SmartHawk

9.0

极危

61 个模型检测该样本为恶意！

重新分析

下载样本

70d5074ab20885ad5cec99b0bb93e8d5f45a4a9374beeb863bfc802f99ce6b5d

2982b154fb8f2d08a4e2ae96afb8a650.exe

分析耗时

265s

最近分析

文件大小

699.0KB

静态报毒动态报毒 AGEN AI SCORE=81 AIDETECTVM ALI2000015 BT3TSM CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS ELDORADO EMOP EMOY FAREIT GENETIC HIGH CONFIDENCE HNBSYZ HPLOKI HSIS IGENT KCLOUD LOKIBOT MALWARE1 MALWARE@#1JBPYQ5U6KZ9Q RGW@AYVVTVII SCORE SIGGEN2 SMBD STATIC AI SUSPICIOUS PE TSCOPE TSGENERIC TSPY UNSAFE X2079 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Baidu		20190318	1.0.0.2
Avast	Win32:Malware-gen	20201210	21.1.5827.0
Alibaba	Trojan:Win32/DelfInject.ali2000015	20190527	0.3.0.5
Kingsoft	Win32.Troj.Undef.(kcloud)	20201211	2017.9.26.565
McAfee	Fareit-FTB!2982B154FB8F	20201211	6.0.6.653
Tencent	Win32.Trojan.Crypt.Hsis	20201211	1.0.0.1
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (50 out of 129 个事件)

Time & API	Arguments	Status
1619374553.572874 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48758596 registers.edi: 0 registers.eax: 0 registers.ebp: 48758664 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 4022337536 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374560.961999 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3 2982b154fb8f2d08a4e2ae96afb8a650+0x54a4d @ 0x454a4d 2982b154fb8f2d08a4e2ae96afb8a650+0x4d254 @ 0x44d254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfcbf14ad	success
1619374553.994249 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48758596 registers.edi: 0 registers.eax: 0 registers.ebp: 48758664 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 408879104 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374577.181374 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49217348 registers.edi: 0 registers.eax: 0 registers.ebp: 49217416 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 1963065344 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374577.462749 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73a5e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73a5ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73a5b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73a5b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73a5ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73a5aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73a55511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73a5559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74117f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74114de3 2982b154fb8f2d08a4e2ae96afb8a650+0x54a4d @ 0x454a4d 2982b154fb8f2d08a4e2ae96afb8a650+0x4d254 @ 0x44d254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe6514ad	success
1619374577.478374 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49479492 registers.edi: 0 registers.eax: 0 registers.ebp: 49479560 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 1946877952 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374577.853874 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48889668 registers.edi: 0 registers.eax: 0 registers.ebp: 48889736 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 2008088576 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374578.525501 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3 2982b154fb8f2d08a4e2ae96afb8a650+0x54a4d @ 0x454a4d 2982b154fb8f2d08a4e2ae96afb8a650+0x4d254 @ 0x44d254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfcd214ad	success
1619374578.525749 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34471748 registers.edi: 0 registers.eax: 0 registers.ebp: 34471816 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 2018574336 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374580.369874 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48299844 registers.edi: 0 registers.eax: 0 registers.ebp: 48299912 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 1634074624 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374581.399999 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73a5e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73a5ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73a5b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73a5b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73a5ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73a5aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73a55511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73a5559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74117f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74114de3 2982b154fb8f2d08a4e2ae96afb8a650+0x54a4d @ 0x454a4d 2982b154fb8f2d08a4e2ae96afb8a650+0x4d254 @ 0x44d254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfcd914ad	success
1619374581.415499 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34668356 registers.edi: 0 registers.eax: 0 registers.ebp: 34668424 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 1700593664 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374582.822374 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35454788 registers.edi: 0 registers.eax: 0 registers.ebp: 35454856 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 1795817472 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374583.759249 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3 2982b154fb8f2d08a4e2ae96afb8a650+0x54a4d @ 0x454a4d 2982b154fb8f2d08a4e2ae96afb8a650+0x4d254 @ 0x44d254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe6014ad	success
1619374583.728874 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48955204 registers.edi: 0 registers.eax: 0 registers.ebp: 48955272 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 1823735808 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374585.134874 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35061572 registers.edi: 0 registers.eax: 0 registers.ebp: 35061640 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 2449670144 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374587.853501 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73a5e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73a5ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73a5b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73a5b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73a5ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73a5aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73a55511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73a5559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74117f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74114de3 2982b154fb8f2d08a4e2ae96afb8a650+0x54a4d @ 0x454a4d 2982b154fb8f2d08a4e2ae96afb8a650+0x4d254 @ 0x44d254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe4c14ad	success
1619374587.775749 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48299844 registers.edi: 0 registers.eax: 0 registers.ebp: 48299912 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 2624782336 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374592.915374 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48758596 registers.edi: 0 registers.eax: 0 registers.ebp: 48758664 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 2962685952 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374593.259749 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741b4de3 2982b154fb8f2d08a4e2ae96afb8a650+0x54a4d @ 0x454a4d 2982b154fb8f2d08a4e2ae96afb8a650+0x4d254 @ 0x44d254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfcd514ad	success
1619374593.197374 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34406212 registers.edi: 0 registers.eax: 0 registers.ebp: 34406280 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 3012624384 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374594.009124 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34602820 registers.edi: 0 registers.eax: 0 registers.ebp: 34602888 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 3033399296 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374595.961999 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7405e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7405ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7405b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7405b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7405ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7405aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74055511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7405559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3 2982b154fb8f2d08a4e2ae96afb8a650+0x54a4d @ 0x454a4d 2982b154fb8f2d08a4e2ae96afb8a650+0x4d254 @ 0x44d254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe6e14ad	success
1619374595.805999 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34668356 registers.edi: 0 registers.eax: 0 registers.ebp: 34668424 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 3185704960 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374598.478874 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35520324 registers.edi: 0 registers.eax: 0 registers.ebp: 35520392 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 2790391808 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374599.134249 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741b4de3 2982b154fb8f2d08a4e2ae96afb8a650+0x54a4d @ 0x454a4d 2982b154fb8f2d08a4e2ae96afb8a650+0x4d254 @ 0x44d254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe8014ad	success
1619374599.119499 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35585860 registers.edi: 0 registers.eax: 0 registers.ebp: 35585928 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 2832400384 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374602.040749 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34668356 registers.edi: 0 registers.eax: 0 registers.ebp: 34668424 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 3558670336 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374606.040374 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73a5e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73a5ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73a5b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73a5b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73a5ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73a5aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73a55511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73a5559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74117f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74114de3 2982b154fb8f2d08a4e2ae96afb8a650+0x54a4d @ 0x454a4d 2982b154fb8f2d08a4e2ae96afb8a650+0x4d254 @ 0x44d254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe7c14ad	success
1619374605.555999 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48824132 registers.edi: 0 registers.eax: 0 registers.ebp: 48824200 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 3287810048 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374607.900124 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48627524 registers.edi: 0 registers.eax: 0 registers.ebp: 48627592 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 3440377856 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374608.822626 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7400e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7400ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7400b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7400b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7400ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7400aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74005511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7400559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74117f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74114de3 2982b154fb8f2d08a4e2ae96afb8a650+0x54a4d @ 0x454a4d 2982b154fb8f2d08a4e2ae96afb8a650+0x4d254 @ 0x44d254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe6a14ad	success
1619374608.478874 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35127108 registers.edi: 0 registers.eax: 0 registers.ebp: 35127176 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 3478257664 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374609.978874 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34144068 registers.edi: 0 registers.eax: 0 registers.ebp: 34144136 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 4113432576 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374610.650874 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73a5e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73a5ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73a5b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73a5b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73a5ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73a5aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73a55511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73a5559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74117f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74114de3 2982b154fb8f2d08a4e2ae96afb8a650+0x54a4d @ 0x454a4d 2982b154fb8f2d08a4e2ae96afb8a650+0x4d254 @ 0x44d254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe7d14ad	success
1619374610.494501 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48627524 registers.edi: 0 registers.eax: 0 registers.ebp: 48627592 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 4147249152 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374614.150124 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34471748 registers.edi: 0 registers.eax: 0 registers.ebp: 34471816 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 3849977856 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374614.915626 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7418e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7418ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7418b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7418b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7418ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7418aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74185511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7418559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74117f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74114de3 2982b154fb8f2d08a4e2ae96afb8a650+0x54a4d @ 0x454a4d 2982b154fb8f2d08a4e2ae96afb8a650+0x4d254 @ 0x44d254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfcd214ad	success
1619374614.915626 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 33750852 registers.edi: 0 registers.eax: 0 registers.ebp: 33750920 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 3860463616 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374616.587249 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49348420 registers.edi: 0 registers.eax: 0 registers.ebp: 49348488 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 4010737664 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374618.119249 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7418e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7418ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7418b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7418b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7418ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7418aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74185511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7418559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74117f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74114de3 2982b154fb8f2d08a4e2ae96afb8a650+0x54a4d @ 0x454a4d 2982b154fb8f2d08a4e2ae96afb8a650+0x4d254 @ 0x44d254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe8814ad	success
1619374617.181874 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49020740 registers.edi: 0 registers.eax: 0 registers.ebp: 49020808 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 286457856 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374620.509501 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35520324 registers.edi: 0 registers.eax: 0 registers.ebp: 35520392 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 475136000 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374621.711999 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7418e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7418ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7418b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7418b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7418ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7418aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74185511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7418559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74117f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74114de3 2982b154fb8f2d08a4e2ae96afb8a650+0x54a4d @ 0x454a4d 2982b154fb8f2d08a4e2ae96afb8a650+0x4d254 @ 0x44d254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfd0414ad	success
1619374621.728626 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35258180 registers.edi: 0 registers.eax: 0 registers.ebp: 35258248 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 50659328 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374633.353874 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48627524 registers.edi: 0 registers.eax: 0 registers.ebp: 48627592 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 780992512 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374634.103501 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7418e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7418ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7418b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7418b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7418ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7418aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74185511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7418559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74117f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74114de3 2982b154fb8f2d08a4e2ae96afb8a650+0x54a4d @ 0x454a4d 2982b154fb8f2d08a4e2ae96afb8a650+0x4d254 @ 0x44d254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe7c14ad	success
1619374634.040749 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48955204 registers.edi: 0 registers.eax: 0 registers.ebp: 48955272 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 1395458048 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374638.462249 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49545028 registers.edi: 0 registers.eax: 0 registers.ebp: 49545096 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 1114832896 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success
1619374640.494374 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34996036 registers.edi: 0 registers.eax: 0 registers.ebp: 34996104 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 1243807744 exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 exception.symbol: 2982b154fb8f2d08a4e2ae96afb8a650+0x5d9ce exception.instruction: div eax exception.module: 2982b154fb8f2d08a4e2ae96afb8a650.exe exception.exception_code: 0xc0000094 exception.offset: 383438 exception.address: 0x45d9ce	success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 1419 个事件)

Time & API	Arguments	Status
1619374553.290874 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success
1619374553.572874 NtProtectVirtualMemory	process_identifier: 648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 40960 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0045d000	success
1619374553.587874 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01fb0000	success
1619374553.946999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619374554.008999 NtAllocateVirtualMemory	process_identifier: 1752 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01fb0000	success
1619374554.008999 NtAllocateVirtualMemory	process_identifier: 1752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x020b0000	success
1619374554.008999 NtAllocateVirtualMemory	process_identifier: 1752 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00690000	success
1619374554.008999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 286720 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00692000	success
1619374559.321999 NtAllocateVirtualMemory	process_identifier: 1752 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x020f0000	success
1619374559.321999 NtAllocateVirtualMemory	process_identifier: 1752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x021e0000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003d2000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003d2000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003d2000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003d2000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003d2000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003d2000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003d2000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003d2000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003d2000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003d2000	success
1619374560.961999 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619374553.994249 NtAllocateVirtualMemory	process_identifier: 1760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success
1619374553.994249 NtProtectVirtualMemory	process_identifier: 1760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 40960 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0045d000	success
1619374554.009249 NtAllocateVirtualMemory	process_identifier: 1760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01f70000	success
1619374577.165374 NtAllocateVirtualMemory	process_identifier: 300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success
1619374577.181374 NtProtectVirtualMemory	process_identifier: 300 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 40960 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0045d000	success
1619374577.181374 NtAllocateVirtualMemory	process_identifier: 300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01e90000	success
1619374577.400749 NtProtectVirtualMemory	process_identifier: 1208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619374577.415749 NtAllocateVirtualMemory	process_identifier: 1208 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01f80000	success
1619374577.415749 NtAllocateVirtualMemory	process_identifier: 1208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02170000	success
1619374577.415749 NtAllocateVirtualMemory	process_identifier: 1208 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01d70000	success
1619374577.415749 NtProtectVirtualMemory	process_identifier: 1208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 286720 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01d72000	success
1619374577.415749 NtAllocateVirtualMemory	process_identifier: 1208 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x021b0000	success
1619374577.415749 NtAllocateVirtualMemory	process_identifier: 1208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02350000	success
1619374577.447749 NtProtectVirtualMemory	process_identifier: 1208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01e32000	success
1619374577.447749 NtProtectVirtualMemory	process_identifier: 1208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619374577.447749 NtProtectVirtualMemory	process_identifier: 1208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01e32000	success
1619374577.447749 NtProtectVirtualMemory	process_identifier: 1208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619374577.447749 NtProtectVirtualMemory	process_identifier: 1208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01e32000	success
1619374577.447749 NtProtectVirtualMemory	process_identifier: 1208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619374577.447749 NtProtectVirtualMemory	process_identifier: 1208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01e32000	success

A process attempted to delay the analysis task. (1 个事件)

description

2982b154fb8f2d08a4e2ae96afb8a650.exe tried to sleep 141 seconds, actually delayed analysis time by 141 seconds

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (50 out of 115 个事件)

Time & API	Arguments	Status	Return
1619374554.009249 Process32NextW	process_name: conhost.exe snapshot_handle: 0x000000fc process_identifier: 1056	success	1
1619374577.478374 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3184	success	1
1619374578.540749 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3336	success	1
1619374578.540749 Process32NextW	process_name: is32bit.exe snapshot_handle: 0x000000f8 process_identifier: 3416	success	1
1619374581.415499 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3520	success	1
1619374581.415499 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3580	success	1
1619374581.415499 Process32NextW	process_name: is32bit.exe snapshot_handle: 0x000000f8 process_identifier: 3656	success	1
1619374583.744874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3756	success	1
1619374583.744874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3816	success	1
1619374585.150874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3924	success	1
1619374587.775749 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 4000	success	1
1619374595.805999 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3624	success	1
1619374595.805999 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3728	success	1
1619374598.478874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3864	success	1
1619374599.119499 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3996	success	1
1619374599.119499 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 4076	success	1
1619374605.555999 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000fc process_identifier: 3404	success	1
1619374605.555999 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000fc process_identifier: 3560	success	1
1619374607.900124 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3812	success	1
1619374608.478874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3732	success	1
1619374608.478874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 4044	success	1
1619374610.494501 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3188	success	1
1619374610.494501 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 4084	success	1
1619374613.994501 Process32NextW	process_name: inject-x64.exe snapshot_handle: 0x0000017c process_identifier: 3668	success	1
1619374614.165124 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3908	success	1
1619374614.165124 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 4012	success	1
1619374614.915626 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3652	success	1
1619374614.915626 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3760	success	1
1619374616.587249 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3224	success	1
1619374617.181874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 1924	success	1
1619374621.728626 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 1892	success	1
1619374634.040749 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 652	success	1
1619374638.462249 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 1604	success	1
1619374640.494374 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3956	success	1
1619374643.853874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3012	success	1
1619374645.525249 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 2568	success	1
1619374648.728874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000fc process_identifier: 3260	success	1
1619374650.150749 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 4116	success	1
1619374650.150749 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 4144	success	1
1619374656.119874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 4176	success	1
1619374656.119874 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 4232	success	1
1619374657.087249 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 4248	success	1
1619374657.087249 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 4308	success	1
1619374657.087249 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 4368	success	1
1619374657.087249 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 4396	success	1
1619374667.884499 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 4436	success	1
1619374669.915874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 4508	success	1
1619374669.915874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 4568	success	1
1619374672.900124 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 4684	success	1
1619374674.993999 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 4756	success	1

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.5019801615452835

section

{'size_of_data': '0x0003e400', 'virtual_address': '0x00076000', 'entropy': 7.5019801615452835, 'name': '.rsrc', 'virtual_size': '0x0003e3a0'}

description

A section with a high entropy has been found

entropy

0.35673352435530087

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 个事件)

process

2982b154fb8f2d08a4e2ae96afb8a650.exe

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (50 out of 86 个事件)

Time & API	Arguments	Status
1619374553.587874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 648	failed
1619374576.978249 Process32NextW	process_name: dllhost.exe snapshot_handle: 0x0000044c process_identifier: 2964	failed
1619374577.181374 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000fc process_identifier: 300	failed
1619374577.697374 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x00000104 process_identifier: 3088	failed
1619374577.869874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3192	failed
1619374580.181749 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x00000138 process_identifier: 3336	failed
1619374580.369874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3444	failed
1619374582.619499 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x00000128 process_identifier: 3580	failed
1619374582.837374 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3684	failed
1619374584.947874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x00000128 process_identifier: 3816	failed
1619374585.150874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3924	failed
1619374590.290749 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x00000158 process_identifier: 4060	failed
1619374592.931374 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3172	failed
1619374593.853374 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x00000114 process_identifier: 3160	failed
1619374594.009124 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000fc process_identifier: 3532	failed
1619374598.336999 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x00000158 process_identifier: 3728	failed
1619374598.478874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3864	failed
1619374601.853499 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x00000160 process_identifier: 4076	failed
1619374602.040749 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000fc process_identifier: 3748	failed
1619374607.743999 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x00000150 process_identifier: 3560	failed
1619374607.900124 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3812	failed
1619374609.790874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x0000012c process_identifier: 4044	failed
1619374609.978874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000fc process_identifier: 2440	failed
1619374613.994501 Process32NextW	process_name: inject-x64.exe snapshot_handle: 0x0000017c process_identifier: 3668	failed
1619374614.165124 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 4012	failed
1619374616.447626 Process32NextW	process_name: mscorsvw.exe snapshot_handle: 0x00000134 process_identifier: 1344	failed
1619374616.587249 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3224	failed
1619374620.353874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x00000170 process_identifier: 2668	failed
1619374620.509501 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3056	failed
1619374633.212626 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000002a0 process_identifier: 2852	failed
1619374633.353874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 2760	failed
1619374638.322749 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x00000198 process_identifier: 652	failed
1619374638.462249 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 1604	failed
1619374640.494374 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 3956	failed
1619374643.681374 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x00000170 process_identifier: 3956	failed
1619374648.587249 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x0000016c process_identifier: 2568	failed
1619374648.728874 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000fc process_identifier: 520	failed
1619374655.962749 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000001d0 process_identifier: 1380	failed
1619374656.119874 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 4232	failed
1619374667.728249 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x00000280 process_identifier: 4308	failed
1619374667.884499 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 4436	failed
1619374672.697874 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x00000160 process_identifier: 4568	failed
1619374672.900124 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 4684	failed
1619374677.633999 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x0000015c process_identifier: 4832	failed
1619374677.775749 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 4952	failed
1619374682.165749 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x0000016c process_identifier: 4192	failed
1619374682.322626 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 4204	failed
1619374684.775626 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x000000f8 process_identifier: 4404	failed
1619374689.915626 Process32NextW	process_name: sppsvc.exe snapshot_handle: 0x000001b8 process_identifier: 4724	failed
1619374693.712249 Process32NextW	process_name: 2982b154fb8f2d08a4e2ae96afb8a650.exe snapshot_handle: 0x00000160 process_identifier: 4964	failed

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (50 out of 86 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 648 called NtSetContextThread to modify thread in remote process 1752
Process injection	Process 300 called NtSetContextThread to modify thread in remote process 1208
Process injection	Process 3192 called NtSetContextThread to modify thread in remote process 3276
Process injection	Process 3444 called NtSetContextThread to modify thread in remote process 3520
Process injection	Process 3684 called NtSetContextThread to modify thread in remote process 3756
Process injection	Process 3924 called NtSetContextThread to modify thread in remote process 4000
Process injection	Process 3172 called NtSetContextThread to modify thread in remote process 3332
Process injection	Process 3532 called NtSetContextThread to modify thread in remote process 3624
Process injection	Process 3864 called NtSetContextThread to modify thread in remote process 3996
Process injection	Process 3748 called NtSetContextThread to modify thread in remote process 3404
Process injection	Process 3812 called NtSetContextThread to modify thread in remote process 3732
Process injection	Process 2440 called NtSetContextThread to modify thread in remote process 3188
Process injection	Process 3908 called NtSetContextThread to modify thread in remote process 3652
Process injection	Process 3224 called NtSetContextThread to modify thread in remote process 1924
Process injection	Process 3056 called NtSetContextThread to modify thread in remote process 3524
Process injection	Process 2760 called NtSetContextThread to modify thread in remote process 2576
Process injection	Process 1604 called NtSetContextThread to modify thread in remote process 3040
Process injection	Process 3012 called NtSetContextThread to modify thread in remote process 628
Process injection	Process 3260 called NtSetContextThread to modify thread in remote process 2496
Process injection	Process 4176 called NtSetContextThread to modify thread in remote process 4248
Process injection	Process 4436 called NtSetContextThread to modify thread in remote process 4508
Process injection	Process 4684 called NtSetContextThread to modify thread in remote process 4756
Process injection	Process 4952 called NtSetContextThread to modify thread in remote process 5028
Process injection	Process 4204 called NtSetContextThread to modify thread in remote process 4348
Process injection	Process 3716 called NtSetContextThread to modify thread in remote process 4688
1619374553.650874 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1752	success	0	0
1619374577.228374 NtSetContextThread	thread_handle: 0x00000100 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1208	success	0	0
1619374577.994874 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3276	success	0	0
1619374580.728874 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3520	success	0	0
1619374583.197374 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3756	success	0	0
1619374586.556874 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 4000	success	0	0
1619374592.994374 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3332	success	0	0
1619374594.712124 NtSetContextThread	thread_handle: 0x00000100 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3624	success	0	0
1619374598.540874 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3996	success	0	0
1619374602.384749 NtSetContextThread	thread_handle: 0x00000100 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3404	success	0	0
1619374607.962124 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3732	success	0	0
1619374610.212874 NtSetContextThread	thread_handle: 0x00000100 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3188	success	0	0
1619374614.494124 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3652	success	0	0
1619374616.712249 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1924	success	0	0
1619374621.525501 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3524	success	0	0
1619374633.650874 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2576	success	0	0
1619374638.603249 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3040	success	0	0
1619374644.103874 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 628	success	0	0
1619374648.790874 NtSetContextThread	thread_handle: 0x00000100 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2496	success	0	0
1619374656.306874 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 4248	success	0	0
1619374668.400499 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 4508	success	0	0
1619374673.619124 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 4756	success	0	0
1619374678.462749 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 5028	success	0	0
1619374684.447626 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 4348	success	0	0
1619374690.289999 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 4688	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (50 out of 86 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 648 resumed a thread in remote process 1752
Process injection	Process 300 resumed a thread in remote process 1208
Process injection	Process 3192 resumed a thread in remote process 3276
Process injection	Process 3444 resumed a thread in remote process 3520
Process injection	Process 3684 resumed a thread in remote process 3756
Process injection	Process 3924 resumed a thread in remote process 4000
Process injection	Process 3172 resumed a thread in remote process 3332
Process injection	Process 3532 resumed a thread in remote process 3624
Process injection	Process 3864 resumed a thread in remote process 3996
Process injection	Process 3748 resumed a thread in remote process 3404
Process injection	Process 3812 resumed a thread in remote process 3732
Process injection	Process 2440 resumed a thread in remote process 3188
Process injection	Process 3908 resumed a thread in remote process 3652
Process injection	Process 3224 resumed a thread in remote process 1924
Process injection	Process 3056 resumed a thread in remote process 3524
Process injection	Process 2760 resumed a thread in remote process 2576
Process injection	Process 1604 resumed a thread in remote process 3040
Process injection	Process 3012 resumed a thread in remote process 628
Process injection	Process 3260 resumed a thread in remote process 2496
Process injection	Process 4176 resumed a thread in remote process 4248
Process injection	Process 4436 resumed a thread in remote process 4508
Process injection	Process 4684 resumed a thread in remote process 4756
Process injection	Process 4952 resumed a thread in remote process 5028
Process injection	Process 4204 resumed a thread in remote process 4348
Process injection	Process 3716 resumed a thread in remote process 4688
1619374553.790874 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 1752	success	0	0
1619374577.275374 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 1208	success	0	0
1619374578.353874 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 3276	success	0	0
1619374581.150874 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 3520	success	0	0
1619374583.587374 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 3756	success	0	0
1619374587.603874 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 4000	success	0	0
1619374593.025374 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 3332	success	0	0
1619374595.665124 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 3624	success	0	0
1619374598.947874 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 3996	success	0	0
1619374605.400749 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 3404	success	0	0
1619374608.306124 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 3732	success	0	0
1619374610.337874 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 3188	success	0	0
1619374614.665124 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 3652	success	0	0
1619374616.915249 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 1924	success	0	0
1619374621.556501 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 3524	success	0	0
1619374633.853874 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 2576	success	0	0
1619374640.275249 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 3040	success	0	0
1619374645.306874 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 628	success	0	0
1619374649.884874 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 2496	success	0	0
1619374656.837874 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 4248	success	0	0
1619374669.697499 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 4508	success	0	0
1619374674.744124 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 4756	success	0	0
1619374678.822749 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 5028	success	0	0
1619374684.556626 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 4348	success	0	0
1619374690.821999 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 4688	success	0	0

Executed a process and injected code into it, probably while unpacking (50 out of 343 个事件)

Time & API	Arguments	Status	Return
1619374553.634874 CreateProcessInternalW	thread_identifier: 2544 thread_handle: 0x000000fc process_identifier: 1752 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619374553.634874 NtUnmapViewOfSection	process_identifier: 1752 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619374553.634874 NtMapViewOfSection	section_handle: 0x00000108 process_identifier: 1752 commit_size: 671744 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 671744 base_address: 0x00400000	success	0
1619374553.650874 NtGetContextThread	thread_handle: 0x000000fc	success	0
1619374553.650874 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1752	success	0
1619374553.790874 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 1752	success	0
1619374553.822874 CreateProcessInternalW	thread_identifier: 2236 thread_handle: 0x00000104 process_identifier: 1760 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe" 2 1752 8500671 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000114 inherit_handles: 0	success	1
1619374577.025249 CreateProcessInternalW	thread_identifier: 3056 thread_handle: 0x00000450 process_identifier: 300 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000454 inherit_handles: 0	success	1
1619374577.212374 CreateProcessInternalW	thread_identifier: 2940 thread_handle: 0x00000100 process_identifier: 1208 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000104 inherit_handles: 0	success	1
1619374577.228374 NtUnmapViewOfSection	process_identifier: 1208 region_size: 4096 process_handle: 0x00000104 base_address: 0x00400000	success	0
1619374577.228374 NtMapViewOfSection	section_handle: 0x0000010c process_identifier: 1208 commit_size: 671744 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000104 allocation_type: 0 () section_offset: 0 view_size: 671744 base_address: 0x00400000	success	0
1619374577.228374 NtGetContextThread	thread_handle: 0x00000100	success	0
1619374577.228374 NtSetContextThread	thread_handle: 0x00000100 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1208	success	0
1619374577.275374 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 1208	success	0
1619374577.290374 CreateProcessInternalW	thread_identifier: 3092 thread_handle: 0x00000108 process_identifier: 3088 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe" 2 1208 8524156 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000118 inherit_handles: 0	success	1
1619374577.712374 CreateProcessInternalW	thread_identifier: 3196 thread_handle: 0x00000108 process_identifier: 3192 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x0000010c inherit_handles: 0	success	1
1619374577.962874 CreateProcessInternalW	thread_identifier: 3280 thread_handle: 0x000000fc process_identifier: 3276 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619374577.962874 NtUnmapViewOfSection	process_identifier: 3276 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619374577.962874 NtMapViewOfSection	section_handle: 0x00000108 process_identifier: 3276 commit_size: 671744 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 671744 base_address: 0x00400000	success	0
1619374577.994874 NtGetContextThread	thread_handle: 0x000000fc	success	0
1619374577.994874 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3276	success	0
1619374578.353874 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 3276	success	0
1619374578.384874 CreateProcessInternalW	thread_identifier: 3340 thread_handle: 0x00000104 process_identifier: 3336 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe" 2 3276 8525234 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000114 inherit_handles: 0	success	1
1619374580.197749 CreateProcessInternalW	thread_identifier: 3448 thread_handle: 0x0000013c process_identifier: 3444 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000140 inherit_handles: 0	success	1
1619374580.415874 CreateProcessInternalW	thread_identifier: 3524 thread_handle: 0x000000fc process_identifier: 3520 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619374580.415874 NtUnmapViewOfSection	process_identifier: 3520 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619374580.415874 NtMapViewOfSection	section_handle: 0x00000108 process_identifier: 3520 commit_size: 671744 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 671744 base_address: 0x00400000	success	0
1619374580.728874 NtGetContextThread	thread_handle: 0x000000fc	success	0
1619374580.728874 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3520	success	0
1619374581.150874 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 3520	success	0
1619374581.212874 CreateProcessInternalW	thread_identifier: 3584 thread_handle: 0x00000104 process_identifier: 3580 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe" 2 3520 8528031 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000114 inherit_handles: 0	success	1
1619374582.650499 CreateProcessInternalW	thread_identifier: 3688 thread_handle: 0x0000012c process_identifier: 3684 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000130 inherit_handles: 0	success	1
1619374582.884374 CreateProcessInternalW	thread_identifier: 3760 thread_handle: 0x000000fc process_identifier: 3756 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619374582.884374 NtUnmapViewOfSection	process_identifier: 3756 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619374582.884374 NtMapViewOfSection	section_handle: 0x00000108 process_identifier: 3756 commit_size: 671744 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 671744 base_address: 0x00400000	success	0
1619374583.197374 NtGetContextThread	thread_handle: 0x000000fc	success	0
1619374583.197374 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3756	success	0
1619374583.587374 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 3756	success	0
1619374583.603374 CreateProcessInternalW	thread_identifier: 3820 thread_handle: 0x00000104 process_identifier: 3816 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe" 2 3756 8530468 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000114 inherit_handles: 0	success	1
1619374584.962874 CreateProcessInternalW	thread_identifier: 3928 thread_handle: 0x0000012c process_identifier: 3924 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000130 inherit_handles: 0	success	1
1619374585.306874 CreateProcessInternalW	thread_identifier: 4004 thread_handle: 0x000000fc process_identifier: 4000 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619374585.306874 NtUnmapViewOfSection	process_identifier: 4000 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619374585.306874 NtMapViewOfSection	section_handle: 0x00000108 process_identifier: 4000 commit_size: 671744 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 671744 base_address: 0x00400000	success	0
1619374586.556874 NtGetContextThread	thread_handle: 0x000000fc	success	0
1619374586.556874 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4859424 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 4000	success	0
1619374587.603874 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 4000	success	0
1619374587.634874 CreateProcessInternalW	thread_identifier: 4064 thread_handle: 0x00000104 process_identifier: 4060 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe" 2 4000 8534484 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000114 inherit_handles: 0	success	1
1619374592.790749 CreateProcessInternalW	thread_identifier: 3188 thread_handle: 0x0000015c process_identifier: 3172 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000160 inherit_handles: 0	success	1
1619374592.994374 CreateProcessInternalW	thread_identifier: 3352 thread_handle: 0x000000fc process_identifier: 3332 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2982b154fb8f2d08a4e2ae96afb8a650.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619374592.994374 NtUnmapViewOfSection	process_identifier: 3332 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0

File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Delf.FareIt.Gen.7
FireEye	Generic.mg.2982b154fb8f2d08
ALYac	Trojan.Delf.FareIt.Gen.7
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.Delf.FareIt.Gen.7
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.9c9d17
Cyren	W32/Injector.ABY.gen!Eldorado
Symantec	Infostealer.Lokibot!43
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Trojan.Fareit-8723799-0
Kaspersky	HEUR:Trojan.Win32.Crypt.gen
Alibaba	Trojan:Win32/DelfInject.ali2000015
NANO-Antivirus	Trojan.Win32.Crypt.hnbsyz
AegisLab	Trojan.Win32.Crypt.4!c
Rising	Trojan.Injector!1.C99D (CLASSIC)
Ad-Aware	Trojan.Delf.FareIt.Gen.7
Emsisoft	Trojan.Delf.FareIt.Gen.7 (B)
Comodo	Malware@#1jbpyq5u6kz9q
F-Secure	Heuristic.HEUR/AGEN.1137572
DrWeb	Trojan.PWS.Siggen2.51483
Zillya	Dropper.Agent.Win32.430725
TrendMicro	TSPY_HPLOKI.SMBD
McAfee-GW-Edition	BehavesLike.Win32.Fareit.jc
Sophos	Mal/Generic-S
Ikarus	Trojan.Inject
Jiangmin	Trojan.Crypt.dso
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1137572
eGambit	Unsafe.AI_Score_99%
MAX	malware (ai score=81)
Antiy-AVL	Trojan/Win32.TSGeneric
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	PWS:Win32/Fareit.AO!MTB
Arcabit	Trojan.Delf.FareIt.Gen.7
ZoneAlarm	HEUR:Trojan.Win32.Crypt.gen
GData	Trojan.Delf.FareIt.Gen.7
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2079
McAfee	Fareit-FTB!2982B154FB8F
VBA32	TScope.Trojan.Delf
Malwarebytes	Trojan.MalPack.DLF
Panda	Trj/Genetic.gen
Zoner	Trojan.Win32.91477

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	216.58.200.238:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x46a12c DeleteCriticalSection

• 0x46a130 LeaveCriticalSection

• 0x46a134 EnterCriticalSection

• 0x46a138 InitializeCriticalSection

• 0x46a13c VirtualFree

• 0x46a140 VirtualAlloc

• 0x46a144 LocalFree

• 0x46a148 LocalAlloc

• 0x46a14c GetVersion

• 0x46a150 GetCurrentThreadId

• 0x46a154 InterlockedDecrement

• 0x46a158 InterlockedIncrement

• 0x46a15c VirtualQuery

• 0x46a160 WideCharToMultiByte

• 0x46a164 MultiByteToWideChar

• 0x46a168 lstrlenA

• 0x46a16c lstrcpynA

• 0x46a170 LoadLibraryExA

• 0x46a174 GetThreadLocale

• 0x46a178 GetStartupInfoA

• 0x46a17c GetProcAddress

• 0x46a180 GetModuleHandleA

• 0x46a184 GetModuleFileNameA

• 0x46a188 GetLocaleInfoA

• 0x46a18c GetCommandLineA

• 0x46a190 FreeLibrary

• 0x46a194 FindFirstFileA

• 0x46a198 FindClose

• 0x46a19c ExitProcess

• 0x46a1a0 WriteFile

• 0x46a1a4 UnhandledExceptionFilter

• 0x46a1a8 RtlUnwind

• 0x46a1ac RaiseException

• 0x46a1b0 GetStdHandle

Library user32.dll:

• 0x46a1b8 GetKeyboardType

• 0x46a1bc LoadStringA

• 0x46a1c0 MessageBoxA

• 0x46a1c4 CharNextA

Library advapi32.dll:

• 0x46a1cc RegQueryValueExA

• 0x46a1d0 RegOpenKeyExA

• 0x46a1d4 RegCloseKey

Library oleaut32.dll:

• 0x46a1dc SysFreeString

• 0x46a1e0 SysReAllocStringLen

• 0x46a1e4 SysAllocStringLen

Library kernel32.dll:

• 0x46a1ec TlsSetValue

• 0x46a1f0 TlsGetValue

• 0x46a1f4 LocalAlloc

• 0x46a1f8 GetModuleHandleA

Library advapi32.dll:

• 0x46a200 RegQueryValueExA

• 0x46a204 RegOpenKeyExA

• 0x46a208 RegCloseKey

Library kernel32.dll:

• 0x46a210 lstrcpyA

• 0x46a214 WriteFile

• 0x46a218 WaitForSingleObject

• 0x46a21c VirtualQuery

• 0x46a220 VirtualProtectEx

• 0x46a224 VirtualAlloc

• 0x46a228 Sleep

• 0x46a22c SizeofResource

• 0x46a230 SetThreadLocale

• 0x46a234 SetFilePointer

• 0x46a238 SetEvent

• 0x46a23c SetErrorMode

• 0x46a240 SetEndOfFile

• 0x46a244 ResetEvent

• 0x46a248 ReadFile

• 0x46a24c MulDiv

• 0x46a250 LockResource

• 0x46a254 LoadResource

• 0x46a258 LoadLibraryA

• 0x46a25c LeaveCriticalSection

• 0x46a260 InitializeCriticalSection

• 0x46a264 GlobalUnlock

• 0x46a268 GlobalReAlloc

• 0x46a26c GlobalHandle

• 0x46a270 GlobalLock

• 0x46a274 GlobalFree

• 0x46a278 GlobalFindAtomA

• 0x46a27c GlobalDeleteAtom

• 0x46a280 GlobalAlloc

• 0x46a284 GlobalAddAtomA

• 0x46a288 GetVersionExA

• 0x46a28c GetVersion

• 0x46a290 GetTickCount

• 0x46a294 GetThreadLocale

• 0x46a298 GetSystemInfo

• 0x46a29c GetStringTypeExA

• 0x46a2a0 GetStdHandle

• 0x46a2a4 GetProcAddress

• 0x46a2a8 GetModuleHandleA

• 0x46a2ac GetModuleFileNameA

• 0x46a2b0 GetLocaleInfoA

• 0x46a2b4 GetLocalTime

• 0x46a2b8 GetLastError

• 0x46a2bc GetFullPathNameA

• 0x46a2c0 GetFileType

• 0x46a2c4 GetFileAttributesA

• 0x46a2c8 GetDiskFreeSpaceA

• 0x46a2cc GetDateFormatA

• 0x46a2d0 GetCurrentThreadId

• 0x46a2d4 GetCurrentProcessId

• 0x46a2d8 GetCurrentProcess

• 0x46a2dc GetCPInfo

• 0x46a2e0 GetACP

• 0x46a2e4 FreeResource

• 0x46a2e8 InterlockedExchange

• 0x46a2ec FreeLibrary

• 0x46a2f0 FormatMessageA

• 0x46a2f4 FindResourceA

• 0x46a2f8 FindFirstFileA

• 0x46a2fc FindClose

• 0x46a300 FileTimeToLocalFileTime

• 0x46a304 FileTimeToDosDateTime

• 0x46a308 EnumCalendarInfoA

• 0x46a30c EnterCriticalSection

• 0x46a310 DeleteCriticalSection

• 0x46a314 CreateThread

• 0x46a318 CreateFileA

• 0x46a31c CreateEventA

• 0x46a320 CompareStringA

• 0x46a324 CloseHandle

Library version.dll:

• 0x46a32c VerQueryValueA

• 0x46a330 GetFileVersionInfoSizeA

• 0x46a334 GetFileVersionInfoA

Library gdi32.dll:

• 0x46a33c UnrealizeObject

• 0x46a340 StretchBlt

• 0x46a344 SetWindowOrgEx

• 0x46a348 SetWinMetaFileBits

• 0x46a34c SetViewportOrgEx

• 0x46a350 SetTextColor

• 0x46a354 SetStretchBltMode

• 0x46a358 SetROP2

• 0x46a35c SetPixel

• 0x46a360 SetEnhMetaFileBits

• 0x46a364 SetDIBColorTable

• 0x46a368 SetBrushOrgEx

• 0x46a36c SetBkMode

• 0x46a370 SetBkColor

• 0x46a374 SelectPalette

• 0x46a378 SelectObject

• 0x46a37c SelectClipRgn

• 0x46a380 SaveDC

• 0x46a384 RestoreDC

• 0x46a388 Rectangle

• 0x46a38c RectVisible

• 0x46a390 RealizePalette

• 0x46a394 Polyline

• 0x46a398 PlayEnhMetaFile

• 0x46a39c PatBlt

• 0x46a3a0 MoveToEx

• 0x46a3a4 MaskBlt

• 0x46a3a8 LineTo

• 0x46a3ac IntersectClipRect

• 0x46a3b0 GetWindowOrgEx

• 0x46a3b4 GetWinMetaFileBits

• 0x46a3b8 GetTextMetricsA

• 0x46a3bc GetTextExtentPoint32A

• 0x46a3c0 GetSystemPaletteEntries

• 0x46a3c4 GetStockObject

• 0x46a3c8 GetPixel

• 0x46a3cc GetPaletteEntries

• 0x46a3d0 GetObjectA

• 0x46a3d4 GetEnhMetaFilePaletteEntries

• 0x46a3d8 GetEnhMetaFileHeader

• 0x46a3dc GetEnhMetaFileBits

• 0x46a3e0 GetDeviceCaps

• 0x46a3e4 GetDIBits

• 0x46a3e8 GetDIBColorTable

• 0x46a3ec GetDCOrgEx

• 0x46a3f0 GetCurrentPositionEx

• 0x46a3f4 GetClipRgn

• 0x46a3f8 GetClipBox

• 0x46a3fc GetBrushOrgEx

• 0x46a400 GetBitmapBits

• 0x46a404 ExcludeClipRect

• 0x46a408 DeleteObject

• 0x46a40c DeleteEnhMetaFile

• 0x46a410 DeleteDC

• 0x46a414 CreateSolidBrush

• 0x46a418 CreateRectRgn

• 0x46a41c CreatePenIndirect

• 0x46a420 CreatePalette

• 0x46a424 CreateHalftonePalette

• 0x46a428 CreateFontIndirectA

• 0x46a42c CreateDIBitmap

• 0x46a430 CreateDIBSection

• 0x46a434 CreateCompatibleDC

• 0x46a438 CreateCompatibleBitmap

• 0x46a43c CreateBrushIndirect

• 0x46a440 CreateBitmap

• 0x46a444 CopyEnhMetaFileA

• 0x46a448 BitBlt

Library user32.dll:

• 0x46a450 CreateWindowExA

• 0x46a454 WindowFromPoint

• 0x46a458 WinHelpA

• 0x46a45c WaitMessage

• 0x46a460 UpdateWindow

• 0x46a464 UnregisterClassA

• 0x46a468 UnhookWindowsHookEx

• 0x46a46c TranslateMessage

• 0x46a470 TranslateMDISysAccel

• 0x46a474 TrackPopupMenu

• 0x46a478 SystemParametersInfoA

• 0x46a47c ShowWindow

• 0x46a480 ShowScrollBar

• 0x46a484 ShowOwnedPopups

• 0x46a488 ShowCursor

• 0x46a48c SetWindowsHookExA

• 0x46a490 SetWindowPos

• 0x46a494 SetWindowPlacement

• 0x46a498 SetWindowLongA

• 0x46a49c SetTimer

• 0x46a4a0 SetScrollRange

• 0x46a4a4 SetScrollPos

• 0x46a4a8 SetScrollInfo

• 0x46a4ac SetRect

• 0x46a4b0 SetPropA

• 0x46a4b4 SetParent

• 0x46a4b8 SetMenuItemInfoA

• 0x46a4bc SetMenu

• 0x46a4c0 SetForegroundWindow

• 0x46a4c4 SetFocus

• 0x46a4c8 SetCursor

• 0x46a4cc SetClassLongA

• 0x46a4d0 SetCapture

• 0x46a4d4 SetActiveWindow

• 0x46a4d8 SendMessageA

• 0x46a4dc ScrollWindow

• 0x46a4e0 ScreenToClient

• 0x46a4e4 RemovePropA

• 0x46a4e8 RemoveMenu

• 0x46a4ec ReleaseDC

• 0x46a4f0 ReleaseCapture

• 0x46a4f4 RegisterWindowMessageA

• 0x46a4f8 RegisterClipboardFormatA

• 0x46a4fc RegisterClassA

• 0x46a500 RedrawWindow

• 0x46a504 PtInRect

• 0x46a508 PostQuitMessage

• 0x46a50c PostMessageA

• 0x46a510 PeekMessageA

• 0x46a514 OffsetRect

• 0x46a518 OemToCharA

• 0x46a51c MessageBoxA

• 0x46a520 MapWindowPoints

• 0x46a524 MapVirtualKeyA

• 0x46a528 LoadStringA

• 0x46a52c LoadKeyboardLayoutA

• 0x46a530 LoadIconA

• 0x46a534 LoadCursorA

• 0x46a538 LoadBitmapA

• 0x46a53c KillTimer

• 0x46a540 IsZoomed

• 0x46a544 IsWindowVisible

• 0x46a548 IsWindowEnabled

• 0x46a54c IsWindow

• 0x46a550 IsRectEmpty

• 0x46a554 IsIconic

• 0x46a558 IsDialogMessageA

• 0x46a55c IsChild

• 0x46a560 InvalidateRect

• 0x46a564 IntersectRect

• 0x46a568 InsertMenuItemA

• 0x46a56c InsertMenuA

• 0x46a570 InflateRect

• 0x46a574 GetWindowThreadProcessId

• 0x46a578 GetWindowTextA

• 0x46a57c GetWindowRect

• 0x46a580 GetWindowPlacement

• 0x46a584 GetWindowLongA

• 0x46a588 GetWindowDC

• 0x46a58c GetTopWindow

• 0x46a590 GetSystemMetrics

• 0x46a594 GetSystemMenu

• 0x46a598 GetSysColorBrush

• 0x46a59c GetSysColor

• 0x46a5a0 GetSubMenu

• 0x46a5a4 GetScrollRange

• 0x46a5a8 GetScrollPos

• 0x46a5ac GetScrollInfo

• 0x46a5b0 GetPropA

• 0x46a5b4 GetParent

• 0x46a5b8 GetWindow

• 0x46a5bc GetMenuStringA

• 0x46a5c0 GetMenuState

• 0x46a5c4 GetMenuItemInfoA

• 0x46a5c8 GetMenuItemID

• 0x46a5cc GetMenuItemCount

• 0x46a5d0 GetMenu

• 0x46a5d4 GetLastActivePopup

• 0x46a5d8 GetKeyboardState

• 0x46a5dc GetKeyboardLayoutList

• 0x46a5e0 GetKeyboardLayout

• 0x46a5e4 GetKeyState

• 0x46a5e8 GetKeyNameTextA

• 0x46a5ec GetIconInfo

• 0x46a5f0 GetForegroundWindow

• 0x46a5f4 GetFocus

• 0x46a5f8 GetDlgItem

• 0x46a5fc GetDesktopWindow

• 0x46a600 GetDCEx

• 0x46a604 GetDC

• 0x46a608 GetCursorPos

• 0x46a60c GetCursor

• 0x46a610 GetClipboardData

• 0x46a614 GetClientRect

• 0x46a618 GetClassNameA

• 0x46a61c GetClassInfoA

• 0x46a620 GetCapture

• 0x46a624 GetActiveWindow

• 0x46a628 FrameRect

• 0x46a62c FindWindowA

• 0x46a630 FillRect

• 0x46a634 EqualRect

• 0x46a638 EnumWindows

• 0x46a63c EnumThreadWindows

• 0x46a640 EndPaint

• 0x46a644 EnableWindow

• 0x46a648 EnableScrollBar

• 0x46a64c EnableMenuItem

• 0x46a650 DrawTextA

• 0x46a654 DrawMenuBar

• 0x46a658 DrawIconEx

• 0x46a65c DrawIcon

• 0x46a660 DrawFrameControl

• 0x46a664 DrawFocusRect

• 0x46a668 DrawEdge

• 0x46a66c DispatchMessageA

• 0x46a670 DestroyWindow

• 0x46a674 DestroyMenu

• 0x46a678 DestroyIcon

• 0x46a67c DestroyCursor

• 0x46a680 DeleteMenu

• 0x46a684 DefWindowProcA

• 0x46a688 DefMDIChildProcA

• 0x46a68c DefFrameProcA

• 0x46a690 CreatePopupMenu

• 0x46a694 CreateMenu

• 0x46a698 CreateIcon

• 0x46a69c ClientToScreen

• 0x46a6a0 CheckMenuItem

• 0x46a6a4 CallWindowProcA

• 0x46a6a8 CallNextHookEx

• 0x46a6ac BeginPaint

• 0x46a6b0 CharNextA

• 0x46a6b4 CharLowerBuffA

• 0x46a6b8 CharLowerA

• 0x46a6bc CharToOemA

• 0x46a6c0 AdjustWindowRectEx

• 0x46a6c4 ActivateKeyboardLayout

Library kernel32.dll:

• 0x46a6cc Sleep

Library oleaut32.dll:

• 0x46a6d4 SafeArrayPtrOfIndex

• 0x46a6d8 SafeArrayGetUBound

• 0x46a6dc SafeArrayGetLBound

• 0x46a6e0 SafeArrayCreate

• 0x46a6e4 VariantChangeType

• 0x46a6e8 VariantCopy

• 0x46a6ec VariantClear

• 0x46a6f0 VariantInit

Library comctl32.dll:

• 0x46a6f8 ImageList_SetIconSize

• 0x46a6fc ImageList_GetIconSize

• 0x46a700 ImageList_Write

• 0x46a704 ImageList_Read

• 0x46a708 ImageList_GetDragImage

• 0x46a70c ImageList_DragShowNolock

• 0x46a710 ImageList_SetDragCursorImage

• 0x46a714 ImageList_DragMove

• 0x46a718 ImageList_DragLeave

• 0x46a71c ImageList_DragEnter

• 0x46a720 ImageList_EndDrag

• 0x46a724 ImageList_BeginDrag

• 0x46a728 ImageList_Remove

• 0x46a72c ImageList_DrawEx

• 0x46a730 ImageList_Replace

• 0x46a734 ImageList_Draw

• 0x46a738 ImageList_GetBkColor

• 0x46a73c ImageList_SetBkColor

• 0x46a740 ImageList_ReplaceIcon

• 0x46a744 ImageList_Add

• 0x46a748 ImageList_GetImageCount

• 0x46a74c ImageList_Destroy

• 0x46a750 ImageList_Create

Library comdlg32.dll:

• 0x46a758 GetSaveFileNameA

• 0x46a75c GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	CNAME clients.l.google.com A 216.58.200.238 A 172.217.160.78	172.217.24.14
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.