SmartHawk

3.6

中危

59 个模型检测该样本为恶意！

重新分析

下载样本

73849ce478a894f10589cc31aece7dcb8a39c1c43a4a5c401b2dae86b53bb9c7

511caf41153634fb5b39f436bd45c885.exe

分析耗时

55s

最近分析

文件大小

212.0KB

静态报毒动态报毒 100% 7XXPC80EKNA AGEN AI SCORE=100 AIDETECTVM CCMW CFSA CONFIDENCE CRIDEX DRIDEX DRIXED EMOTET GDSDA GENERIC@ML GENERICKD HEVH HIGH CONFIDENCE KCLOUD KRYPTIK KVMH008 MALICIOUS PE MALWARE1 MALWARE@#5TWNWOUP0H34 NU0@A0K@HGMI PALLAS POSSIBLETHREAT R + TROJ R345282 RDMK SCORE SMSG2PG8KAFKSJR4LJNMCW STATIC AI SUSGEN TROJANX TSCOPE UNSAFE ZENPAK ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Drixed-FIY!511CAF411536	20201211	6.0.6.653
Alibaba	TrojanDownloader:Win32/Cridex.013f6458	20190527	0.3.0.5
Avast	Win32:TrojanX-gen [Trj]	20201210	21.1.5827.0
Baidu		20190318	1.0.0.2
Kingsoft	Win32.Heur.KVMH008.a.(kcloud)	20201211	2017.9.26.565
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.rdar

One or more processes crashed (50 out of 65536 个事件)

Time & API	Arguments	Status
1619426980.741262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0x144e1 @ 0x100144e1 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637808 registers.edi: 260 registers.eax: 2010505254 registers.ebp: 1638240 registers.edx: 129161 registers.ebx: 4083652503 registers.esi: 0 registers.ecx: 2010505254 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.741262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbf7b @ 0x1000bf7b 511caf41153634fb5b39f436bd45c885+0x13d5a @ 0x10013d5a 511caf41153634fb5b39f436bd45c885+0x144e1 @ 0x100144e1 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 38406096 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.741262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbf7b @ 0x1000bf7b 511caf41153634fb5b39f436bd45c885+0x13d5a @ 0x10013d5a 511caf41153634fb5b39f436bd45c885+0x144e1 @ 0x100144e1 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 38406112 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.741262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbf7b @ 0x1000bf7b 511caf41153634fb5b39f436bd45c885+0x13d5a @ 0x10013d5a 511caf41153634fb5b39f436bd45c885+0x144e1 @ 0x100144e1 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 38406128 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.741262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbf7b @ 0x1000bf7b 511caf41153634fb5b39f436bd45c885+0x13d5a @ 0x10013d5a 511caf41153634fb5b39f436bd45c885+0x144e1 @ 0x100144e1 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 38406144 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.741262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbf7b @ 0x1000bf7b 511caf41153634fb5b39f436bd45c885+0x13d5a @ 0x10013d5a 511caf41153634fb5b39f436bd45c885+0x144e1 @ 0x100144e1 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 38406160 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.741262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbf7b @ 0x1000bf7b 511caf41153634fb5b39f436bd45c885+0x13d5a @ 0x10013d5a 511caf41153634fb5b39f436bd45c885+0x144e1 @ 0x100144e1 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 38406176 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.741262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbf7b @ 0x1000bf7b 511caf41153634fb5b39f436bd45c885+0x13d5a @ 0x10013d5a 511caf41153634fb5b39f436bd45c885+0x144e1 @ 0x100144e1 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 38406192 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.741262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbf7b @ 0x1000bf7b 511caf41153634fb5b39f436bd45c885+0x13d5a @ 0x10013d5a 511caf41153634fb5b39f436bd45c885+0x144e1 @ 0x100144e1 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 38406208 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.741262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbf7b @ 0x1000bf7b 511caf41153634fb5b39f436bd45c885+0x13d5a @ 0x10013d5a 511caf41153634fb5b39f436bd45c885+0x144e1 @ 0x100144e1 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 38406224 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.741262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbf7b @ 0x1000bf7b 511caf41153634fb5b39f436bd45c885+0x13d5a @ 0x10013d5a 511caf41153634fb5b39f436bd45c885+0x144e1 @ 0x100144e1 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 38406240 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.741262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbf7b @ 0x1000bf7b 511caf41153634fb5b39f436bd45c885+0x13d5a @ 0x10013d5a 511caf41153634fb5b39f436bd45c885+0x144e1 @ 0x100144e1 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 38406256 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.741262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbf7b @ 0x1000bf7b 511caf41153634fb5b39f436bd45c885+0x13d5a @ 0x10013d5a 511caf41153634fb5b39f436bd45c885+0x144e1 @ 0x100144e1 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 38406272 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.741262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbf7b @ 0x1000bf7b 511caf41153634fb5b39f436bd45c885+0x13d5a @ 0x10013d5a 511caf41153634fb5b39f436bd45c885+0x144e1 @ 0x100144e1 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 38406288 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.741262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbf7b @ 0x1000bf7b 511caf41153634fb5b39f436bd45c885+0x13d5a @ 0x10013d5a 511caf41153634fb5b39f436bd45c885+0x144e1 @ 0x100144e1 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 38406304 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.741262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbf7b @ 0x1000bf7b 511caf41153634fb5b39f436bd45c885+0x13d5a @ 0x10013d5a 511caf41153634fb5b39f436bd45c885+0x144e1 @ 0x100144e1 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 38406320 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.741262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbf7b @ 0x1000bf7b 511caf41153634fb5b39f436bd45c885+0x13d5a @ 0x10013d5a 511caf41153634fb5b39f436bd45c885+0x144e1 @ 0x100144e1 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 38406336 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.741262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0x1429b @ 0x1001429b 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637024 registers.edi: 1024 registers.eax: 2010505254 registers.ebp: 1638084 registers.edx: 0 registers.ebx: 1638104 registers.esi: 23 registers.ecx: 1024 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638068 registers.edi: 388 registers.eax: 2010505254 registers.ebp: 1638256 registers.edx: 0 registers.ebx: 1983119360 registers.esi: 784896 registers.ecx: 388 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbeab @ 0x1000beab 511caf41153634fb5b39f436bd45c885+0x143af @ 0x100143af 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 38409576 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbeab @ 0x1000beab 511caf41153634fb5b39f436bd45c885+0x143af @ 0x100143af 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 38409600 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbeab @ 0x1000beab 511caf41153634fb5b39f436bd45c885+0x143af @ 0x100143af 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 38409624 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbeab @ 0x1000beab 511caf41153634fb5b39f436bd45c885+0x143af @ 0x100143af 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 38409648 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbeab @ 0x1000beab 511caf41153634fb5b39f436bd45c885+0x143af @ 0x100143af 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 38409672 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbeab @ 0x1000beab 511caf41153634fb5b39f436bd45c885+0x143af @ 0x100143af 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 38409696 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbeab @ 0x1000beab 511caf41153634fb5b39f436bd45c885+0x143af @ 0x100143af 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 38409720 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbeab @ 0x1000beab 511caf41153634fb5b39f436bd45c885+0x143af @ 0x100143af 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 38409744 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbeab @ 0x1000beab 511caf41153634fb5b39f436bd45c885+0x143af @ 0x100143af 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 38409768 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbeab @ 0x1000beab 511caf41153634fb5b39f436bd45c885+0x143af @ 0x100143af 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 38409792 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbeab @ 0x1000beab 511caf41153634fb5b39f436bd45c885+0x143af @ 0x100143af 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 38409816 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbeab @ 0x1000beab 511caf41153634fb5b39f436bd45c885+0x143af @ 0x100143af 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 38409840 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbeab @ 0x1000beab 511caf41153634fb5b39f436bd45c885+0x143af @ 0x100143af 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 38409864 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbeab @ 0x1000beab 511caf41153634fb5b39f436bd45c885+0x143af @ 0x100143af 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 38409888 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbeab @ 0x1000beab 511caf41153634fb5b39f436bd45c885+0x143af @ 0x100143af 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 38409912 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xbeab @ 0x1000beab 511caf41153634fb5b39f436bd45c885+0x143af @ 0x100143af 511caf41153634fb5b39f436bd45c885+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 38409936 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637796 registers.edi: 0 registers.eax: 1983867560 registers.ebp: 1638264 registers.edx: 1637477 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 1983867560 exception.instruction_r: cc c3 c7 05 95 a1 02 10 00 00 00 00 c7 05 8d a1 exception.symbol: 511caf41153634fb5b39f436bd45c885+0x262d exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 9773 exception.address: 0x1000262d	success
1619426980.757262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0x216b7 @ 0x100216b7 511caf41153634fb5b39f436bd45c885+0xe15b @ 0x1000e15b 511caf41153634fb5b39f436bd45c885+0x267b @ 0x1000267b 511caf41153634fb5b39f436bd45c885+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637696 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637728 registers.edx: 1637463 registers.ebx: 1637744 registers.esi: 0 registers.ecx: 1637724 exception.instruction_r: cc c3 85 c0 75 09 e8 22 23 ff ff 85 c0 75 44 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0x21713 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 136979 exception.address: 0x10021713	success
1619426980.772262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0x216b7 @ 0x100216b7 511caf41153634fb5b39f436bd45c885+0xe15b @ 0x1000e15b 511caf41153634fb5b39f436bd45c885+0x267b @ 0x1000267b 511caf41153634fb5b39f436bd45c885+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637700 registers.edi: 4 registers.eax: 1985273800 registers.ebp: 1637728 registers.edx: 1637485 registers.ebx: 1637744 registers.esi: 5685184 registers.ecx: 1985273800 exception.instruction_r: cc c3 85 f6 74 1d 83 fe ff 74 18 68 47 fe ac c2 exception.symbol: 511caf41153634fb5b39f436bd45c885+0x2173c exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 137020 exception.address: 0x1002173c	success
1619426980.788262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0x216b7 @ 0x100216b7 511caf41153634fb5b39f436bd45c885+0xe15b @ 0x1000e15b 511caf41153634fb5b39f436bd45c885+0x267b @ 0x1000267b 511caf41153634fb5b39f436bd45c885+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637704 registers.edi: 4 registers.eax: 1985274148 registers.ebp: 1637728 registers.edx: 1637492 registers.ebx: 1637744 registers.esi: 5685184 registers.ecx: 1985274148 exception.instruction_r: cc c3 5e 5f 5b 8b e5 5d c3 57 6a 00 53 e8 91 9e exception.symbol: 511caf41153634fb5b39f436bd45c885+0x2175d exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 137053 exception.address: 0x1002175d	success
1619426980.788262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0xe17f @ 0x1000e17f 511caf41153634fb5b39f436bd45c885+0x267b @ 0x1000267b 511caf41153634fb5b39f436bd45c885+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637708 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1637744 registers.edx: 38409576 registers.ebx: 64 registers.esi: 1638204 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0xb251 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619426980.788262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0x216b7 @ 0x100216b7 511caf41153634fb5b39f436bd45c885+0xe19c @ 0x1000e19c 511caf41153634fb5b39f436bd45c885+0x267b @ 0x1000267b 511caf41153634fb5b39f436bd45c885+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637696 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637728 registers.edx: 38409576 registers.ebx: 1637744 registers.esi: 0 registers.ecx: 1637724 exception.instruction_r: cc c3 85 c0 75 09 e8 22 23 ff ff 85 c0 75 44 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0x21713 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 136979 exception.address: 0x10021713	success
1619426980.788262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0x216b7 @ 0x100216b7 511caf41153634fb5b39f436bd45c885+0xe19c @ 0x1000e19c 511caf41153634fb5b39f436bd45c885+0x267b @ 0x1000267b 511caf41153634fb5b39f436bd45c885+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637700 registers.edi: 4 registers.eax: 1985273800 registers.ebp: 1637728 registers.edx: 38409576 registers.ebx: 1637744 registers.esi: 5686144 registers.ecx: 3 exception.instruction_r: cc c3 85 f6 74 1d 83 fe ff 74 18 68 47 fe ac c2 exception.symbol: 511caf41153634fb5b39f436bd45c885+0x2173c exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 137020 exception.address: 0x1002173c	success
1619426980.788262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0x216b7 @ 0x100216b7 511caf41153634fb5b39f436bd45c885+0xe19c @ 0x1000e19c 511caf41153634fb5b39f436bd45c885+0x267b @ 0x1000267b 511caf41153634fb5b39f436bd45c885+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637704 registers.edi: 4 registers.eax: 1985274148 registers.ebp: 1637728 registers.edx: 38409576 registers.ebx: 1637744 registers.esi: 5686144 registers.ecx: 4 exception.instruction_r: cc c3 5e 5f 5b 8b e5 5d c3 57 6a 00 53 e8 91 9e exception.symbol: 511caf41153634fb5b39f436bd45c885+0x2175d exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 137053 exception.address: 0x1002175d	success
1619426980.788262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0x216b7 @ 0x100216b7 511caf41153634fb5b39f436bd45c885+0xe19c @ 0x1000e19c 511caf41153634fb5b39f436bd45c885+0x267b @ 0x1000267b 511caf41153634fb5b39f436bd45c885+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637696 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637728 registers.edx: 38409576 registers.ebx: 1637744 registers.esi: 0 registers.ecx: 1637724 exception.instruction_r: cc c3 85 c0 75 09 e8 22 23 ff ff 85 c0 75 44 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0x21713 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 136979 exception.address: 0x10021713	success
1619426980.788262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0x216b7 @ 0x100216b7 511caf41153634fb5b39f436bd45c885+0xe19c @ 0x1000e19c 511caf41153634fb5b39f436bd45c885+0x267b @ 0x1000267b 511caf41153634fb5b39f436bd45c885+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637700 registers.edi: 4 registers.eax: 1985273800 registers.ebp: 1637728 registers.edx: 38409576 registers.ebx: 1637744 registers.esi: 5686144 registers.ecx: 3 exception.instruction_r: cc c3 85 f6 74 1d 83 fe ff 74 18 68 47 fe ac c2 exception.symbol: 511caf41153634fb5b39f436bd45c885+0x2173c exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 137020 exception.address: 0x1002173c	success
1619426980.788262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0x216b7 @ 0x100216b7 511caf41153634fb5b39f436bd45c885+0xe19c @ 0x1000e19c 511caf41153634fb5b39f436bd45c885+0x267b @ 0x1000267b 511caf41153634fb5b39f436bd45c885+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637704 registers.edi: 4 registers.eax: 1985274148 registers.ebp: 1637728 registers.edx: 38409576 registers.ebx: 1637744 registers.esi: 5686144 registers.ecx: 4 exception.instruction_r: cc c3 5e 5f 5b 8b e5 5d c3 57 6a 00 53 e8 91 9e exception.symbol: 511caf41153634fb5b39f436bd45c885+0x2175d exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 137053 exception.address: 0x1002175d	success
1619426980.788262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0x216b7 @ 0x100216b7 511caf41153634fb5b39f436bd45c885+0xe19c @ 0x1000e19c 511caf41153634fb5b39f436bd45c885+0x267b @ 0x1000267b 511caf41153634fb5b39f436bd45c885+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637696 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637728 registers.edx: 38409576 registers.ebx: 1637744 registers.esi: 0 registers.ecx: 1637724 exception.instruction_r: cc c3 85 c0 75 09 e8 22 23 ff ff 85 c0 75 44 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0x21713 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 136979 exception.address: 0x10021713	success
1619426980.788262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0x216b7 @ 0x100216b7 511caf41153634fb5b39f436bd45c885+0xe19c @ 0x1000e19c 511caf41153634fb5b39f436bd45c885+0x267b @ 0x1000267b 511caf41153634fb5b39f436bd45c885+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637700 registers.edi: 4 registers.eax: 1985273800 registers.ebp: 1637728 registers.edx: 38409576 registers.ebx: 1637744 registers.esi: 5686144 registers.ecx: 3 exception.instruction_r: cc c3 85 f6 74 1d 83 fe ff 74 18 68 47 fe ac c2 exception.symbol: 511caf41153634fb5b39f436bd45c885+0x2173c exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 137020 exception.address: 0x1002173c	success
1619426980.788262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0x216b7 @ 0x100216b7 511caf41153634fb5b39f436bd45c885+0xe19c @ 0x1000e19c 511caf41153634fb5b39f436bd45c885+0x267b @ 0x1000267b 511caf41153634fb5b39f436bd45c885+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637704 registers.edi: 4 registers.eax: 1985274148 registers.ebp: 1637728 registers.edx: 38409576 registers.ebx: 1637744 registers.esi: 5686144 registers.ecx: 4 exception.instruction_r: cc c3 5e 5f 5b 8b e5 5d c3 57 6a 00 53 e8 91 9e exception.symbol: 511caf41153634fb5b39f436bd45c885+0x2175d exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 137053 exception.address: 0x1002175d	success
1619426980.788262 __exception__	stacktrace: 511caf41153634fb5b39f436bd45c885+0x216b7 @ 0x100216b7 511caf41153634fb5b39f436bd45c885+0xe19c @ 0x1000e19c 511caf41153634fb5b39f436bd45c885+0x267b @ 0x1000267b 511caf41153634fb5b39f436bd45c885+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637696 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637728 registers.edx: 38409576 registers.ebx: 1637744 registers.esi: 0 registers.ecx: 1637724 exception.instruction_r: cc c3 85 c0 75 09 e8 22 23 ff ff 85 c0 75 44 56 exception.symbol: 511caf41153634fb5b39f436bd45c885+0x21713 exception.instruction: int3 exception.module: 511caf41153634fb5b39f436bd45c885.exe exception.exception_code: 0x80000003 exception.offset: 136979 exception.address: 0x10021713	success

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619426980.710262 NtAllocateVirtualMemory	process_identifier: 324 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022c0000	success	0	0

The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)

entropy

7.968647887699288

section

{'size_of_data': '0x0001d000', 'virtual_address': '0x00005000', 'entropy': 7.968647887699288, 'name': '.rdata', 'virtual_size': '0x0001cb8d'}

description

A section with a high entropy has been found

entropy

7.844186713255151

section

{'size_of_data': '0x00011000', 'virtual_address': '0x00022000', 'entropy': 7.844186713255151, 'name': '.data', 'virtual_size': '0x000107dc'}

description

A section with a high entropy has been found

entropy

0.8846153846153846

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Tries to unhook Windows functions monitored by Cuckoo (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619427021.272262 __anomaly__	subcategory: exception tid: 2248 message: Encountered 65537 exceptions, quitting. function_name:	success	0	0

File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.Dridex.716
MicroWorld-eScan	Trojan.GenericKD.34165435
FireEye	Generic.mg.511caf41153634fb
McAfee	Drixed-FIY!511CAF411536
Cylance	Unsafe
VIPRE	LooksLike.Win32.Dridex.e (v)
Sangfor	Malware
K7AntiVirus	Trojan ( 005485311 )
Alibaba	TrojanDownloader:Win32/Cridex.013f6458
K7GW	Trojan ( 0056cd241 )
Cybereason	malicious.115363
Arcabit	Trojan.Generic.D20952BB
BitDefenderTheta	Gen:NN.ZexaF.34670.nu0@a0k@Hgmi
Cyren	W32/Trojan.CFSA-6221
Symantec	Packed.Generic.553
ESET-NOD32	a variant of Win32/Kryptik.HEVH
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	HEUR:Trojan.Win32.Zenpak.vho
BitDefender	Trojan.GenericKD.34165435
NANO-Antivirus	Virus.Win32.Gen.ccmw
Paloalto	generic.ml
Ad-Aware	Trojan.GenericKD.34165435
Sophos	Mal/Generic-R + Troj/Dridex-ADB
Comodo	Malware@#5twnwoup0h34
F-Secure	Heuristic.HEUR/AGEN.1138488
Zillya	Downloader.Cridex.Win32.145
McAfee-GW-Edition	BehavesLike.Win32.Emotet.dc
Emsisoft	Trojan.GenericKD.34165435 (B)
SentinelOne	Static AI - Malicious PE
Jiangmin	TrojanDownloader.Cridex.uz
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1138488
Antiy-AVL	Trojan[Downloader]/Win32.Cridex
Kingsoft	Win32.Heur.KVMH008.a.(kcloud)
Gridinsoft	Trojan.Heur!.02052021
Microsoft	Trojan:Win32/Dridex.ARJ!MTB
AegisLab	Trojan.Win32.Cridex.a!c
ZoneAlarm	HEUR:Trojan.Win32.Zenpak.vho
GData	Trojan.GenericKD.34165435
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Dridex.R345282
Acronis	suspicious
VBA32	TScope.Malware-Cryptor.SB
ALYac	Spyware.Banker.Dridex
MAX	malware (ai score=100)
Malwarebytes	Trojan.Dridex
Rising	Trojan.Generic@ML.89 (RDMK:Smsg2pg8kafkSjr4lJnMCw)

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-13 16:34:46

Imports

Library CFGMGR32.dll:

• 0x1000500c CM_Get_HW_Prof_Flags_ExW

Library Secur32.dll:

• 0x100050b0 DeleteSecurityContext

• 0x100050b4 GetComputerObjectNameW

Library IPHLPAPI.DLL:

• 0x10005034 GetNetworkParams

• 0x10005038 GetTcpStatistics

Library ole32.dll:

• 0x10005100 StgConvertVariantToProperty

Library OLEAUT32.dll:

• 0x1000507c VarDecFromR8

• 0x10005080 SafeArrayCreateVector

Library WINSPOOL.DRV:

• 0x100050f0 AddPrinterW

Library WININET.dll:

• 0x100050e4 FindFirstUrlCacheEntryExW

• 0x100050e8 InternetCanonicalizeUrlA

Library USER32.dll:

• 0x100050bc CopyImage

• 0x100050c0 ArrangeIconicWindows

• 0x100050c4 GetMenuItemInfoA

• 0x100050c8 UnregisterClassA

• 0x100050cc GetUserObjectInformationA

• 0x100050d0 DialogBoxIndirectParamA

• 0x100050d4 NotifyWinEvent

• 0x100050d8 MessageBoxIndirectW

• 0x100050dc IsCharUpperA

Library CRYPT32.dll:

• 0x10005014 CryptUnregisterOIDFunction

Library MPRAPI.dll:

• 0x10005074 MprAdminInterfaceSetInfo

Library ADVAPI32.dll:

• 0x10005000 SetNamedSecurityInfoW

• 0x10005004 OpenServiceW

Library KERNEL32.dll:

• 0x10005040 LoadLibraryExW

• 0x10005044 LoadLibraryW

• 0x10005048 SetConsoleWindowInfo

• 0x1000504c GetTapePosition

• 0x10005050 OpenSemaphoreA

• 0x10005054 TerminateThread

• 0x10005058 HeapValidate

• 0x1000505c EraseTape

• 0x10005060 GetProcAddress

• 0x10005064 GetLastError

• 0x10005068 GetModuleFileNameA

• 0x1000506c CloseHandle

Library msvcrt.dll:

• 0x100050f8 strcoll

Library GDI32.dll:

• 0x10005024 CreatePatternBrush

• 0x10005028 RemoveFontResourceW

• 0x1000502c SetViewportOrgEx

Library RPCRT4.dll:

• 0x10005088 RpcBindingFromStringBindingW

Library ESENT.dll:

• 0x1000501c JetCommitTransaction

Library pdh.dll:

• 0x10005108 PdhParseCounterPathW

• 0x1000510c PdhExpandWildCardPathHA

Library SETUPAPI.dll:

• 0x10005090 SetupDiCancelDriverInfoSearch

• 0x10005094 SetupGetSourceInfoW

Library SHLWAPI.dll:

• 0x1000509c SHRegQueryUSValueW

• 0x100050a0 PathGetArgsW

• 0x100050a4 PathRemoveExtensionA

• 0x100050a8 UrlGetLocationA

Exports

Ordinal	Address	Name
1	0x10021313	mvbFp6

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62192	239.255.255.250	3702
192.168.56.101	65005	239.255.255.250	3702
192.168.56.101	65007	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.