11.8
0-day
61 个模型检测该样本为恶意！
重新分析
更多

3bdbaa5a18db65052429b0bbadf24061da6aac7cdb88124571493d968c34e84d

6426d78e4c7e00598c058ff562833cb5.exe

分析耗时

77s

最近分析

文件大小

639.5KB
静态报毒 动态报毒 AI SCORE=89 AIDETECTVM ALI2000015 BSCOPE BT6JTN CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS EMOP EMOY FAREIT HIGH CONFIDENCE HNUUEN HPLOKI IGENT KCLOUD KRYPTIK MALICIOUS PE MALWARE2 MALWARE@#AC908W0P7JV7 NANOCORE NGW@AIYAS4NI PASSWORDSTEALER PUTTY PWSX QMAOU SCORE SMBD SPYBOTNET STATIC AI SUSGEN TROJANPSW TSPY UNSAFE X2094 YZUU ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!6426D78E4C7E 20201211 6.0.6.653
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Avast Win32:PWSX-gen [Trj] 20201210 21.1.5827.0
Baidu 20190318 1.0.0.2
Kingsoft Win32.Troj.Undef.(kcloud) 20201211 2017.9.26.565
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
Queries for the computername (3 个事件)
Time & API Arguments Status Return Repeated
1619639610.672625
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619639653.516625
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619639653.579625
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Tries to locate where the browsers are installed (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619639606.297625
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (27 个事件)
Time & API Arguments Status Return Repeated
1619639605.235374
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34275140
registers.edi: 0
registers.eax: 0
registers.ebp: 34275208
registers.edx: 0
registers.ebx: 0
registers.esi: 0
registers.ecx: 6
exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10
exception.symbol: 6426d78e4c7e00598c058ff562833cb5+0x65396
exception.instruction: div eax
exception.module: 6426d78e4c7e00598c058ff562833cb5.exe
exception.exception_code: 0xc0000094
exception.offset: 414614
exception.address: 0x465396
success 0 0
1619639632.344625
__exception__
stacktrace: 
RtlAllocateHeap+0xac RtlFreeAnsiString-0x54 ntdll+0x2e0d2 @ 0x77d5e0d2
ExpandEnvironmentStringsA+0x185 InitializeCriticalSectionAndSpinCount-0x88 kernelbase+0xffc7 @ 0x778effc7
CryptAcquireContextA+0x3ab CryptGenKey-0x32d cryptsp+0x464e @ 0x7506464e
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x3998 @ 0x403998
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x137d7 @ 0x4137d7
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635796
registers.edi: 23
registers.eax: 5836880
registers.ebp: 1635928
registers.edx: 5536720
registers.ebx: 49
registers.esi: 5836888
registers.ecx: 5604096
exception.instruction_r: 0f b7 06 99 0f a4 c2 10 c1 e0 10 0b f8 0b da 89
exception.symbol: RtlInitUnicodeString+0xec RtlMultiByteToUnicodeN-0x251 ntdll+0x2e2f4
exception.instruction: movzx eax, word ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 189172
exception.address: 0x77d5e2f4
success 0 0
1619639632.344625
__exception__
stacktrace: 
RtlAllocateHeap+0xac RtlFreeAnsiString-0x54 ntdll+0x2e0d2 @ 0x77d5e0d2
ExpandEnvironmentStringsA+0x185 InitializeCriticalSectionAndSpinCount-0x88 kernelbase+0xffc7 @ 0x778effc7
CryptAcquireContextA+0x3ab CryptGenKey-0x32d cryptsp+0x464e @ 0x7506464e
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x3998 @ 0x403998
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x137d7 @ 0x4137d7
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635796
registers.edi: 49
registers.eax: 5836880
registers.ebp: 1635928
registers.edx: 1664024600
registers.ebx: 23
registers.esi: 5836888
registers.ecx: 5604096
exception.instruction_r: 0f b7 06 99 0f a4 c2 10 c1 e0 10 0b d8 0b fa 89
exception.symbol: LdrUnlockLoaderLock+0x2cc RtlInitUnicodeStringEx-0xe6b ntdll+0x36f08
exception.instruction: movzx eax, word ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 225032
exception.address: 0x77d66f08
success 0 0
1619639632.344625
__exception__
stacktrace: 
RtlAllocateHeap+0xac RtlFreeAnsiString-0x54 ntdll+0x2e0d2 @ 0x77d5e0d2
ExpandEnvironmentStringsA+0xa5 InitializeCriticalSectionAndSpinCount-0x168 kernelbase+0xfee7 @ 0x778efee7
CryptAcquireContextA+0x3cf CryptGenKey-0x309 cryptsp+0x4672 @ 0x75064672
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x3998 @ 0x403998
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x137d7 @ 0x4137d7
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635800
registers.edi: 49
registers.eax: 5836880
registers.ebp: 1635932
registers.edx: 1664024600
registers.ebx: 23
registers.esi: 5836888
registers.ecx: 5604096
exception.instruction_r: 0f b7 06 99 0f a4 c2 10 c1 e0 10 0b d8 0b fa 89
exception.symbol: LdrUnlockLoaderLock+0x2cc RtlInitUnicodeStringEx-0xe6b ntdll+0x36f08
exception.instruction: movzx eax, word ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 225032
exception.address: 0x77d66f08
success 0 0
1619639632.344625
__exception__
stacktrace: 
RtlAllocateHeap+0xac RtlFreeAnsiString-0x54 ntdll+0x2e0d2 @ 0x77d5e0d2
RtlDeleteBoundaryDescriptor+0x3f RtlAnsiStringToUnicodeString-0x9 ntdll+0x2e6ac @ 0x77d5e6ac
_wcsnicmp+0x133 RtlInitAnsiStringEx-0x2d ntdll+0x2f76e @ 0x77d5f76e
IsNLSDefinedString+0xd66 CreateThreadpool-0x4be kernelbase+0x3676a @ 0x7791676a
GetModuleHandleA+0x27 GetVersionExA-0x25 kernelbase+0x11f1c @ 0x778f1f1c
CryptContextAddRef-0x5b cryptsp+0x2e1e @ 0x75062e1e
CryptAcquireContextA+0x3fc CryptGenKey-0x2dc cryptsp+0x469f @ 0x7506469f
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x3998 @ 0x403998
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x137d7 @ 0x4137d7
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635724
registers.edi: 49
registers.eax: 5836880
registers.ebp: 1635856
registers.edx: 1664024600
registers.ebx: 23
registers.esi: 5836888
registers.ecx: 5604096
exception.instruction_r: 0f b7 06 99 0f a4 c2 10 c1 e0 10 0b d8 0b fa 89
exception.symbol: LdrUnlockLoaderLock+0x2cc RtlInitUnicodeStringEx-0xe6b ntdll+0x36f08
exception.instruction: movzx eax, word ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 225032
exception.address: 0x77d66f08
success 0 0
1619639632.344625
__exception__
stacktrace: 
RtlAllocateHeap+0xac RtlFreeAnsiString-0x54 ntdll+0x2e0d2 @ 0x77d5e0d2
RtlDeleteBoundaryDescriptor+0x3f RtlAnsiStringToUnicodeString-0x9 ntdll+0x2e6ac @ 0x77d5e6ac
_wcsnicmp+0x133 RtlInitAnsiStringEx-0x2d ntdll+0x2f76e @ 0x77d5f76e
RtlCreateUnicodeStringFromAsciiz+0x29 RtlInitializeConditionVariable-0x31 ntdll+0x38425 @ 0x77d68425
RegOpenKeyExA+0xe8 DisableThreadLibraryCalls-0xce kernel32+0x14817 @ 0x76354817
RegOpenKeyExA+0x21 DisableThreadLibraryCalls-0x195 kernel32+0x14750 @ 0x76354750
New_advapi32_RegOpenKeyExA@20+0x4f New_advapi32_RegOpenKeyExW@20-0x173 @ 0x74563adf
CPAcquireContext+0x7f0 CPReleaseContext-0xb70 rsaenh+0x4ea8 @ 0x75024ea8
CPAcquireContext+0x771 CPReleaseContext-0xbef rsaenh+0x4e29 @ 0x75024e29
CPAcquireContext+0xb1 CPReleaseContext-0x12af rsaenh+0x4769 @ 0x75024769
CPAcquireContext+0x3f CPReleaseContext-0x1321 rsaenh+0x46f7 @ 0x750246f7
CryptAcquireContextA+0x5f4 CryptGenKey-0xe4 cryptsp+0x4897 @ 0x75064897
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x3998 @ 0x403998
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x137d7 @ 0x4137d7
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635304
registers.edi: 49
registers.eax: 5836880
registers.ebp: 1635436
registers.edx: 1664024600
registers.ebx: 23
registers.esi: 5836888
registers.ecx: 5604096
exception.instruction_r: 0f b7 06 99 0f a4 c2 10 c1 e0 10 0b d8 0b fa 89
exception.symbol: LdrUnlockLoaderLock+0x2cc RtlInitUnicodeStringEx-0xe6b ntdll+0x36f08
exception.instruction: movzx eax, word ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 225032
exception.address: 0x77d66f08
success 0 0
1619639632.344625
__exception__
stacktrace: 
RtlAllocateHeap+0xac RtlFreeAnsiString-0x54 ntdll+0x2e0d2 @ 0x77d5e0d2
CPGenRandom-0x2ba8 rsaenh+0x187b @ 0x7502187b
CPGetKeyParam+0xbe41 CPDecrypt-0x4b48 rsaenh+0x20ba3 @ 0x75040ba3
CPAcquireContext+0x3f CPReleaseContext-0x1321 rsaenh+0x46f7 @ 0x750246f7
CryptAcquireContextA+0x5f4 CryptGenKey-0xe4 cryptsp+0x4897 @ 0x75064897
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x3998 @ 0x403998
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x137d7 @ 0x4137d7
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635732
registers.edi: 49
registers.eax: 5836880
registers.ebp: 1635864
registers.edx: 1664024600
registers.ebx: 23
registers.esi: 5836888
registers.ecx: 5604096
exception.instruction_r: 0f b7 06 99 0f a4 c2 10 c1 e0 10 0b d8 0b fa 89
exception.symbol: LdrUnlockLoaderLock+0x2cc RtlInitUnicodeStringEx-0xe6b ntdll+0x36f08
exception.instruction: movzx eax, word ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 225032
exception.address: 0x77d66f08
success 0 0
1619639632.344625
__exception__
stacktrace: 
RtlAllocateHeap+0xac RtlFreeAnsiString-0x54 ntdll+0x2e0d2 @ 0x77d5e0d2
ExpandEnvironmentStringsA+0x185 InitializeCriticalSectionAndSpinCount-0x88 kernelbase+0xffc7 @ 0x778effc7
CryptAcquireContextA+0x3ab CryptGenKey-0x32d cryptsp+0x464e @ 0x7506464e
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x39ae @ 0x4039ae
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x137d7 @ 0x4137d7
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635796
registers.edi: 49
registers.eax: 5836880
registers.ebp: 1635928
registers.edx: 1664024600
registers.ebx: 23
registers.esi: 5836888
registers.ecx: 5604096
exception.instruction_r: 0f b7 06 99 0f a4 c2 10 c1 e0 10 0b d8 0b fa 89
exception.symbol: LdrUnlockLoaderLock+0x2cc RtlInitUnicodeStringEx-0xe6b ntdll+0x36f08
exception.instruction: movzx eax, word ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 225032
exception.address: 0x77d66f08
success 0 0
1619639632.344625
__exception__
stacktrace: 
RtlAllocateHeap+0xac RtlFreeAnsiString-0x54 ntdll+0x2e0d2 @ 0x77d5e0d2
ExpandEnvironmentStringsA+0xa5 InitializeCriticalSectionAndSpinCount-0x168 kernelbase+0xfee7 @ 0x778efee7
CryptAcquireContextA+0x3cf CryptGenKey-0x309 cryptsp+0x4672 @ 0x75064672
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x39ae @ 0x4039ae
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x137d7 @ 0x4137d7
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635800
registers.edi: 49
registers.eax: 5836880
registers.ebp: 1635932
registers.edx: 1664024600
registers.ebx: 23
registers.esi: 5836888
registers.ecx: 5604096
exception.instruction_r: 0f b7 06 99 0f a4 c2 10 c1 e0 10 0b d8 0b fa 89
exception.symbol: LdrUnlockLoaderLock+0x2cc RtlInitUnicodeStringEx-0xe6b ntdll+0x36f08
exception.instruction: movzx eax, word ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 225032
exception.address: 0x77d66f08
success 0 0
1619639632.344625
__exception__
stacktrace: 
RtlAllocateHeap+0xac RtlFreeAnsiString-0x54 ntdll+0x2e0d2 @ 0x77d5e0d2
RtlDeleteBoundaryDescriptor+0x3f RtlAnsiStringToUnicodeString-0x9 ntdll+0x2e6ac @ 0x77d5e6ac
_wcsnicmp+0x133 RtlInitAnsiStringEx-0x2d ntdll+0x2f76e @ 0x77d5f76e
IsNLSDefinedString+0xd66 CreateThreadpool-0x4be kernelbase+0x3676a @ 0x7791676a
GetModuleHandleA+0x27 GetVersionExA-0x25 kernelbase+0x11f1c @ 0x778f1f1c
CryptContextAddRef-0x5b cryptsp+0x2e1e @ 0x75062e1e
CryptAcquireContextA+0x3fc CryptGenKey-0x2dc cryptsp+0x469f @ 0x7506469f
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x39ae @ 0x4039ae
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x137d7 @ 0x4137d7
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635724
registers.edi: 49
registers.eax: 5836880
registers.ebp: 1635856
registers.edx: 1664024600
registers.ebx: 23
registers.esi: 5836888
registers.ecx: 5604096
exception.instruction_r: 0f b7 06 99 0f a4 c2 10 c1 e0 10 0b d8 0b fa 89
exception.symbol: LdrUnlockLoaderLock+0x2cc RtlInitUnicodeStringEx-0xe6b ntdll+0x36f08
exception.instruction: movzx eax, word ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 225032
exception.address: 0x77d66f08
success 0 0
1619639632.344625
__exception__
stacktrace: 
RtlAllocateHeap+0xac RtlFreeAnsiString-0x54 ntdll+0x2e0d2 @ 0x77d5e0d2
RtlDeleteBoundaryDescriptor+0x3f RtlAnsiStringToUnicodeString-0x9 ntdll+0x2e6ac @ 0x77d5e6ac
_wcsnicmp+0x133 RtlInitAnsiStringEx-0x2d ntdll+0x2f76e @ 0x77d5f76e
RtlCreateUnicodeStringFromAsciiz+0x29 RtlInitializeConditionVariable-0x31 ntdll+0x38425 @ 0x77d68425
RegOpenKeyExA+0xe8 DisableThreadLibraryCalls-0xce kernel32+0x14817 @ 0x76354817
RegOpenKeyExA+0x21 DisableThreadLibraryCalls-0x195 kernel32+0x14750 @ 0x76354750
New_advapi32_RegOpenKeyExA@20+0x4f New_advapi32_RegOpenKeyExW@20-0x173 @ 0x74563adf
CPAcquireContext+0x7f0 CPReleaseContext-0xb70 rsaenh+0x4ea8 @ 0x75024ea8
CPAcquireContext+0x771 CPReleaseContext-0xbef rsaenh+0x4e29 @ 0x75024e29
CPAcquireContext+0xb1 CPReleaseContext-0x12af rsaenh+0x4769 @ 0x75024769
CPAcquireContext+0x3f CPReleaseContext-0x1321 rsaenh+0x46f7 @ 0x750246f7
CryptAcquireContextA+0x5f4 CryptGenKey-0xe4 cryptsp+0x4897 @ 0x75064897
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x39ae @ 0x4039ae
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x137d7 @ 0x4137d7
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635304
registers.edi: 49
registers.eax: 5836880
registers.ebp: 1635436
registers.edx: 1664024600
registers.ebx: 23
registers.esi: 5836888
registers.ecx: 5604096
exception.instruction_r: 0f b7 06 99 0f a4 c2 10 c1 e0 10 0b d8 0b fa 89
exception.symbol: LdrUnlockLoaderLock+0x2cc RtlInitUnicodeStringEx-0xe6b ntdll+0x36f08
exception.instruction: movzx eax, word ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 225032
exception.address: 0x77d66f08
success 0 0
1619639632.344625
__exception__
stacktrace: 
RtlAllocateHeap+0xac RtlFreeAnsiString-0x54 ntdll+0x2e0d2 @ 0x77d5e0d2
CPGenRandom-0x2ba8 rsaenh+0x187b @ 0x7502187b
CPGetKeyParam+0xbe41 CPDecrypt-0x4b48 rsaenh+0x20ba3 @ 0x75040ba3
CPAcquireContext+0x3f CPReleaseContext-0x1321 rsaenh+0x46f7 @ 0x750246f7
CryptAcquireContextA+0x5f4 CryptGenKey-0xe4 cryptsp+0x4897 @ 0x75064897
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x39ae @ 0x4039ae
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x137d7 @ 0x4137d7
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635732
registers.edi: 49
registers.eax: 5836880
registers.ebp: 1635864
registers.edx: 1664024600
registers.ebx: 23
registers.esi: 5836888
registers.ecx: 5604096
exception.instruction_r: 0f b7 06 99 0f a4 c2 10 c1 e0 10 0b d8 0b fa 89
exception.symbol: LdrUnlockLoaderLock+0x2cc RtlInitUnicodeStringEx-0xe6b ntdll+0x36f08
exception.instruction: movzx eax, word ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 225032
exception.address: 0x77d66f08
success 0 0
1619639632.360625
__exception__
stacktrace: 
RtlAllocateHeap+0xac RtlFreeAnsiString-0x54 ntdll+0x2e0d2 @ 0x77d5e0d2
RtlFlsAlloc+0x281 EtwNotificationRegister-0x84e ntdll+0x3ece4 @ 0x77d6ece4
RtlFlsAlloc+0x389 EtwNotificationRegister-0x746 ntdll+0x3edec @ 0x77d6edec
RtlFlsAlloc+0x48a EtwNotificationRegister-0x645 ntdll+0x3eeed @ 0x77d6eeed
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
WahOpenApcHelper+0x1702 gethostname-0x4d6 ws2_32+0x9b85 @ 0x77539b85
WahOpenApcHelper+0x1833 gethostname-0x3a5 ws2_32+0x9cb6 @ 0x77539cb6
WahOpenApcHelper+0x18ab gethostname-0x32d ws2_32+0x9d2e @ 0x77539d2e
bind+0x1b8 GetAddrInfoW-0x14f ws2_32+0x473a @ 0x7753473a
WSALookupServiceBeginW+0x15a WSAEventSelect-0xbdb ws2_32+0x58b4 @ 0x775358b4
WSALookupServiceBeginW+0x72 WSAEventSelect-0xcc3 ws2_32+0x57cc @ 0x775357cc
WSALookupServiceNextW+0x46f WSALookupServiceEnd-0x10e ws2_32+0x512b @ 0x7753512b
WSALookupServiceNextW+0x273 WSALookupServiceEnd-0x30a ws2_32+0x4f2f @ 0x77534f2f
WSALookupServiceBeginW+0xb1b WSAEventSelect-0x21a ws2_32+0x6275 @ 0x77536275
GetAddrInfoW+0x210 FreeAddrInfoW-0x82 ws2_32+0x4a99 @ 0x77534a99
New_ws2_32_GetAddrInfoW@16+0x48 New_ws2_32_TransmitFile@28-0x116 @ 0x7457ad73
getaddrinfo+0x6d WSASend-0x103 ws2_32+0x4303 @ 0x77534303
New_ws2_32_getaddrinfo@16+0xf4 New_ws2_32_gethostbyname@4-0x6a @ 0x7457c2ce
6426d78e4c7e00598c058ff562833cb5+0x4e55 @ 0x404e55
6426d78e4c7e00598c058ff562833cb5+0x14083 @ 0x414083
6426d78e4c7e00598c058ff562833cb5+0x142cb @ 0x4142cb
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x137d7 @ 0x4137d7
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1631172
registers.edi: 49
registers.eax: 5836880
registers.ebp: 1631304
registers.edx: 1664024600
registers.ebx: 23
registers.esi: 5836888
registers.ecx: 5604096
exception.instruction_r: 0f b7 06 99 0f a4 c2 10 c1 e0 10 0b d8 0b fa 89
exception.symbol: LdrUnlockLoaderLock+0x2cc RtlInitUnicodeStringEx-0xe6b ntdll+0x36f08
exception.instruction: movzx eax, word ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 225032
exception.address: 0x77d66f08
success 0 0
1619639632.360625
__exception__
stacktrace: 
RtlAllocateHeap+0xac RtlFreeAnsiString-0x54 ntdll+0x2e0d2 @ 0x77d5e0d2
RtlFlsAlloc+0x281 EtwNotificationRegister-0x84e ntdll+0x3ece4 @ 0x77d6ece4
RtlFlsAlloc+0x688 EtwNotificationRegister-0x447 ntdll+0x3f0eb @ 0x77d6f0eb
RtlFlsAlloc+0x48a EtwNotificationRegister-0x645 ntdll+0x3eeed @ 0x77d6eeed
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
LoadLibraryExA+0x26 FreeLibrary-0x18 kernelbase+0x11d7a @ 0x778f1d7a
NSPStartup+0xc9 MigrateWinsockConfiguration-0x3241 mswsock+0x9ae6 @ 0x750c9ae6
WSPStartup+0xf39 NSPStartup-0x49 mswsock+0x99d4 @ 0x750c99d4
WahOpenApcHelper+0x1730 gethostname-0x4a8 ws2_32+0x9bb3 @ 0x77539bb3
WahOpenApcHelper+0x1833 gethostname-0x3a5 ws2_32+0x9cb6 @ 0x77539cb6
WahOpenApcHelper+0x18ab gethostname-0x32d ws2_32+0x9d2e @ 0x77539d2e
bind+0x1b8 GetAddrInfoW-0x14f ws2_32+0x473a @ 0x7753473a
WSALookupServiceBeginW+0x15a WSAEventSelect-0xbdb ws2_32+0x58b4 @ 0x775358b4
WSALookupServiceBeginW+0x72 WSAEventSelect-0xcc3 ws2_32+0x57cc @ 0x775357cc
WSALookupServiceNextW+0x46f WSALookupServiceEnd-0x10e ws2_32+0x512b @ 0x7753512b
WSALookupServiceNextW+0x273 WSALookupServiceEnd-0x30a ws2_32+0x4f2f @ 0x77534f2f
WSALookupServiceBeginW+0xb1b WSAEventSelect-0x21a ws2_32+0x6275 @ 0x77536275
GetAddrInfoW+0x210 FreeAddrInfoW-0x82 ws2_32+0x4a99 @ 0x77534a99
New_ws2_32_GetAddrInfoW@16+0x48 New_ws2_32_TransmitFile@28-0x116 @ 0x7457ad73
getaddrinfo+0x6d WSASend-0x103 ws2_32+0x4303 @ 0x77534303
New_ws2_32_getaddrinfo@16+0xf4 New_ws2_32_gethostbyname@4-0x6a @ 0x7457c2ce
6426d78e4c7e00598c058ff562833cb5+0x4e55 @ 0x404e55
6426d78e4c7e00598c058ff562833cb5+0x14083 @ 0x414083
6426d78e4c7e00598c058ff562833cb5+0x142cb @ 0x4142cb
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x137d7 @ 0x4137d7
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1631012
registers.edi: 49
registers.eax: 5836880
registers.ebp: 1631144
registers.edx: 1664024600
registers.ebx: 23
registers.esi: 5836888
registers.ecx: 5604096
exception.instruction_r: 0f b7 06 99 0f a4 c2 10 c1 e0 10 0b d8 0b fa 89
exception.symbol: LdrUnlockLoaderLock+0x2cc RtlInitUnicodeStringEx-0xe6b ntdll+0x36f08
exception.instruction: movzx eax, word ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 225032
exception.address: 0x77d66f08
success 0 0
1619639632.375625
__exception__
stacktrace: 
RtlAllocateHeap+0xac RtlFreeAnsiString-0x54 ntdll+0x2e0d2 @ 0x77d5e0d2
ExpandEnvironmentStringsA+0x185 InitializeCriticalSectionAndSpinCount-0x88 kernelbase+0xffc7 @ 0x778effc7
CryptAcquireContextA+0x3ab CryptGenKey-0x32d cryptsp+0x464e @ 0x7506464e
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x3998 @ 0x403998
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x137d7 @ 0x4137d7
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635796
registers.edi: 23
registers.eax: 5836880
registers.ebp: 1635928
registers.edx: 5536720
registers.ebx: 50
registers.esi: 5836888
registers.ecx: 5604096
exception.instruction_r: 0f b7 06 99 0f a4 c2 10 c1 e0 10 0b f8 0b da 89
exception.symbol: RtlInitUnicodeString+0xec RtlMultiByteToUnicodeN-0x251 ntdll+0x2e2f4
exception.instruction: movzx eax, word ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 189172
exception.address: 0x77d5e2f4
success 0 0
1619639653.422625
__exception__
stacktrace: 
RtlAllocateHeap+0xac RtlFreeAnsiString-0x54 ntdll+0x2e0d2 @ 0x77d5e0d2
profapi+0x11fb @ 0x757f11fb
profapi+0x12d5 @ 0x757f12d5
profapi+0x13e3 @ 0x757f13e3
profapi+0x159f @ 0x757f159f
profapi+0x154b @ 0x757f154b
GetUserProfileDirectoryW+0x9a RegisterGPNotification-0x59 userenv+0x264c @ 0x7580264c
GetUserProfileDirectoryW+0x3e RegisterGPNotification-0xb5 userenv+0x25f0 @ 0x758025f0
CPGetKeyParam+0xd599 CPDecrypt-0x33f0 rsaenh+0x222fb @ 0x750422fb
DllUnregisterServer+0x873f rsaenh+0x32161 @ 0x75052161
CPDeriveKey+0x6ba DllRegisterServer-0x111f rsaenh+0x288bb @ 0x750488bb
CPGetKeyParam+0xbea6 CPDecrypt-0x4ae3 rsaenh+0x20c08 @ 0x75040c08
CPAcquireContext+0x3f CPReleaseContext-0x1321 rsaenh+0x46f7 @ 0x750246f7
CryptAcquireContextA+0x5f4 CryptGenKey-0xe4 cryptsp+0x4897 @ 0x75064897
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x3998 @ 0x403998
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x137d7 @ 0x4137d7
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1632496
registers.edi: 23
registers.eax: 5836880
registers.ebp: 1632628
registers.edx: 5536720
registers.ebx: 56
registers.esi: 5836888
registers.ecx: 5604096
exception.instruction_r: 0f b7 06 99 0f a4 c2 10 c1 e0 10 0b f8 0b da 89
exception.symbol: RtlInitUnicodeString+0xec RtlMultiByteToUnicodeN-0x251 ntdll+0x2e2f4
exception.instruction: movzx eax, word ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 189172
exception.address: 0x77d5e2f4
success 0 0
1619639653.422625
__exception__
stacktrace: 
RtlAllocateHeap+0xac RtlFreeAnsiString-0x54 ntdll+0x2e0d2 @ 0x77d5e0d2
profapi+0x11fb @ 0x757f11fb
profapi+0x12d5 @ 0x757f12d5
profapi+0x13e3 @ 0x757f13e3
profapi+0x159f @ 0x757f159f
profapi+0x154b @ 0x757f154b
GetUserProfileDirectoryW+0x9a RegisterGPNotification-0x59 userenv+0x264c @ 0x7580264c
GetUserProfileDirectoryW+0x3e RegisterGPNotification-0xb5 userenv+0x25f0 @ 0x758025f0
CPGetKeyParam+0xd599 CPDecrypt-0x33f0 rsaenh+0x222fb @ 0x750422fb
CPGenKey+0x850a CPEncrypt-0x11b6 rsaenh+0x139ff @ 0x750339ff
CPGenKey+0x835b CPEncrypt-0x1365 rsaenh+0x13850 @ 0x75033850
CPGenKey+0x8178 CPEncrypt-0x1548 rsaenh+0x1366d @ 0x7503366d
CPAcquireContext+0x3f CPReleaseContext-0x1321 rsaenh+0x46f7 @ 0x750246f7
CryptAcquireContextA+0x5f4 CryptGenKey-0xe4 cryptsp+0x4897 @ 0x75064897
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x39ae @ 0x4039ae
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x137d7 @ 0x4137d7
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1631208
registers.edi: 23
registers.eax: 5836880
registers.ebp: 1631340
registers.edx: 5536720
registers.ebx: 61
registers.esi: 5836888
registers.ecx: 5604096
exception.instruction_r: 0f b7 06 99 0f a4 c2 10 c1 e0 10 0b f8 0b da 89
exception.symbol: RtlInitUnicodeString+0xec RtlMultiByteToUnicodeN-0x251 ntdll+0x2e2f4
exception.instruction: movzx eax, word ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 189172
exception.address: 0x77d5e2f4
success 0 0
1619639653.547625
__exception__
stacktrace: 
RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x77d5e003
ExpandEnvironmentStringsA+0x1f2 InitializeCriticalSectionAndSpinCount-0x1b kernelbase+0x10034 @ 0x778f0034
CryptAcquireContextA+0x3ab CryptGenKey-0x32d cryptsp+0x464e @ 0x7506464e
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x3998 @ 0x403998
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x1381d @ 0x41381d
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635972
registers.edi: 5836880
registers.eax: 0
registers.ebp: 1636024
registers.edx: 5836888
registers.ebx: 5836888
registers.esi: 428907742
registers.ecx: 5505024
exception.instruction_r: 8b 46 04 89 45 f4 c6 47 07 80 c6 47 06 00 8b 5e
exception.symbol: RtlInitUnicodeString+0x196 RtlMultiByteToUnicodeN-0x1a7 ntdll+0x2e39e
exception.instruction: mov eax, dword ptr [esi + 4]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 189342
exception.address: 0x77d5e39e
success 0 0
1619639653.547625
__exception__
stacktrace: 
RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x77d5e003
ExpandEnvironmentStringsA+0x1f2 InitializeCriticalSectionAndSpinCount-0x1b kernelbase+0x10034 @ 0x778f0034
CryptAcquireContextA+0x3ab CryptGenKey-0x32d cryptsp+0x464e @ 0x7506464e
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x39ae @ 0x4039ae
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x1381d @ 0x41381d
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635972
registers.edi: 5633752
registers.eax: 5604088
registers.ebp: 1636024
registers.edx: 5633760
registers.ebx: 5633760
registers.esi: 432308983
registers.ecx: 5505024
exception.instruction_r: 8b 46 04 89 45 f4 c6 47 07 80 c6 47 06 00 8b 5e
exception.symbol: RtlInitUnicodeString+0x196 RtlMultiByteToUnicodeN-0x1a7 ntdll+0x2e39e
exception.instruction: mov eax, dword ptr [esi + 4]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 189342
exception.address: 0x77d5e39e
success 0 0
1619639653.547625
__exception__
stacktrace: 
RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x77d5e003
ExpandEnvironmentStringsA+0x1f2 InitializeCriticalSectionAndSpinCount-0x1b kernelbase+0x10034 @ 0x778f0034
CryptAcquireContextA+0x3ab CryptGenKey-0x32d cryptsp+0x464e @ 0x7506464e
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x3998 @ 0x403998
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x1381d @ 0x41381d
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635972
registers.edi: 5633848
registers.eax: 3801155
registers.ebp: 1636024
registers.edx: 5633856
registers.ebx: 5633856
registers.esi: 430637168
registers.ecx: 5505024
exception.instruction_r: 8b 46 04 89 45 f4 c6 47 07 80 c6 47 06 00 8b 5e
exception.symbol: RtlInitUnicodeString+0x196 RtlMultiByteToUnicodeN-0x1a7 ntdll+0x2e39e
exception.instruction: mov eax, dword ptr [esi + 4]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 189342
exception.address: 0x77d5e39e
success 0 0
1619639653.547625
__exception__
stacktrace: 
RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x77d5e003
ExpandEnvironmentStringsA+0x1f2 InitializeCriticalSectionAndSpinCount-0x1b kernelbase+0x10034 @ 0x778f0034
CryptAcquireContextA+0x3ab CryptGenKey-0x32d cryptsp+0x464e @ 0x7506464e
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x39ae @ 0x4039ae
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x1381d @ 0x41381d
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635972
registers.edi: 5634592
registers.eax: 7536761
registers.ebp: 1636024
registers.edx: 5634600
registers.ebx: 5634600
registers.esi: 434242025
registers.ecx: 5505024
exception.instruction_r: 8b 46 04 89 45 f4 c6 47 07 80 c6 47 06 00 8b 5e
exception.symbol: RtlInitUnicodeString+0x196 RtlMultiByteToUnicodeN-0x1a7 ntdll+0x2e39e
exception.instruction: mov eax, dword ptr [esi + 4]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 189342
exception.address: 0x77d5e39e
success 0 0
1619639653.547625
__exception__
stacktrace: 
RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x77d5e003
ExpandEnvironmentStringsA+0x1f2 InitializeCriticalSectionAndSpinCount-0x1b kernelbase+0x10034 @ 0x778f0034
CryptAcquireContextA+0x3ab CryptGenKey-0x32d cryptsp+0x464e @ 0x7506464e
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x3998 @ 0x403998
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x1381d @ 0x41381d
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635972
registers.edi: 5634624
registers.eax: 7536761
registers.ebp: 1636024
registers.edx: 5634632
registers.ebx: 5634632
registers.esi: 434242021
registers.ecx: 5505024
exception.instruction_r: 8b 46 04 89 45 f4 c6 47 07 80 c6 47 06 00 8b 5e
exception.symbol: RtlInitUnicodeString+0x196 RtlMultiByteToUnicodeN-0x1a7 ntdll+0x2e39e
exception.instruction: mov eax, dword ptr [esi + 4]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 189342
exception.address: 0x77d5e39e
success 0 0
1619639653.563625
__exception__
stacktrace: 
RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x77d5e003
ExpandEnvironmentStringsA+0x1f2 InitializeCriticalSectionAndSpinCount-0x1b kernelbase+0x10034 @ 0x778f0034
CryptAcquireContextA+0x3ab CryptGenKey-0x32d cryptsp+0x464e @ 0x7506464e
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x39ae @ 0x4039ae
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x1381d @ 0x41381d
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635972
registers.edi: 5634624
registers.eax: 7536761
registers.ebp: 1636024
registers.edx: 5634632
registers.ebx: 5634632
registers.esi: 434242021
registers.ecx: 5505024
exception.instruction_r: 8b 46 04 89 45 f4 c6 47 07 80 c6 47 06 00 8b 5e
exception.symbol: RtlInitUnicodeString+0x196 RtlMultiByteToUnicodeN-0x1a7 ntdll+0x2e39e
exception.instruction: mov eax, dword ptr [esi + 4]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 189342
exception.address: 0x77d5e39e
success 0 0
1619639653.563625
__exception__
stacktrace: 
RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x77d5e003
ExpandEnvironmentStringsA+0x1f2 InitializeCriticalSectionAndSpinCount-0x1b kernelbase+0x10034 @ 0x778f0034
CryptAcquireContextA+0x3ab CryptGenKey-0x32d cryptsp+0x464e @ 0x7506464e
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x3998 @ 0x403998
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x14575 @ 0x414575
6426d78e4c7e00598c058ff562833cb5+0x1381d @ 0x41381d
6426d78e4c7e00598c058ff562833cb5+0x139b7 @ 0x4139b7
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1635972
registers.edi: 5634288
registers.eax: 6619251
registers.ebp: 1636024
registers.edx: 5634296
registers.ebx: 5634296
registers.esi: 435421625
registers.ecx: 5505024
exception.instruction_r: 8b 46 04 89 45 f4 c6 47 07 80 c6 47 06 00 8b 5e
exception.symbol: RtlInitUnicodeString+0x196 RtlMultiByteToUnicodeN-0x1a7 ntdll+0x2e39e
exception.instruction: mov eax, dword ptr [esi + 4]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 189342
exception.address: 0x77d5e39e
success 0 0
1619639653.594625
__exception__
stacktrace: 
RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x77d5e003
ExpandEnvironmentStringsA+0x1f2 InitializeCriticalSectionAndSpinCount-0x1b kernelbase+0x10034 @ 0x778f0034
CryptAcquireContextA+0x3ab CryptGenKey-0x32d cryptsp+0x464e @ 0x7506464e
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x3998 @ 0x403998
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x12f30 @ 0x412f30
6426d78e4c7e00598c058ff562833cb5+0x139c1 @ 0x4139c1
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1636876
registers.edi: 5634288
registers.eax: 6619251
registers.ebp: 1636928
registers.edx: 5634296
registers.ebx: 5634296
registers.esi: 435421625
registers.ecx: 5505024
exception.instruction_r: 8b 46 04 89 45 f4 c6 47 07 80 c6 47 06 00 8b 5e
exception.symbol: RtlInitUnicodeString+0x196 RtlMultiByteToUnicodeN-0x1a7 ntdll+0x2e39e
exception.instruction: mov eax, dword ptr [esi + 4]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 189342
exception.address: 0x77d5e39e
success 0 0
1619639653.594625
__exception__
stacktrace: 
RtlAllocateHeap+0xac RtlFreeAnsiString-0x54 ntdll+0x2e0d2 @ 0x77d5e0d2
ExpandEnvironmentStringsA+0x185 InitializeCriticalSectionAndSpinCount-0x88 kernelbase+0xffc7 @ 0x778effc7
CryptAcquireContextA+0x3ab CryptGenKey-0x32d cryptsp+0x464e @ 0x7506464e
New_advapi32_CryptAcquireContextA@20+0x4f New_advapi32_CryptAcquireContextW@20-0xcf @ 0x74560f45
CryptAcquireContextW+0x97 CryptSetProviderA-0x54 cryptsp+0x647f @ 0x7506647f
New_advapi32_CryptAcquireContextW@20+0x9f New_advapi32_CryptCreateHash@20-0x7f @ 0x745610b3
6426d78e4c7e00598c058ff562833cb5+0x39ae @ 0x4039ae
6426d78e4c7e00598c058ff562833cb5+0x13c27 @ 0x413c27
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x12f30 @ 0x412f30
6426d78e4c7e00598c058ff562833cb5+0x139c1 @ 0x4139c1
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1636700
registers.edi: 12
registers.eax: 6045560
registers.ebp: 1636832
registers.edx: 5536720
registers.ebx: 80
registers.esi: 6045568
registers.ecx: 5604096
exception.instruction_r: 0f b7 06 99 0f a4 c2 10 c1 e0 10 0b f8 0b da 89
exception.symbol: RtlInitUnicodeString+0xec RtlMultiByteToUnicodeN-0x251 ntdll+0x2e2f4
exception.instruction: movzx eax, word ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 189172
exception.address: 0x77d5e2f4
success 0 0
1619639653.610625
__exception__
stacktrace: 
RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x77d5e003
HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x763514dd
6426d78e4c7e00598c058ff562833cb5+0x2bc6 @ 0x402bc6
6426d78e4c7e00598c058ff562833cb5+0x13c7d @ 0x413c7d
6426d78e4c7e00598c058ff562833cb5+0x1428b @ 0x41428b
6426d78e4c7e00598c058ff562833cb5+0x12f30 @ 0x412f30
6426d78e4c7e00598c058ff562833cb5+0x139c1 @ 0x4139c1
6426d78e4c7e00598c058ff562833cb5+0x13a2d @ 0x413a2d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637496
registers.edi: 5634288
registers.eax: 6619251
registers.ebp: 1637548
registers.edx: 5634296
registers.ebx: 5634296
registers.esi: 435421625
registers.ecx: 5505024
exception.instruction_r: 8b 46 04 89 45 f4 c6 47 07 80 c6 47 06 00 8b 5e
exception.symbol: RtlInitUnicodeString+0x196 RtlMultiByteToUnicodeN-0x1a7 ntdll+0x2e39e
exception.instruction: mov eax, dword ptr [esi + 4]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 189342
exception.address: 0x77d5e39e
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1619639605.047374
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00580000
success 0 0
1619639605.235374
NtProtectVirtualMemory
process_identifier: 1320
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 36864
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00465000
success 0 0
1619639605.250374
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01e80000
success 0 0
Steals private information from local Internet browsers (19 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Moves the original executable to a new location (1 个事件)
Time & API Arguments Status Return Repeated
1619639653.579625
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6426d78e4c7e00598c058ff562833cb5.exe
newfilepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe
newfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe
flags: 1
oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6426d78e4c7e00598c058ff562833cb5.exe
success 1 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 6.96808254952194 section {'size_of_data': '0x00027200', 'virtual_address': '0x0007f000', 'entropy': 6.96808254952194, 'name': '.rsrc', 'virtual_size': '0x00027110'} description A section with a high entropy has been found
entropy 0.245105716523101 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1619639653.438625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 79.124.8.8
Harvests credentials from local FTP client softwares (22 个事件)
file C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file C:\Windows\wcx_ftp.ini
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file C:\Windows\32BitFtp.ini
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Program Files (x86)\FileZilla\Filezilla.xml
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry HKEY_CURRENT_USER\Software\Martin Prikryl
registry HKEY_LOCAL_MACHINE\Software\Martin Prikryl
Harvests information related to installed instant messenger clients (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml
Harvests credentials from local email clients (3 个事件)
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 1320 called NtSetContextThread to modify thread in remote process 2620
Time & API Arguments Status Return Repeated
1619639605.438374
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4274654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2620
success 0 0
Putty Files, Registry Keys and/or Mutexes Detected
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 1320 resumed a thread in remote process 2620
Time & API Arguments Status Return Repeated
1619639605.657374
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2620
success 0 0
Executed a process and injected code into it, probably while unpacking (7 个事件)
Time & API Arguments Status Return Repeated
1619639605.422374
CreateProcessInternalW
thread_identifier: 2996
thread_handle: 0x000000fc
process_identifier: 2620
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6426d78e4c7e00598c058ff562833cb5.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619639605.422374
NtUnmapViewOfSection
process_identifier: 2620
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619639605.422374
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 2620
commit_size: 663552
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 663552
base_address: 0x00400000
success 0 0
1619639605.438374
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619639605.438374
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4274654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2620
success 0 0
1619639605.657374
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2620
success 0 0
1619639607.813625
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 2620
success 0 0
File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
DrWeb BackDoor.SpyBotNET.25
MicroWorld-eScan Trojan.Delf.FareIt.Gen.7
FireEye Generic.mg.6426d78e4c7e0059
McAfee Fareit-FTB!6426D78E4C7E
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Trojan ( 0056a5691 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Trojan ( 0056a5691 )
Cybereason malicious.d64ec8
Arcabit Trojan.Delf.FareIt.Gen.7
BitDefenderTheta Gen:NN.ZelphiF.34670.NGW@aiyAS4ni
Cyren W32/Trojan.YZUU-7588
Symantec Infostealer
ESET-NOD32 a variant of Win32/Injector.EMOP
APEX Malicious
Avast Win32:PWSX-gen [Trj]
ClamAV Win.Dropper.Nanocore-8973483-0
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.Delf.FareIt.Gen.7
NANO-Antivirus Trojan.Win32.Kryptik.hnuuen
Paloalto generic.ml
Ad-Aware Trojan.Delf.FareIt.Gen.7
Sophos Mal/Generic-S
Comodo Malware@#ac908w0p7jv7
F-Secure Trojan.TR/Injector.qmaou
Zillya Trojan.Injector.Win32.749784
TrendMicro TSPY_HPLOKI.SMBD
McAfee-GW-Edition BehavesLike.Win32.Fareit.jh
Emsisoft Trojan.Delf.FareIt.Gen.7 (B)
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.Kryptik.byj
Webroot W32.Trojan.Gen
Avira TR/Injector.qmaou
Antiy-AVL Trojan/Win32.Kryptik
Kingsoft Win32.Troj.Undef.(kcloud)
Microsoft PWS:Win32/Fareit.AQ!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.Delf.FareIt.Gen.7
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2094
Acronis suspicious
VBA32 BScope.TrojanPSW.Fareit
ALYac Trojan.Delf.FareIt.Gen.7
MAX malware (ai score=89)
Malwarebytes Spyware.PasswordStealer
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)
dead_host 172.217.24.14:443
dead_host 79.124.8.8:80
dead_host 172.217.160.110:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x472164 VirtualFree
• 0x472168 VirtualAlloc
• 0x47216c LocalFree
• 0x472170 LocalAlloc
• 0x472174 GetVersion
• 0x472178 GetCurrentThreadId
• 0x472184 VirtualQuery
• 0x472188 WideCharToMultiByte
• 0x47218c MultiByteToWideChar
• 0x472190 lstrlenA
• 0x472194 lstrcpynA
• 0x472198 LoadLibraryExA
• 0x47219c GetThreadLocale
• 0x4721a0 GetStartupInfoA
• 0x4721a4 GetProcAddress
• 0x4721a8 GetModuleHandleA
• 0x4721ac GetModuleFileNameA
• 0x4721b0 GetLocaleInfoA
• 0x4721b4 GetCommandLineA
• 0x4721b8 FreeLibrary
• 0x4721bc FindFirstFileA
• 0x4721c0 FindClose
• 0x4721c4 ExitProcess
• 0x4721c8 WriteFile
• 0x4721d0 RtlUnwind
• 0x4721d4 RaiseException
• 0x4721d8 GetStdHandle
Library user32.dll:
• 0x4721e0 GetKeyboardType
• 0x4721e4 LoadStringA
• 0x4721e8 MessageBoxA
• 0x4721ec CharNextA
Library advapi32.dll:
• 0x4721f4 RegQueryValueExA
• 0x4721f8 RegOpenKeyExA
• 0x4721fc RegCloseKey
Library oleaut32.dll:
• 0x472204 SysFreeString
• 0x472208 SysReAllocStringLen
• 0x47220c SysAllocStringLen
Library kernel32.dll:
• 0x472214 TlsSetValue
• 0x472218 TlsGetValue
• 0x47221c LocalAlloc
• 0x472220 GetModuleHandleA
Library advapi32.dll:
• 0x472228 RegQueryValueExA
• 0x47222c RegOpenKeyExA
• 0x472230 RegCloseKey
Library kernel32.dll:
• 0x472238 lstrcpyA
• 0x47223c WriteFile
• 0x472240 WaitForSingleObject
• 0x472244 VirtualQuery
• 0x472248 VirtualProtectEx
• 0x47224c VirtualAlloc
• 0x472250 Sleep
• 0x472254 SizeofResource
• 0x472258 SetThreadLocale
• 0x47225c SetFilePointer
• 0x472260 SetEvent
• 0x472264 SetErrorMode
• 0x472268 SetEndOfFile
• 0x47226c ResetEvent
• 0x472270 ReadFile
• 0x472274 MultiByteToWideChar
• 0x472278 MulDiv
• 0x47227c LockResource
• 0x472280 LoadResource
• 0x472284 LoadLibraryA
• 0x472290 GlobalUnlock
• 0x472294 GlobalReAlloc
• 0x472298 GlobalHandle
• 0x47229c GlobalLock
• 0x4722a0 GlobalFree
• 0x4722a4 GlobalFindAtomA
• 0x4722a8 GlobalDeleteAtom
• 0x4722ac GlobalAlloc
• 0x4722b0 GlobalAddAtomA
• 0x4722b4 GetVersionExA
• 0x4722b8 GetVersion
• 0x4722bc GetTickCount
• 0x4722c0 GetThreadLocale
• 0x4722c4 GetSystemInfo
• 0x4722c8 GetStringTypeExA
• 0x4722cc GetStdHandle
• 0x4722d0 GetProcAddress
• 0x4722d4 GetModuleHandleA
• 0x4722d8 GetModuleFileNameA
• 0x4722dc GetLocaleInfoA
• 0x4722e0 GetLocalTime
• 0x4722e4 GetLastError
• 0x4722e8 GetFullPathNameA
• 0x4722ec GetFileAttributesA
• 0x4722f0 GetDiskFreeSpaceA
• 0x4722f4 GetDateFormatA
• 0x4722f8 GetCurrentThreadId
• 0x4722fc GetCurrentProcessId
• 0x472300 GetCurrentProcess
• 0x472304 GetCPInfo
• 0x472308 GetACP
• 0x47230c FreeResource
• 0x472310 InterlockedExchange
• 0x472314 FreeLibrary
• 0x472318 FormatMessageA
• 0x47231c FindResourceA
• 0x472320 FindFirstFileA
• 0x472324 FindClose
• 0x472330 EnumCalendarInfoA
• 0x47233c CreateThread
• 0x472340 CreateFileA
• 0x472344 CreateEventA
• 0x472348 CompareStringA
• 0x47234c CloseHandle
Library version.dll:
• 0x472354 VerQueryValueA
• 0x47235c GetFileVersionInfoA
Library gdi32.dll:
• 0x472364 UnrealizeObject
• 0x472368 StretchBlt
• 0x47236c SetWindowOrgEx
• 0x472370 SetWinMetaFileBits
• 0x472374 SetViewportOrgEx
• 0x472378 SetTextColor
• 0x47237c SetStretchBltMode
• 0x472380 SetROP2
• 0x472384 SetPixel
• 0x472388 SetEnhMetaFileBits
• 0x47238c SetDIBColorTable
• 0x472390 SetBrushOrgEx
• 0x472394 SetBkMode
• 0x472398 SetBkColor
• 0x47239c SelectPalette
• 0x4723a0 SelectObject
• 0x4723a4 SaveDC
• 0x4723a8 RestoreDC
• 0x4723ac Rectangle
• 0x4723b0 RectVisible
• 0x4723b4 RealizePalette
• 0x4723b8 Polyline
• 0x4723bc PlayEnhMetaFile
• 0x4723c0 PatBlt
• 0x4723c4 MoveToEx
• 0x4723c8 MaskBlt
• 0x4723cc LineTo
• 0x4723d0 IntersectClipRect
• 0x4723d4 GetWindowOrgEx
• 0x4723d8 GetWinMetaFileBits
• 0x4723dc GetTextMetricsA
• 0x4723e8 GetStockObject
• 0x4723ec GetPixel
• 0x4723f0 GetPaletteEntries
• 0x4723f4 GetObjectA
• 0x472400 GetEnhMetaFileBits
• 0x472404 GetDeviceCaps
• 0x472408 GetDIBits
• 0x47240c GetDIBColorTable
• 0x472410 GetDCOrgEx
• 0x472418 GetClipBox
• 0x47241c GetBrushOrgEx
• 0x472420 GetBitmapBits
• 0x472424 ExcludeClipRect
• 0x472428 EndPath
• 0x47242c DeleteObject
• 0x472430 DeleteEnhMetaFile
• 0x472434 DeleteDC
• 0x472438 CreateSolidBrush
• 0x47243c CreatePenIndirect
• 0x472440 CreatePalette
• 0x472448 CreateFontIndirectA
• 0x47244c CreateDIBitmap
• 0x472450 CreateDIBSection
• 0x472454 CreateCompatibleDC
• 0x47245c CreateBrushIndirect
• 0x472460 CreateBitmap
• 0x472464 CopyEnhMetaFileA
• 0x472468 BitBlt
Library user32.dll:
• 0x472470 CreateWindowExA
• 0x472474 WindowFromPoint
• 0x472478 WinHelpA
• 0x47247c WaitMessage
• 0x472480 UpdateWindow
• 0x472484 UnregisterClassA
• 0x472488 UnhookWindowsHookEx
• 0x47248c TranslateMessage
• 0x472494 TrackPopupMenu
• 0x47249c ShowWindow
• 0x4724a0 ShowScrollBar
• 0x4724a4 ShowOwnedPopups
• 0x4724a8 ShowCursor
• 0x4724ac SetWindowsHookExA
• 0x4724b0 SetWindowPos
• 0x4724b4 SetWindowPlacement
• 0x4724b8 SetWindowLongA
• 0x4724bc SetTimer
• 0x4724c0 SetScrollRange
• 0x4724c4 SetScrollPos
• 0x4724c8 SetScrollInfo
• 0x4724cc SetRect
• 0x4724d0 SetPropA
• 0x4724d4 SetParent
• 0x4724d8 SetMenuItemInfoA
• 0x4724dc SetMenu
• 0x4724e0 SetForegroundWindow
• 0x4724e4 SetFocus
• 0x4724e8 SetCursor
• 0x4724ec SetClassLongA
• 0x4724f0 SetCapture
• 0x4724f4 SetActiveWindow
• 0x4724f8 SendMessageA
• 0x4724fc ScrollWindow
• 0x472500 ScreenToClient
• 0x472504 RemovePropA
• 0x472508 RemoveMenu
• 0x47250c ReleaseDC
• 0x472510 ReleaseCapture
• 0x47251c RegisterClassA
• 0x472520 RedrawWindow
• 0x472524 PtInRect
• 0x472528 PostQuitMessage
• 0x47252c PostMessageA
• 0x472530 PeekMessageA
• 0x472534 OffsetRect
• 0x472538 OemToCharA
• 0x47253c MessageBoxA
• 0x472540 MapWindowPoints
• 0x472544 MapVirtualKeyA
• 0x472548 LoadStringA
• 0x47254c LoadKeyboardLayoutA
• 0x472550 LoadIconA
• 0x472554 LoadCursorA
• 0x472558 LoadBitmapA
• 0x47255c KillTimer
• 0x472560 IsZoomed
• 0x472564 IsWindowVisible
• 0x472568 IsWindowEnabled
• 0x47256c IsWindow
• 0x472570 IsRectEmpty
• 0x472574 IsIconic
• 0x472578 IsDialogMessageA
• 0x47257c IsChild
• 0x472580 InvalidateRect
• 0x472584 IntersectRect
• 0x472588 InsertMenuItemA
• 0x47258c InsertMenuA
• 0x472590 InflateRect
• 0x472598 GetWindowTextA
• 0x47259c GetWindowRect
• 0x4725a0 GetWindowPlacement
• 0x4725a4 GetWindowLongA
• 0x4725a8 GetWindowDC
• 0x4725ac GetTopWindow
• 0x4725b0 GetSystemMetrics
• 0x4725b4 GetSystemMenu
• 0x4725b8 GetSysColorBrush
• 0x4725bc GetSysColor
• 0x4725c0 GetSubMenu
• 0x4725c4 GetScrollRange
• 0x4725c8 GetScrollPos
• 0x4725cc GetScrollInfo
• 0x4725d0 GetPropA
• 0x4725d4 GetParent
• 0x4725d8 GetWindow
• 0x4725dc GetMenuStringA
• 0x4725e0 GetMenuState
• 0x4725e4 GetMenuItemInfoA
• 0x4725e8 GetMenuItemID
• 0x4725ec GetMenuItemCount
• 0x4725f0 GetMenu
• 0x4725f4 GetLastActivePopup
• 0x4725f8 GetKeyboardState
• 0x472600 GetKeyboardLayout
• 0x472604 GetKeyState
• 0x472608 GetKeyNameTextA
• 0x47260c GetIconInfo
• 0x472610 GetForegroundWindow
• 0x472614 GetFocus
• 0x472618 GetDlgItem
• 0x47261c GetDesktopWindow
• 0x472620 GetDCEx
• 0x472624 GetDC
• 0x472628 GetCursorPos
• 0x47262c GetCursor
• 0x472630 GetClipboardData
• 0x472634 GetClientRect
• 0x472638 GetClassNameA
• 0x47263c GetClassInfoA
• 0x472640 GetCapture
• 0x472644 GetActiveWindow
• 0x472648 FrameRect
• 0x47264c FindWindowA
• 0x472650 FillRect
• 0x472654 EqualRect
• 0x472658 EnumWindows
• 0x47265c EnumThreadWindows
• 0x472660 EndPaint
• 0x472664 EnableWindow
• 0x472668 EnableScrollBar
• 0x47266c EnableMenuItem
• 0x472670 DrawTextA
• 0x472674 DrawMenuBar
• 0x472678 DrawIconEx
• 0x47267c DrawIcon
• 0x472680 DrawFrameControl
• 0x472684 DrawEdge
• 0x472688 DispatchMessageA
• 0x47268c DestroyWindow
• 0x472690 DestroyMenu
• 0x472694 DestroyIcon
• 0x472698 DestroyCursor
• 0x47269c DeleteMenu
• 0x4726a0 DefWindowProcA
• 0x4726a4 DefMDIChildProcA
• 0x4726a8 DefFrameProcA
• 0x4726ac CreatePopupMenu
• 0x4726b0 CreateMenu
• 0x4726b4 CreateIcon
• 0x4726b8 ClientToScreen
• 0x4726bc CheckMenuItem
• 0x4726c0 CallWindowProcA
• 0x4726c4 CallNextHookEx
• 0x4726c8 BeginPaint
• 0x4726cc CharNextA
• 0x4726d0 CharLowerBuffA
• 0x4726d4 CharLowerA
• 0x4726d8 CharUpperBuffA
• 0x4726dc CharToOemA
• 0x4726e0 AdjustWindowRectEx
Library kernel32.dll:
• 0x4726ec Sleep
Library oleaut32.dll:
• 0x4726f4 SafeArrayPtrOfIndex
• 0x4726f8 SafeArrayPutElement
• 0x4726fc SafeArrayGetElement
• 0x472704 SafeArrayAccessData
• 0x472708 SafeArrayGetUBound
• 0x47270c SafeArrayGetLBound
• 0x472710 SafeArrayCreate
• 0x472714 VariantChangeType
• 0x472718 VariantCopyInd
• 0x47271c VariantCopy
• 0x472720 VariantClear
• 0x472724 VariantInit
Library ole32.dll:
• 0x47272c CoCreateInstance
• 0x472730 CoGetMalloc
• 0x472734 CoUninitialize
• 0x472738 CoInitialize
Library oleaut32.dll:
• 0x472740 GetErrorInfo
• 0x472744 SysFreeString
Library comctl32.dll:
• 0x472754 ImageList_Write
• 0x472758 ImageList_Read
• 0x472768 ImageList_DragMove
• 0x47276c ImageList_DragLeave
• 0x472770 ImageList_DragEnter
• 0x472774 ImageList_EndDrag
• 0x472778 ImageList_BeginDrag
• 0x47277c ImageList_Remove
• 0x472780 ImageList_DrawEx
• 0x472784 ImageList_Replace
• 0x472788 ImageList_Draw
• 0x472798 ImageList_Add
• 0x4727a0 ImageList_Destroy
• 0x4727a4 ImageList_Create
Library comdlg32.dll:
• 0x4727ac GetSaveFileNameA
• 0x4727b0 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51379 239.255.255.250 3702
192.168.56.101 55369 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.