SmartHawk

6.4

高危

51 个模型检测该样本为恶意！

重新分析

下载样本

c256666562b73aee6208fa0bacff25b832c0ec16fe7e7081a7c7ff3ef2016c83

7e7bffdf3b021dd9a0ccc23e3ac6008f.exe

分析耗时

50s

最近分析

文件大小

778.5KB

静态报毒动态报毒 AI SCORE=84 ANDROM ATTRIBUTE AUTO AZWQ CLOUD CONFIDENCE DBIIZPO FAKEAV FORMBOOK GDSDA GENERICKD GENERICRXAA GENERIK GENKD HIGH CONFIDENCE HIGHCONFIDENCE HNBZRN MALICIOUS PE MALWARE@#STVB55PNB492 NOON SCORE SSCOPE SWOTTER THGOGBO UNSAFE XBPPG 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	GenericRXAA-AA!7E7BFFDF3B02	20200717	6.0.6.653
Alibaba	TrojanSpy:Win32/FormBook.1d266c0f	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Malware-gen	20200717	18.4.3895.0
Kingsoft		20200717	2013.8.14.323
Tencent	Win32.Trojan.Inject.Auto	20200717	1.0.0.1
CrowdStrike	win/malicious_confidence_70% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (50 out of 32403 个事件)

Time & API	Arguments	Status
1619649225.138017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 5046272 registers.eax: 0 registers.ebp: 1638192 registers.edx: 1983904256 registers.ebx: 1983189538 registers.esi: 1983912052 registers.ecx: 4125117381 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.138017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 5111808 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.138017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 5177344 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.138017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 5242880 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.138017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 5308416 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.138017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 5373952 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.138017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 5439488 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.138017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 5505024 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.154017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 5767168 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 0 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.154017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 5832704 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.154017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 5898240 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.154017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 5963776 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.154017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 6029312 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.154017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 6094848 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.154017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 6160384 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.154017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 6225920 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.169017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 6291456 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.169017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 6356992 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.169017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 6422528 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.169017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 6488064 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.169017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 6553600 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.169017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 6684672 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 0 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 6750208 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 6815744 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 6881280 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 6946816 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 7012352 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 7077888 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 7143424 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 7208960 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 7274496 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 7340032 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 7405568 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 7471104 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 7536640 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 7602176 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 7667712 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 7733248 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 7798784 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 7864320 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 7929856 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 7995392 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 8060928 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 8126464 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.185017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 8257536 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 0 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.200017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 8323072 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.200017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 8388608 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.200017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 8454144 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.200017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 10354688 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 256 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success
1619649225.200017 __exception__	stacktrace: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc612f @ 0x4c612f 7e7bffdf3b021dd9a0ccc23e3ac6008f+0x72730 @ 0x472730 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638180 registers.edi: 10420224 registers.eax: 0 registers.ebp: 1638192 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1637056 registers.ecx: 1638340 exception.instruction_r: 8b 3f e9 be f3 ff ff 8b c2 05 00 2e 74 76 e9 55 exception.symbol: 7e7bffdf3b021dd9a0ccc23e3ac6008f+0xc834e exception.instruction: mov edi, dword ptr [edi] exception.module: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe exception.exception_code: 0xc0000005 exception.offset: 820046 exception.address: 0x4c834e	success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (4 个事件)

Time & API	Arguments	Status
1619649239.904017 NtAllocateVirtualMemory	process_identifier: 2120 region_size: 503808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x004d0000	success
1619649239.935017 NtAllocateVirtualMemory	process_identifier: 2120 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ec0000	success
1619649239.950017 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619652576.453751 NtAllocateVirtualMemory	process_identifier: 376 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01fc0000	success

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619649255.794017 CreateProcessInternalW	thread_identifier: 2428 thread_handle: 0x000000d8 process_identifier: 376 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7e7bffdf3b021dd9a0ccc23e3ac6008f.exe track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7e7bffdf3b021dd9a0ccc23e3ac6008f.exe" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7e7bffdf3b021dd9a0ccc23e3ac6008f.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x000000dc inherit_handles: 1	success	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619649239.997017 Process32NextW	process_name: pythonw.exe snapshot_handle: 0x00000088 process_identifier: 2056	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.785779385402161

section

{'size_of_data': '0x00044e00', 'virtual_address': '0x00084000', 'entropy': 7.785779385402161, 'name': '.rsrc', 'virtual_size': '0x00045000'}

description

A section with a high entropy has been found

entropy

0.35434083601286176

description

Overall entropy of this PE file is high

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (21 个事件)

Time & API	Arguments	Status
1619649239.997017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x00000088 process_identifier: 2120	failed
1619649240.044017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x0000008c process_identifier: 2120	failed
1619649240.091017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x00000090 process_identifier: 2120	failed
1619649240.122017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x00000094 process_identifier: 2120	failed
1619649240.169017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x00000098 process_identifier: 2120	failed
1619649240.200017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x0000009c process_identifier: 2120	failed
1619649240.247017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x000000a0 process_identifier: 2120	failed
1619649240.294017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x000000a4 process_identifier: 2120	failed
1619649240.341017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x000000a8 process_identifier: 2120	failed
1619649240.372017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x000000ac process_identifier: 2120	failed
1619649240.404017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x000000b0 process_identifier: 2120	failed
1619649240.435017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x000000b4 process_identifier: 2120	failed
1619649240.466017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x000000b8 process_identifier: 2120	failed
1619649240.497017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x000000bc process_identifier: 2120	failed
1619649240.529017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x000000c0 process_identifier: 2120	failed
1619649240.560017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x000000c4 process_identifier: 2120	failed
1619649240.575017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x000000c8 process_identifier: 2120	failed
1619649240.607017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x000000cc process_identifier: 2120	failed
1619649240.638017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x000000d0 process_identifier: 2120	failed
1619649240.669017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x000000d4 process_identifier: 2120	failed
1619649255.810017 Process32NextW	process_name: 7e7bffdf3b021dd9a0ccc23e3ac6008f.exe snapshot_handle: 0x000000e4 process_identifier: 376	failed

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (5 个事件)

Time & API	Arguments	Status	Return
1619649255.825017 NtAllocateVirtualMemory	process_identifier: 376 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000000dc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619649255.825017 NtAllocateVirtualMemory	process_identifier: 376 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000000dc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619649255.825017 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000000dc base_address: 0x77d4f000	success	0
1619649255.825017 NtAllocateVirtualMemory	process_identifier: 376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000000dc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x001e0000	success	0
1619649255.825017 NtAllocateVirtualMemory	process_identifier: 376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000000dc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x001f0000	success	0

Executed a process and injected code into it, probably while unpacking (8 个事件)

Time & API	Arguments	Status	Return
1619649255.794017 CreateProcessInternalW	thread_identifier: 2428 thread_handle: 0x000000d8 process_identifier: 376 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7e7bffdf3b021dd9a0ccc23e3ac6008f.exe track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7e7bffdf3b021dd9a0ccc23e3ac6008f.exe" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7e7bffdf3b021dd9a0ccc23e3ac6008f.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x000000dc inherit_handles: 1	success	1
1619649255.794017 NtGetContextThread	thread_handle: 0x000000d8	success	0
1619649255.825017 NtAllocateVirtualMemory	process_identifier: 376 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000000dc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619649255.825017 NtUnmapViewOfSection	process_identifier: 376 region_size: 4096 process_handle: 0x000000dc base_address: 0x00400000	success	0
1619649255.825017 NtUnmapViewOfSection	process_identifier: 376 region_size: 2004156416 process_handle: 0x000000dc base_address: 0x00400000	failed	3221225497
1619649255.825017 NtAllocateVirtualMemory	process_identifier: 376 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000000dc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619649255.825017 NtAllocateVirtualMemory	process_identifier: 376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000000dc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x001e0000	success	0
1619649255.825017 NtAllocateVirtualMemory	process_identifier: 376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000000dc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x001f0000	success	0

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 个事件)

MicroWorld-eScan	Trojan.GenericKD.34132294
FireEye	Generic.mg.7e7bffdf3b021dd9
CAT-QuickHeal	Trojanspy.Noon
McAfee	GenericRXAA-AA!7E7BFFDF3B02
Malwarebytes	Spyware.FormBook.MSIL
Sangfor	Malware
K7AntiVirus	Trojan ( 0052eef11 )
Alibaba	TrojanSpy:Win32/FormBook.1d266c0f
K7GW	Trojan ( 0052eef11 )
Cybereason	malicious.f3b021
Cyren	W32/Trojan.FDFD-6857
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Malware-gen
GData	Trojan.GenericKD.34132294
Kaspersky	Trojan-Spy.Win32.Noon.azwq
BitDefender	Trojan.GenericKD.34132294
NANO-Antivirus	Trojan.Win32.Androm.hnbzrn
Paloalto	generic.ml
Rising	Spyware.Noon!8.E7C9 (CLOUD)
Endgame	malicious (high confidence)
Sophos	Mal/Generic-S
Comodo	Malware@#stvb55pnb492
F-Secure	Trojan.TR/AD.Swotter.xbppg
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.Win32.NOON.THGOGBO
Emsisoft	Trojan.GenericKD.34132294 (B)
SentinelOne	DFI - Malicious PE
Jiangmin	TrojanSpy.Noon.pye
Webroot	W32.Trojan.GenKD
Avira	TR/AD.Swotter.xbppg
Antiy-AVL	Trojan[Spy]/Win32.Noon
Arcabit	Trojan.Generic.D208D146
ZoneAlarm	Trojan-Spy.Win32.Noon.azwq
Microsoft	Trojan:Win32/FormBook.DB!MTB
Cynet	Malicious (score: 85)
VBA32	SScope.Trojan.FakeAV.01697
ALYac	Trojan.Agent.FormBook
MAX	malware (ai score=84)
Ad-Aware	Trojan.GenericKD.34132294
Cylance	Unsafe
ESET-NOD32	Win32/Formbook.AA
TrendMicro-HouseCall	TrojanSpy.Win32.NOON.THGOGBO
Tencent	Win32.Trojan.Inject.Auto
Ikarus	Trojan.SuspectCRC
Fortinet	W32/Generik.DBIIZPO!tr
BitDefenderTheta	AI:Packer.67C7CA9A18
AVG	Win32:Malware-gen
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_70% (W)

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x47612c DeleteCriticalSection

• 0x476130 LeaveCriticalSection

• 0x476134 EnterCriticalSection

• 0x476138 InitializeCriticalSection

• 0x47613c VirtualFree

• 0x476140 VirtualAlloc

• 0x476144 LocalFree

• 0x476148 LocalAlloc

• 0x47614c GetVersion

• 0x476150 GetCurrentThreadId

• 0x476154 InterlockedDecrement

• 0x476158 InterlockedIncrement

• 0x47615c VirtualQuery

• 0x476160 WideCharToMultiByte

• 0x476164 MultiByteToWideChar

• 0x476168 lstrlenA

• 0x47616c lstrcpynA

• 0x476170 LoadLibraryExA

• 0x476174 GetThreadLocale

• 0x476178 GetStartupInfoA

• 0x47617c GetProcAddress

• 0x476180 GetModuleHandleA

• 0x476184 GetModuleFileNameA

• 0x476188 GetLocaleInfoA

• 0x47618c GetCommandLineA

• 0x476190 FreeLibrary

• 0x476194 FindFirstFileA

• 0x476198 FindClose

• 0x47619c ExitProcess

• 0x4761a0 WriteFile

• 0x4761a4 UnhandledExceptionFilter

• 0x4761a8 RtlUnwind

• 0x4761ac RaiseException

• 0x4761b0 GetStdHandle

Library user32.dll:

• 0x4761b8 GetKeyboardType

• 0x4761bc LoadStringA

• 0x4761c0 MessageBoxA

• 0x4761c4 CharNextA

Library advapi32.dll:

• 0x4761cc RegQueryValueExA

• 0x4761d0 RegOpenKeyExA

• 0x4761d4 RegCloseKey

Library oleaut32.dll:

• 0x4761dc SysFreeString

• 0x4761e0 SysReAllocStringLen

• 0x4761e4 SysAllocStringLen

Library kernel32.dll:

• 0x4761ec TlsSetValue

• 0x4761f0 TlsGetValue

• 0x4761f4 LocalAlloc

• 0x4761f8 GetModuleHandleA

Library advapi32.dll:

• 0x476200 RegQueryValueExA

• 0x476204 RegOpenKeyExA

• 0x476208 RegCloseKey

Library kernel32.dll:

• 0x476210 lstrcpyA

• 0x476214 WritePrivateProfileStringA

• 0x476218 WriteFile

• 0x47621c WaitForSingleObject

• 0x476220 VirtualQuery

• 0x476224 VirtualAlloc

• 0x476228 Sleep

• 0x47622c SizeofResource

• 0x476230 SetThreadLocale

• 0x476234 SetFilePointer

• 0x476238 SetEvent

• 0x47623c SetErrorMode

• 0x476240 SetEndOfFile

• 0x476244 ResetEvent

• 0x476248 ReadFile

• 0x47624c MulDiv

• 0x476250 LockResource

• 0x476254 LoadResource

• 0x476258 LoadLibraryA

• 0x47625c LeaveCriticalSection

• 0x476260 InitializeCriticalSection

• 0x476264 GlobalUnlock

• 0x476268 GlobalReAlloc

• 0x47626c GlobalHandle

• 0x476270 GlobalLock

• 0x476274 GlobalFree

• 0x476278 GlobalFindAtomA

• 0x47627c GlobalDeleteAtom

• 0x476280 GlobalAlloc

• 0x476284 GlobalAddAtomA

• 0x476288 GetVersionExA

• 0x47628c GetVersion

• 0x476290 GetTickCount

• 0x476294 GetThreadLocale

• 0x476298 GetSystemInfo

• 0x47629c GetStringTypeExA

• 0x4762a0 GetStdHandle

• 0x4762a4 GetProcAddress

• 0x4762a8 GetPrivateProfileStringA

• 0x4762ac GetModuleHandleA

• 0x4762b0 GetModuleFileNameA

• 0x4762b4 GetLocaleInfoA

• 0x4762b8 GetLocalTime

• 0x4762bc GetLastError

• 0x4762c0 GetFullPathNameA

• 0x4762c4 GetDiskFreeSpaceA

• 0x4762c8 GetDateFormatA

• 0x4762cc GetCurrentThreadId

• 0x4762d0 GetCurrentProcessId

• 0x4762d4 GetCPInfo

• 0x4762d8 GetACP

• 0x4762dc FreeResource

• 0x4762e0 InterlockedExchange

• 0x4762e4 FreeLibrary

• 0x4762e8 FormatMessageA

• 0x4762ec FindResourceA

• 0x4762f0 EnumCalendarInfoA

• 0x4762f4 EnterCriticalSection

• 0x4762f8 DeleteCriticalSection

• 0x4762fc CreateThread

• 0x476300 CreateFileA

• 0x476304 CreateEventA

• 0x476308 CompareStringA

• 0x47630c CloseHandle

Library version.dll:

• 0x476314 VerQueryValueA

• 0x476318 GetFileVersionInfoSizeA

• 0x47631c GetFileVersionInfoA

Library gdi32.dll:

• 0x476324 UnrealizeObject

• 0x476328 StretchBlt

• 0x47632c SetWindowOrgEx

• 0x476330 SetWindowExtEx

• 0x476334 SetWinMetaFileBits

• 0x476338 SetViewportOrgEx

• 0x47633c SetViewportExtEx

• 0x476340 SetTextColor

• 0x476344 SetStretchBltMode

• 0x476348 SetROP2

• 0x47634c SetPixel

• 0x476350 SetMapMode

• 0x476354 SetEnhMetaFileBits

• 0x476358 SetDIBColorTable

• 0x47635c SetBrushOrgEx

• 0x476360 SetBkMode

• 0x476364 SetBkColor

• 0x476368 SelectPalette

• 0x47636c SelectObject

• 0x476370 SaveDC

• 0x476374 RoundRect

• 0x476378 RestoreDC

• 0x47637c Rectangle

• 0x476380 RectVisible

• 0x476384 RealizePalette

• 0x476388 Polyline

• 0x47638c PolyPolyline

• 0x476390 PlayEnhMetaFile

• 0x476394 PatBlt

• 0x476398 MoveToEx

• 0x47639c MaskBlt

• 0x4763a0 LineTo

• 0x4763a4 IntersectClipRect

• 0x4763a8 GetWindowOrgEx

• 0x4763ac GetWinMetaFileBits

• 0x4763b0 GetTextMetricsA

• 0x4763b4 GetTextExtentPointA

• 0x4763b8 GetTextExtentPoint32A

• 0x4763bc GetSystemPaletteEntries

• 0x4763c0 GetStockObject

• 0x4763c4 GetPixel

• 0x4763c8 GetPaletteEntries

• 0x4763cc GetObjectA

• 0x4763d0 GetEnhMetaFilePaletteEntries

• 0x4763d4 GetEnhMetaFileHeader

• 0x4763d8 GetEnhMetaFileBits

• 0x4763dc GetDeviceCaps

• 0x4763e0 GetDIBits

• 0x4763e4 GetDIBColorTable

• 0x4763e8 GetDCOrgEx

• 0x4763ec GetCurrentPositionEx

• 0x4763f0 GetClipBox

• 0x4763f4 GetBrushOrgEx

• 0x4763f8 GetBitmapBits

• 0x4763fc ExtTextOutA

• 0x476400 ExtCreatePen

• 0x476404 ExcludeClipRect

• 0x476408 Ellipse

• 0x47640c DeleteObject

• 0x476410 DeleteEnhMetaFile

• 0x476414 DeleteDC

• 0x476418 CreateSolidBrush

• 0x47641c CreatePenIndirect

• 0x476420 CreatePalette

• 0x476424 CreateHalftonePalette

• 0x476428 CreateFontIndirectA

• 0x47642c CreateDIBitmap

• 0x476430 CreateDIBSection

• 0x476434 CreateCompatibleDC

• 0x476438 CreateCompatibleBitmap

• 0x47643c CreateBrushIndirect

• 0x476440 CreateBitmap

• 0x476444 CopyEnhMetaFileA

• 0x476448 BitBlt

Library user32.dll:

• 0x476450 CreateWindowExA

• 0x476454 WindowFromPoint

• 0x476458 WinHelpA

• 0x47645c WaitMessage

• 0x476460 ValidateRect

• 0x476464 UpdateWindow

• 0x476468 UnregisterClassA

• 0x47646c UnionRect

• 0x476470 UnhookWindowsHookEx

• 0x476474 TranslateMessage

• 0x476478 TranslateMDISysAccel

• 0x47647c TrackPopupMenu

• 0x476480 SystemParametersInfoA

• 0x476484 ShowWindow

• 0x476488 ShowScrollBar

• 0x47648c ShowOwnedPopups

• 0x476490 ShowCursor

• 0x476494 SetWindowsHookExA

• 0x476498 SetWindowTextA

• 0x47649c SetWindowPos

• 0x4764a0 SetWindowPlacement

• 0x4764a4 SetWindowLongA

• 0x4764a8 SetTimer

• 0x4764ac SetScrollRange

• 0x4764b0 SetScrollPos

• 0x4764b4 SetScrollInfo

• 0x4764b8 SetRect

• 0x4764bc SetPropA

• 0x4764c0 SetParent

• 0x4764c4 SetMenuItemInfoA

• 0x4764c8 SetMenu

• 0x4764cc SetKeyboardState

• 0x4764d0 SetForegroundWindow

• 0x4764d4 SetFocus

• 0x4764d8 SetCursor

• 0x4764dc SetClipboardData

• 0x4764e0 SetClassLongA

• 0x4764e4 SetCapture

• 0x4764e8 SetActiveWindow

• 0x4764ec SendMessageA

• 0x4764f0 ScrollWindowEx

• 0x4764f4 ScrollWindow

• 0x4764f8 ScreenToClient

• 0x4764fc RemovePropA

• 0x476500 RemoveMenu

• 0x476504 ReleaseDC

• 0x476508 ReleaseCapture

• 0x47650c RegisterWindowMessageA

• 0x476510 RegisterClipboardFormatA

• 0x476514 RegisterClassA

• 0x476518 RedrawWindow

• 0x47651c PtInRect

• 0x476520 PostQuitMessage

• 0x476524 PostMessageA

• 0x476528 PeekMessageA

• 0x47652c OpenClipboard

• 0x476530 OffsetRect

• 0x476534 OemToCharA

• 0x476538 MessageBoxA

• 0x47653c MessageBeep

• 0x476540 MapWindowPoints

• 0x476544 MapVirtualKeyA

• 0x476548 LoadStringA

• 0x47654c LoadKeyboardLayoutA

• 0x476550 LoadIconA

• 0x476554 LoadCursorA

• 0x476558 LoadBitmapA

• 0x47655c KillTimer

• 0x476560 IsZoomed

• 0x476564 IsWindowVisible

• 0x476568 IsWindowEnabled

• 0x47656c IsWindow

• 0x476570 IsRectEmpty

• 0x476574 IsIconic

• 0x476578 IsDialogMessageA

• 0x47657c IsChild

• 0x476580 IsCharAlphaNumericA

• 0x476584 IsCharAlphaA

• 0x476588 InvalidateRect

• 0x47658c IntersectRect

• 0x476590 InsertMenuItemA

• 0x476594 InsertMenuA

• 0x476598 InflateRect

• 0x47659c GetWindowThreadProcessId

• 0x4765a0 GetWindowTextA

• 0x4765a4 GetWindowRect

• 0x4765a8 GetWindowPlacement

• 0x4765ac GetWindowLongA

• 0x4765b0 GetWindowDC

• 0x4765b4 GetTopWindow

• 0x4765b8 GetSystemMetrics

• 0x4765bc GetSystemMenu

• 0x4765c0 GetSysColorBrush

• 0x4765c4 GetSysColor

• 0x4765c8 GetSubMenu

• 0x4765cc GetScrollRange

• 0x4765d0 GetScrollPos

• 0x4765d4 GetScrollInfo

• 0x4765d8 GetPropA

• 0x4765dc GetParent

• 0x4765e0 GetWindow

• 0x4765e4 GetMessageTime

• 0x4765e8 GetMenuStringA

• 0x4765ec GetMenuState

• 0x4765f0 GetMenuItemInfoA

• 0x4765f4 GetMenuItemID

• 0x4765f8 GetMenuItemCount

• 0x4765fc GetMenu

• 0x476600 GetLastActivePopup

• 0x476604 GetKeyboardState

• 0x476608 GetKeyboardLayoutList

• 0x47660c GetKeyboardLayout

• 0x476610 GetKeyState

• 0x476614 GetKeyNameTextA

• 0x476618 GetIconInfo

• 0x47661c GetForegroundWindow

• 0x476620 GetFocus

• 0x476624 GetDoubleClickTime

• 0x476628 GetDesktopWindow

• 0x47662c GetDCEx

• 0x476630 GetDC

• 0x476634 GetCursorPos

• 0x476638 GetCursor

• 0x47663c GetClipboardData

• 0x476640 GetClientRect

• 0x476644 GetClassNameA

• 0x476648 GetClassInfoA

• 0x47664c GetCaretPos

• 0x476650 GetCapture

• 0x476654 GetActiveWindow

• 0x476658 FrameRect

• 0x47665c FindWindowA

• 0x476660 FillRect

• 0x476664 EqualRect

• 0x476668 EnumWindows

• 0x47666c EnumThreadWindows

• 0x476670 EnumClipboardFormats

• 0x476674 EndPaint

• 0x476678 EnableWindow

• 0x47667c EnableScrollBar

• 0x476680 EnableMenuItem

• 0x476684 EmptyClipboard

• 0x476688 DrawTextA

• 0x47668c DrawMenuBar

• 0x476690 DrawIconEx

• 0x476694 DrawIcon

• 0x476698 DrawFrameControl

• 0x47669c DrawFocusRect

• 0x4766a0 DrawEdge

• 0x4766a4 DispatchMessageA

• 0x4766a8 DestroyWindow

• 0x4766ac DestroyMenu

• 0x4766b0 DestroyIcon

• 0x4766b4 DestroyCursor

• 0x4766b8 DeleteMenu

• 0x4766bc DefWindowProcA

• 0x4766c0 DefMDIChildProcA

• 0x4766c4 DefFrameProcA

• 0x4766c8 CreatePopupMenu

• 0x4766cc CreateMenu

• 0x4766d0 CreateIcon

• 0x4766d4 CloseClipboard

• 0x4766d8 ClientToScreen

• 0x4766dc CheckMenuItem

• 0x4766e0 CallWindowProcA

• 0x4766e4 CallNextHookEx

• 0x4766e8 BeginPaint

• 0x4766ec CharNextA

• 0x4766f0 CharLowerBuffA

• 0x4766f4 CharLowerA

• 0x4766f8 CharUpperBuffA

• 0x4766fc CharToOemA

• 0x476700 AdjustWindowRectEx

• 0x476704 ActivateKeyboardLayout

Library kernel32.dll:

• 0x47670c Sleep

Library oleaut32.dll:

• 0x476714 SafeArrayPtrOfIndex

• 0x476718 SafeArrayGetUBound

• 0x47671c SafeArrayGetLBound

• 0x476720 SafeArrayCreate

• 0x476724 VariantChangeType

• 0x476728 VariantCopy

• 0x47672c VariantClear

• 0x476730 VariantInit

Library kernel32.dll:

• 0x476798 MulDiv

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58370	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.