SmartHawk

4.8

中危

36 个模型检测该样本为恶意！

重新分析

下载样本

bd705cdb9a9e06398c6f84000aa04b8ca6cb6cb07854d15cb67ac22684493500

8a3592b41a7028c36a7a4cfe86338de5.exe

分析耗时

28s

最近分析

文件大小

6.5MB

静态报毒动态报毒 AI SCORE=99 ARTEMIS ATTRIBUTE CMRTAZQ1S71NNE+UJ9XEGD8+C0RB CONFIDENCE ENIGMAPROTECTOR HACKTOOL HIGHCONFIDENCE HW32 M SUSPICIOUS MALICIOUS PE N3#79% OASO PLOCK PUAMSON R002H09EU19 R266558 RDM+ SALITY TIGGRE UNSAFE UNWADERS URSU 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Packed:Win32/EnigmaProtector.9d4a37d2	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Malware-gen	20190604	18.4.3895.0
Tencent		20190604	1.0.0.1
Kingsoft		20190604	2013.8.14.323
McAfee	Artemis!8A3592B41A70	20190604	6.0.6.653
CrowdStrike	win/malicious_confidence_90% (W)	20190212	1.0

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620960315.474751 GetComputerNameA	computer_name: OSKAR-PC	success	1	0
1620960315.958751 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620960316.365751 IsDebuggerPresent		failed	0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

One or more processes crashed (50 个事件)

Time & API	Arguments	Status
1620960313.943751 __exception__	stacktrace: dbkFCallWrapperAddr+0x385978 8a3592b41a7028c36a7a4cfe86338de5+0x893fb4 @ 0xc93fb4 dbkFCallWrapperAddr+0x385f25 8a3592b41a7028c36a7a4cfe86338de5+0x894561 @ 0xc94561 dbkFCallWrapperAddr+0x4636a7 8a3592b41a7028c36a7a4cfe86338de5+0x971ce3 @ 0xd71ce3 registers.esp: 2686684 registers.edi: 14098672 registers.eax: 0 registers.ebp: 2686712 registers.edx: 0 registers.ebx: 3645646510 registers.esi: 11505664 registers.ecx: 52640492 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x2cb099 8a3592b41a7028c36a7a4cfe86338de5+0x7d96d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 8230613 exception.address: 0xbd96d5	success
1620960313.958751 __exception__	stacktrace: dbkFCallWrapperAddr+0x385978 8a3592b41a7028c36a7a4cfe86338de5+0x893fb4 @ 0xc93fb4 dbkFCallWrapperAddr+0x385f25 8a3592b41a7028c36a7a4cfe86338de5+0x894561 @ 0xc94561 dbkFCallWrapperAddr+0x4636a7 8a3592b41a7028c36a7a4cfe86338de5+0x971ce3 @ 0xd71ce3 registers.esp: 2686684 registers.edi: 2686684 registers.eax: 0 registers.ebp: 2686712 registers.edx: 0 registers.ebx: 12424939 registers.esi: 0 registers.ecx: 2686720 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x2cb099 8a3592b41a7028c36a7a4cfe86338de5+0x7d96d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 8230613 exception.address: 0xbd96d5	success
1620960313.958751 __exception__	stacktrace: dbkFCallWrapperAddr+0x385978 8a3592b41a7028c36a7a4cfe86338de5+0x893fb4 @ 0xc93fb4 dbkFCallWrapperAddr+0x385f25 8a3592b41a7028c36a7a4cfe86338de5+0x894561 @ 0xc94561 dbkFCallWrapperAddr+0x4636a7 8a3592b41a7028c36a7a4cfe86338de5+0x971ce3 @ 0xd71ce3 registers.esp: 2686684 registers.edi: 2686684 registers.eax: 0 registers.ebp: 2686712 registers.edx: 0 registers.ebx: 12424939 registers.esi: 0 registers.ecx: 2686720 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x2cb099 8a3592b41a7028c36a7a4cfe86338de5+0x7d96d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 8230613 exception.address: 0xbd96d5	success
1620960313.958751 __exception__	stacktrace: dbkFCallWrapperAddr+0x385978 8a3592b41a7028c36a7a4cfe86338de5+0x893fb4 @ 0xc93fb4 dbkFCallWrapperAddr+0x385f25 8a3592b41a7028c36a7a4cfe86338de5+0x894561 @ 0xc94561 dbkFCallWrapperAddr+0x4636a7 8a3592b41a7028c36a7a4cfe86338de5+0x971ce3 @ 0xd71ce3 registers.esp: 2686684 registers.edi: 2686684 registers.eax: 0 registers.ebp: 2686712 registers.edx: 0 registers.ebx: 12424939 registers.esi: 0 registers.ecx: 2686720 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x2cb099 8a3592b41a7028c36a7a4cfe86338de5+0x7d96d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 8230613 exception.address: 0xbd96d5	success
1620960313.958751 __exception__	stacktrace: dbkFCallWrapperAddr+0x385978 8a3592b41a7028c36a7a4cfe86338de5+0x893fb4 @ 0xc93fb4 dbkFCallWrapperAddr+0x385f25 8a3592b41a7028c36a7a4cfe86338de5+0x894561 @ 0xc94561 dbkFCallWrapperAddr+0x4636a7 8a3592b41a7028c36a7a4cfe86338de5+0x971ce3 @ 0xd71ce3 registers.esp: 2686684 registers.edi: 2686684 registers.eax: 0 registers.ebp: 2686712 registers.edx: 0 registers.ebx: 12424939 registers.esi: 0 registers.ecx: 2686720 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x2cb099 8a3592b41a7028c36a7a4cfe86338de5+0x7d96d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 8230613 exception.address: 0xbd96d5	success
1620960314.036751 __exception__	stacktrace: dbkFCallWrapperAddr+0x3748d8 8a3592b41a7028c36a7a4cfe86338de5+0x882f14 @ 0xc82f14 dbkFCallWrapperAddr+0x385f3d 8a3592b41a7028c36a7a4cfe86338de5+0x894579 @ 0xc94579 dbkFCallWrapperAddr+0x4636a7 8a3592b41a7028c36a7a4cfe86338de5+0x971ce3 @ 0xd71ce3 registers.esp: 2686620 registers.edi: 12892836 registers.eax: 0 registers.ebp: 2686648 registers.edx: 2 registers.ebx: 7311360 registers.esi: 11505664 registers.ecx: 11505664 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x2cb0c4 8a3592b41a7028c36a7a4cfe86338de5+0x7d9700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 8230656 exception.address: 0xbd9700	success
1620960314.036751 __exception__	stacktrace: dbkFCallWrapperAddr+0x3748d8 8a3592b41a7028c36a7a4cfe86338de5+0x882f14 @ 0xc82f14 dbkFCallWrapperAddr+0x385f3d 8a3592b41a7028c36a7a4cfe86338de5+0x894579 @ 0xc94579 dbkFCallWrapperAddr+0x4636a7 8a3592b41a7028c36a7a4cfe86338de5+0x971ce3 @ 0xd71ce3 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 2 registers.ebx: 12424982 registers.esi: 0 registers.ecx: 2686656 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x2cb0c4 8a3592b41a7028c36a7a4cfe86338de5+0x7d9700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 8230656 exception.address: 0xbd9700	success
1620960314.036751 __exception__	stacktrace: dbkFCallWrapperAddr+0x3748d8 8a3592b41a7028c36a7a4cfe86338de5+0x882f14 @ 0xc82f14 dbkFCallWrapperAddr+0x385f3d 8a3592b41a7028c36a7a4cfe86338de5+0x894579 @ 0xc94579 dbkFCallWrapperAddr+0x4636a7 8a3592b41a7028c36a7a4cfe86338de5+0x971ce3 @ 0xd71ce3 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 2 registers.ebx: 12424982 registers.esi: 0 registers.ecx: 2686656 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x2cb0c4 8a3592b41a7028c36a7a4cfe86338de5+0x7d9700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 8230656 exception.address: 0xbd9700	success
1620960315.396751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63a2d6 8a3592b41a7028c36a7a4cfe86338de5+0xb48912 @ 0xf48912 dbkFCallWrapperAddr+0x63f523 8a3592b41a7028c36a7a4cfe86338de5+0xb4db5f @ 0xf4db5f dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686316 registers.edi: 16994544 registers.eax: 0 registers.ebp: 2686344 registers.edx: 0 registers.ebx: 2230735634 registers.esi: 14401536 registers.ecx: 67123948 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e099 8a3592b41a7028c36a7a4cfe86338de5+0xa9c6d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 11126485 exception.address: 0xe9c6d5	success
1620960315.396751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63a2d6 8a3592b41a7028c36a7a4cfe86338de5+0xb48912 @ 0xf48912 dbkFCallWrapperAddr+0x63f523 8a3592b41a7028c36a7a4cfe86338de5+0xb4db5f @ 0xf4db5f dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686316 registers.edi: 2686316 registers.eax: 0 registers.ebp: 2686344 registers.edx: 0 registers.ebx: 15320811 registers.esi: 0 registers.ecx: 2686352 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e099 8a3592b41a7028c36a7a4cfe86338de5+0xa9c6d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 11126485 exception.address: 0xe9c6d5	success
1620960315.396751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63a2d6 8a3592b41a7028c36a7a4cfe86338de5+0xb48912 @ 0xf48912 dbkFCallWrapperAddr+0x63f523 8a3592b41a7028c36a7a4cfe86338de5+0xb4db5f @ 0xf4db5f dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686316 registers.edi: 2686316 registers.eax: 0 registers.ebp: 2686344 registers.edx: 0 registers.ebx: 15320811 registers.esi: 0 registers.ecx: 2686352 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e099 8a3592b41a7028c36a7a4cfe86338de5+0xa9c6d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 11126485 exception.address: 0xe9c6d5	success
1620960315.396751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63a2d6 8a3592b41a7028c36a7a4cfe86338de5+0xb48912 @ 0xf48912 dbkFCallWrapperAddr+0x63f523 8a3592b41a7028c36a7a4cfe86338de5+0xb4db5f @ 0xf4db5f dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686316 registers.edi: 2686316 registers.eax: 0 registers.ebp: 2686344 registers.edx: 2 registers.ebx: 15320811 registers.esi: 0 registers.ecx: 2686352 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e0c4 8a3592b41a7028c36a7a4cfe86338de5+0xa9c700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 11126528 exception.address: 0xe9c700	success
1620960315.411751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63d68e 8a3592b41a7028c36a7a4cfe86338de5+0xb4bcca @ 0xf4bcca dbkFCallWrapperAddr+0x63f530 8a3592b41a7028c36a7a4cfe86338de5+0xb4db6c @ 0xf4db6c dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686252 registers.edi: 15788708 registers.eax: 0 registers.ebp: 2686280 registers.edx: 2 registers.ebx: 10207232 registers.esi: 14401536 registers.ecx: 14401536 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e0c4 8a3592b41a7028c36a7a4cfe86338de5+0xa9c700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 11126528 exception.address: 0xe9c700	success
1620960315.411751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63d68e 8a3592b41a7028c36a7a4cfe86338de5+0xb4bcca @ 0xf4bcca dbkFCallWrapperAddr+0x63f530 8a3592b41a7028c36a7a4cfe86338de5+0xb4db6c @ 0xf4db6c dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686252 registers.edi: 2686252 registers.eax: 0 registers.ebp: 2686280 registers.edx: 2 registers.ebx: 15320854 registers.esi: 0 registers.ecx: 2686288 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e0c4 8a3592b41a7028c36a7a4cfe86338de5+0xa9c700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 11126528 exception.address: 0xe9c700	success
1620960315.411751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63d68e 8a3592b41a7028c36a7a4cfe86338de5+0xb4bcca @ 0xf4bcca dbkFCallWrapperAddr+0x63f530 8a3592b41a7028c36a7a4cfe86338de5+0xb4db6c @ 0xf4db6c dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686252 registers.edi: 2686252 registers.eax: 0 registers.ebp: 2686280 registers.edx: 0 registers.ebx: 15320854 registers.esi: 0 registers.ecx: 2686288 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e099 8a3592b41a7028c36a7a4cfe86338de5+0xa9c6d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 11126485 exception.address: 0xe9c6d5	success
1620960315.411751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63d68e 8a3592b41a7028c36a7a4cfe86338de5+0xb4bcca @ 0xf4bcca dbkFCallWrapperAddr+0x63f530 8a3592b41a7028c36a7a4cfe86338de5+0xb4db6c @ 0xf4db6c dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686252 registers.edi: 2686252 registers.eax: 0 registers.ebp: 2686280 registers.edx: 0 registers.ebx: 15320811 registers.esi: 0 registers.ecx: 2686288 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e099 8a3592b41a7028c36a7a4cfe86338de5+0xa9c6d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 11126485 exception.address: 0xe9c6d5	success
1620960315.474751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63d954 8a3592b41a7028c36a7a4cfe86338de5+0xb4bf90 @ 0xf4bf90 dbkFCallWrapperAddr+0x63f530 8a3592b41a7028c36a7a4cfe86338de5+0xb4db6c @ 0xf4db6c dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686252 registers.edi: 15788708 registers.eax: 0 registers.ebp: 2686280 registers.edx: 0 registers.ebx: 10207232 registers.esi: 14401536 registers.ecx: 1478504532 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e099 8a3592b41a7028c36a7a4cfe86338de5+0xa9c6d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 11126485 exception.address: 0xe9c6d5	success
1620960315.474751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63d954 8a3592b41a7028c36a7a4cfe86338de5+0xb4bf90 @ 0xf4bf90 dbkFCallWrapperAddr+0x63f530 8a3592b41a7028c36a7a4cfe86338de5+0xb4db6c @ 0xf4db6c dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686252 registers.edi: 2686252 registers.eax: 0 registers.ebp: 2686280 registers.edx: 0 registers.ebx: 15320811 registers.esi: 0 registers.ecx: 2686288 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e099 8a3592b41a7028c36a7a4cfe86338de5+0xa9c6d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 11126485 exception.address: 0xe9c6d5	success
1620960315.474751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63d954 8a3592b41a7028c36a7a4cfe86338de5+0xb4bf90 @ 0xf4bf90 dbkFCallWrapperAddr+0x63f530 8a3592b41a7028c36a7a4cfe86338de5+0xb4db6c @ 0xf4db6c dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686252 registers.edi: 2686252 registers.eax: 0 registers.ebp: 2686280 registers.edx: 2 registers.ebx: 15320811 registers.esi: 0 registers.ecx: 2686288 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e0c4 8a3592b41a7028c36a7a4cfe86338de5+0xa9c700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 11126528 exception.address: 0xe9c700	success
1620960315.474751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63d954 8a3592b41a7028c36a7a4cfe86338de5+0xb4bf90 @ 0xf4bf90 dbkFCallWrapperAddr+0x63f530 8a3592b41a7028c36a7a4cfe86338de5+0xb4db6c @ 0xf4db6c dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686252 registers.edi: 2686252 registers.eax: 0 registers.ebp: 2686280 registers.edx: 0 registers.ebx: 15320854 registers.esi: 0 registers.ecx: 2686288 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e099 8a3592b41a7028c36a7a4cfe86338de5+0xa9c6d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 11126485 exception.address: 0xe9c6d5	success
1620960315.505751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63dae9 8a3592b41a7028c36a7a4cfe86338de5+0xb4c125 @ 0xf4c125 dbkFCallWrapperAddr+0x63f530 8a3592b41a7028c36a7a4cfe86338de5+0xb4db6c @ 0xf4db6c dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686252 registers.edi: 15788708 registers.eax: 0 registers.ebp: 2686280 registers.edx: 0 registers.ebx: 10207232 registers.esi: 14401536 registers.ecx: 0 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e099 8a3592b41a7028c36a7a4cfe86338de5+0xa9c6d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 11126485 exception.address: 0xe9c6d5	success
1620960315.521751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63dcc3 8a3592b41a7028c36a7a4cfe86338de5+0xb4c2ff @ 0xf4c2ff dbkFCallWrapperAddr+0x63f530 8a3592b41a7028c36a7a4cfe86338de5+0xb4db6c @ 0xf4db6c dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686252 registers.edi: 15788708 registers.eax: 0 registers.ebp: 2686280 registers.edx: 0 registers.ebx: 10207232 registers.esi: 14401536 registers.ecx: 2160714559 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e099 8a3592b41a7028c36a7a4cfe86338de5+0xa9c6d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 11126485 exception.address: 0xe9c6d5	success
1620960315.521751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63dcc3 8a3592b41a7028c36a7a4cfe86338de5+0xb4c2ff @ 0xf4c2ff dbkFCallWrapperAddr+0x63f530 8a3592b41a7028c36a7a4cfe86338de5+0xb4db6c @ 0xf4db6c dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686252 registers.edi: 2686252 registers.eax: 0 registers.ebp: 2686280 registers.edx: 2 registers.ebx: 15320811 registers.esi: 0 registers.ecx: 2686288 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e0c4 8a3592b41a7028c36a7a4cfe86338de5+0xa9c700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 11126528 exception.address: 0xe9c700	success
1620960315.521751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63dcc3 8a3592b41a7028c36a7a4cfe86338de5+0xb4c2ff @ 0xf4c2ff dbkFCallWrapperAddr+0x63f530 8a3592b41a7028c36a7a4cfe86338de5+0xb4db6c @ 0xf4db6c dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686252 registers.edi: 2686252 registers.eax: 0 registers.ebp: 2686280 registers.edx: 0 registers.ebx: 15320854 registers.esi: 0 registers.ecx: 2686288 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e099 8a3592b41a7028c36a7a4cfe86338de5+0xa9c6d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 11126485 exception.address: 0xe9c6d5	success
1620960315.521751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63dcc3 8a3592b41a7028c36a7a4cfe86338de5+0xb4c2ff @ 0xf4c2ff dbkFCallWrapperAddr+0x63f530 8a3592b41a7028c36a7a4cfe86338de5+0xb4db6c @ 0xf4db6c dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686252 registers.edi: 2686252 registers.eax: 0 registers.ebp: 2686280 registers.edx: 2 registers.ebx: 15320811 registers.esi: 0 registers.ecx: 2686288 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e0c4 8a3592b41a7028c36a7a4cfe86338de5+0xa9c700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 11126528 exception.address: 0xe9c700	success
1620960315.521751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63dcc3 8a3592b41a7028c36a7a4cfe86338de5+0xb4c2ff @ 0xf4c2ff dbkFCallWrapperAddr+0x63f530 8a3592b41a7028c36a7a4cfe86338de5+0xb4db6c @ 0xf4db6c dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686252 registers.edi: 2686252 registers.eax: 0 registers.ebp: 2686280 registers.edx: 2 registers.ebx: 15320854 registers.esi: 0 registers.ecx: 2686288 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e0c4 8a3592b41a7028c36a7a4cfe86338de5+0xa9c700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 11126528 exception.address: 0xe9c700	success
1620960315.521751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63dcc3 8a3592b41a7028c36a7a4cfe86338de5+0xb4c2ff @ 0xf4c2ff dbkFCallWrapperAddr+0x63f530 8a3592b41a7028c36a7a4cfe86338de5+0xb4db6c @ 0xf4db6c dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686252 registers.edi: 2686252 registers.eax: 0 registers.ebp: 2686280 registers.edx: 2 registers.ebx: 15320854 registers.esi: 0 registers.ecx: 2686288 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e0c4 8a3592b41a7028c36a7a4cfe86338de5+0xa9c700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 11126528 exception.address: 0xe9c700	success
1620960315.521751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63ddbe 8a3592b41a7028c36a7a4cfe86338de5+0xb4c3fa @ 0xf4c3fa dbkFCallWrapperAddr+0x63f530 8a3592b41a7028c36a7a4cfe86338de5+0xb4db6c @ 0xf4db6c dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686252 registers.edi: 15788708 registers.eax: 0 registers.ebp: 2686280 registers.edx: 2 registers.ebx: 10207232 registers.esi: 14401536 registers.ecx: 3892674048 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e0c4 8a3592b41a7028c36a7a4cfe86338de5+0xa9c700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 11126528 exception.address: 0xe9c700	success
1620960315.536751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63ddbe 8a3592b41a7028c36a7a4cfe86338de5+0xb4c3fa @ 0xf4c3fa dbkFCallWrapperAddr+0x63f530 8a3592b41a7028c36a7a4cfe86338de5+0xb4db6c @ 0xf4db6c dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686252 registers.edi: 2686252 registers.eax: 0 registers.ebp: 2686280 registers.edx: 2 registers.ebx: 15320854 registers.esi: 0 registers.ecx: 2686288 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e0c4 8a3592b41a7028c36a7a4cfe86338de5+0xa9c700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 11126528 exception.address: 0xe9c700	success
1620960315.536751 __exception__	stacktrace: dbkFCallWrapperAddr+0x63ddbe 8a3592b41a7028c36a7a4cfe86338de5+0xb4c3fa @ 0xf4c3fa dbkFCallWrapperAddr+0x63f530 8a3592b41a7028c36a7a4cfe86338de5+0xb4db6c @ 0xf4db6c dbkFCallWrapperAddr+0x72680f 8a3592b41a7028c36a7a4cfe86338de5+0xc34e4b @ 0x1034e4b registers.esp: 2686252 registers.edi: 2686252 registers.eax: 0 registers.ebp: 2686280 registers.edx: 2 registers.ebx: 15320854 registers.esi: 0 registers.ecx: 2686288 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x58e0c4 8a3592b41a7028c36a7a4cfe86338de5+0xa9c700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 11126528 exception.address: 0xe9c700	success
1620960315.958751 __exception__	stacktrace: dbkFCallWrapperAddr+0x374ba9 8a3592b41a7028c36a7a4cfe86338de5+0x8831e5 @ 0xc831e5 dbkFCallWrapperAddr+0x385f3d 8a3592b41a7028c36a7a4cfe86338de5+0x894579 @ 0xc94579 dbkFCallWrapperAddr+0x4636a7 8a3592b41a7028c36a7a4cfe86338de5+0x971ce3 @ 0xd71ce3 registers.esp: 2686620 registers.edi: 12892836 registers.eax: 0 registers.ebp: 2686648 registers.edx: 2 registers.ebx: 4 registers.esi: 4294967295 registers.ecx: 0 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x2cb0c4 8a3592b41a7028c36a7a4cfe86338de5+0x7d9700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 8230656 exception.address: 0xbd9700	success
1620960315.974751 __exception__	stacktrace: dbkFCallWrapperAddr+0x374ba9 8a3592b41a7028c36a7a4cfe86338de5+0x8831e5 @ 0xc831e5 dbkFCallWrapperAddr+0x385f3d 8a3592b41a7028c36a7a4cfe86338de5+0x894579 @ 0xc94579 dbkFCallWrapperAddr+0x4636a7 8a3592b41a7028c36a7a4cfe86338de5+0x971ce3 @ 0xd71ce3 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 0 registers.ebx: 12424982 registers.esi: 0 registers.ecx: 2686656 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x2cb099 8a3592b41a7028c36a7a4cfe86338de5+0x7d96d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 8230613 exception.address: 0xbd96d5	success
1620960315.974751 __exception__	stacktrace: dbkFCallWrapperAddr+0x374ba9 8a3592b41a7028c36a7a4cfe86338de5+0x8831e5 @ 0xc831e5 dbkFCallWrapperAddr+0x385f3d 8a3592b41a7028c36a7a4cfe86338de5+0x894579 @ 0xc94579 dbkFCallWrapperAddr+0x4636a7 8a3592b41a7028c36a7a4cfe86338de5+0x971ce3 @ 0xd71ce3 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 2 registers.ebx: 12424939 registers.esi: 0 registers.ecx: 2686656 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x2cb0c4 8a3592b41a7028c36a7a4cfe86338de5+0x7d9700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 8230656 exception.address: 0xbd9700	success
1620960315.974751 __exception__	stacktrace: dbkFCallWrapperAddr+0x374ba9 8a3592b41a7028c36a7a4cfe86338de5+0x8831e5 @ 0xc831e5 dbkFCallWrapperAddr+0x385f3d 8a3592b41a7028c36a7a4cfe86338de5+0x894579 @ 0xc94579 dbkFCallWrapperAddr+0x4636a7 8a3592b41a7028c36a7a4cfe86338de5+0x971ce3 @ 0xd71ce3 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 0 registers.ebx: 12424982 registers.esi: 0 registers.ecx: 2686656 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x2cb099 8a3592b41a7028c36a7a4cfe86338de5+0x7d96d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 8230613 exception.address: 0xbd96d5	success
1620960315.974751 __exception__	stacktrace: dbkFCallWrapperAddr+0x374ba9 8a3592b41a7028c36a7a4cfe86338de5+0x8831e5 @ 0xc831e5 dbkFCallWrapperAddr+0x385f3d 8a3592b41a7028c36a7a4cfe86338de5+0x894579 @ 0xc94579 dbkFCallWrapperAddr+0x4636a7 8a3592b41a7028c36a7a4cfe86338de5+0x971ce3 @ 0xd71ce3 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 2 registers.ebx: 12424939 registers.esi: 0 registers.ecx: 2686656 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x2cb0c4 8a3592b41a7028c36a7a4cfe86338de5+0x7d9700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 8230656 exception.address: 0xbd9700	success
1620960315.974751 __exception__	stacktrace: dbkFCallWrapperAddr+0x374bc7 8a3592b41a7028c36a7a4cfe86338de5+0x883203 @ 0xc83203 dbkFCallWrapperAddr+0x385f3d 8a3592b41a7028c36a7a4cfe86338de5+0x894579 @ 0xc94579 dbkFCallWrapperAddr+0x4636a7 8a3592b41a7028c36a7a4cfe86338de5+0x971ce3 @ 0xd71ce3 registers.esp: 2686620 registers.edi: 12864077 registers.eax: 2324 registers.ebp: 2686648 registers.edx: 2686656 registers.ebx: 4 registers.esi: 4294919751 registers.ecx: 0 exception.instruction_r: cc 68 86 3d 28 9c e9 b8 87 ff ff c7 ef 9b d8 ab exception.symbol: dbkFCallWrapperAddr+0x3765e9 8a3592b41a7028c36a7a4cfe86338de5+0x884c25 exception.instruction: int3 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0x80000003 exception.offset: 8932389 exception.address: 0xc84c25	success
1620960316.021751 __exception__	stacktrace: registers.esp: 2686620 registers.edi: 12892836 registers.eax: 4 registers.ebp: 1111705675 registers.edx: 0 registers.ebx: 4 registers.esi: 4294967295 registers.ecx: 4112711680 exception.instruction_r: cc 68 b8 25 28 9c e9 8d 76 ff ff da 91 57 2c 82 exception.symbol: dbkFCallWrapperAddr+0x377714 8a3592b41a7028c36a7a4cfe86338de5+0x885d50 exception.instruction: int3 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0x80000003 exception.offset: 8936784 exception.address: 0xc85d50	success
1620960316.036751 __exception__	stacktrace: dbkFCallWrapperAddr+0x3810e9 8a3592b41a7028c36a7a4cfe86338de5+0x88f725 @ 0xc8f725 registers.esp: 2686572 registers.edi: 14 registers.eax: 0 registers.ebp: 2686628 registers.edx: 58639280 registers.ebx: 6 registers.esi: 114 registers.ecx: 4 exception.instruction_r: 31 00 e8 b0 ff ff ff 8b 44 24 0c 8b 4c 24 04 c7 exception.symbol: dbkFCallWrapperAddr+0x8382b9 8a3592b41a7028c36a7a4cfe86338de5+0xd468f5 exception.instruction: xor dword ptr [eax], eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000005 exception.offset: 13920501 exception.address: 0x11468f5	success
1620960316.036751 __exception__	stacktrace: dbkFCallWrapperAddr+0x3810e9 8a3592b41a7028c36a7a4cfe86338de5+0x88f725 @ 0xc8f725 registers.esp: 2686572 registers.edi: 14 registers.eax: 0 registers.ebp: 2686628 registers.edx: 58639280 registers.ebx: 6 registers.esi: 114 registers.ecx: 4 exception.instruction_r: 31 00 e8 4b ff ff ff 8b 44 24 0c 8b 4c 24 04 83 exception.symbol: dbkFCallWrapperAddr+0x83831e 8a3592b41a7028c36a7a4cfe86338de5+0xd4695a exception.instruction: xor dword ptr [eax], eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000005 exception.offset: 13920602 exception.address: 0x114695a	success
1620960316.052751 __exception__	stacktrace: dbkFCallWrapperAddr+0x3810e9 8a3592b41a7028c36a7a4cfe86338de5+0x88f725 @ 0xc8f725 registers.esp: 2686572 registers.edi: 11 registers.eax: 0 registers.ebp: 2686628 registers.edx: 58639280 registers.ebx: 9 registers.esi: 171 registers.ecx: 4 exception.instruction_r: cc e8 b1 ff ff ff 8b 44 24 0c c7 80 b8 00 00 00 exception.symbol: dbkFCallWrapperAddr+0x85632d 8a3592b41a7028c36a7a4cfe86338de5+0xd64969 exception.instruction: int3 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0x80000003 exception.offset: 14043497 exception.address: 0x1164969	success
1620960316.052751 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 81919868 registers.edi: 0 registers.eax: 0 registers.ebp: 81919880 registers.edx: 18114988 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: 31 00 e8 b0 ff ff ff 8b 44 24 0c 8b 4c 24 04 c7 exception.symbol: dbkFCallWrapperAddr+0x8382b9 8a3592b41a7028c36a7a4cfe86338de5+0xd468f5 exception.instruction: xor dword ptr [eax], eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000005 exception.offset: 13920501 exception.address: 0x11468f5	success
1620960316.052751 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 81919868 registers.edi: 0 registers.eax: 0 registers.ebp: 81919880 registers.edx: 18114988 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: 31 00 e8 4b ff ff ff 8b 44 24 0c 8b 4c 24 04 83 exception.symbol: dbkFCallWrapperAddr+0x83831e 8a3592b41a7028c36a7a4cfe86338de5+0xd4695a exception.instruction: xor dword ptr [eax], eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000005 exception.offset: 13920602 exception.address: 0x114695a	success
1620960316.068751 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 84017020 registers.edi: 0 registers.eax: 0 registers.ebp: 84017032 registers.edx: 18237836 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: cc e8 b1 ff ff ff 8b 44 24 0c c7 80 b8 00 00 00 exception.symbol: dbkFCallWrapperAddr+0x85632d 8a3592b41a7028c36a7a4cfe86338de5+0xd64969 exception.instruction: int3 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0x80000003 exception.offset: 14043497 exception.address: 0x1164969	success
1620960316.427751 __exception__	stacktrace: dbkFCallWrapperAddr+0x374d46 8a3592b41a7028c36a7a4cfe86338de5+0x883382 @ 0xc83382 dbkFCallWrapperAddr+0x385f3d 8a3592b41a7028c36a7a4cfe86338de5+0x894579 @ 0xc94579 dbkFCallWrapperAddr+0x4636a7 8a3592b41a7028c36a7a4cfe86338de5+0x971ce3 @ 0xd71ce3 registers.esp: 2686620 registers.edi: 12892836 registers.eax: 0 registers.ebp: 2686648 registers.edx: 2 registers.ebx: 4 registers.esi: 4294967295 registers.ecx: 4 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x2cb0c4 8a3592b41a7028c36a7a4cfe86338de5+0x7d9700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 8230656 exception.address: 0xbd9700	success
1620960316.427751 __exception__	stacktrace: dbkFCallWrapperAddr+0x374d46 8a3592b41a7028c36a7a4cfe86338de5+0x883382 @ 0xc83382 dbkFCallWrapperAddr+0x385f3d 8a3592b41a7028c36a7a4cfe86338de5+0x894579 @ 0xc94579 dbkFCallWrapperAddr+0x4636a7 8a3592b41a7028c36a7a4cfe86338de5+0x971ce3 @ 0xd71ce3 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 0 registers.ebx: 12424982 registers.esi: 0 registers.ecx: 2686656 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x2cb099 8a3592b41a7028c36a7a4cfe86338de5+0x7d96d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 8230613 exception.address: 0xbd96d5	success
1620960316.427751 __exception__	stacktrace: dbkFCallWrapperAddr+0x374d46 8a3592b41a7028c36a7a4cfe86338de5+0x883382 @ 0xc83382 dbkFCallWrapperAddr+0x385f3d 8a3592b41a7028c36a7a4cfe86338de5+0x894579 @ 0xc94579 dbkFCallWrapperAddr+0x4636a7 8a3592b41a7028c36a7a4cfe86338de5+0x971ce3 @ 0xd71ce3 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 2 registers.ebx: 12424939 registers.esi: 0 registers.ecx: 2686656 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x2cb0c4 8a3592b41a7028c36a7a4cfe86338de5+0x7d9700 exception.instruction: ud2 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc000001d exception.offset: 8230656 exception.address: 0xbd9700	success
1620960316.427751 __exception__	stacktrace: dbkFCallWrapperAddr+0x374d46 8a3592b41a7028c36a7a4cfe86338de5+0x883382 @ 0xc83382 dbkFCallWrapperAddr+0x385f3d 8a3592b41a7028c36a7a4cfe86338de5+0x894579 @ 0xc94579 dbkFCallWrapperAddr+0x4636a7 8a3592b41a7028c36a7a4cfe86338de5+0x971ce3 @ 0xd71ce3 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 0 registers.ebx: 12424982 registers.esi: 0 registers.ecx: 2686656 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: dbkFCallWrapperAddr+0x2cb099 8a3592b41a7028c36a7a4cfe86338de5+0x7d96d5 exception.instruction: div eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000094 exception.offset: 8230613 exception.address: 0xbd96d5	success
1620960318.052751 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 81919868 registers.edi: 0 registers.eax: 0 registers.ebp: 81919880 registers.edx: 2130287604 registers.ebx: 0 registers.esi: 0 registers.ecx: 2005871740 exception.instruction_r: 31 00 e8 b0 ff ff ff 8b 44 24 0c 8b 4c 24 04 c7 exception.symbol: dbkFCallWrapperAddr+0x8382b9 8a3592b41a7028c36a7a4cfe86338de5+0xd468f5 exception.instruction: xor dword ptr [eax], eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000005 exception.offset: 13920501 exception.address: 0x11468f5	success
1620960318.052751 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 81919868 registers.edi: 0 registers.eax: 0 registers.ebp: 81919880 registers.edx: 2130287604 registers.ebx: 0 registers.esi: 0 registers.ecx: 2005871740 exception.instruction_r: 31 00 e8 4b ff ff ff 8b 44 24 0c 8b 4c 24 04 83 exception.symbol: dbkFCallWrapperAddr+0x83831e 8a3592b41a7028c36a7a4cfe86338de5+0xd4695a exception.instruction: xor dword ptr [eax], eax exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0xc0000005 exception.offset: 13920602 exception.address: 0x114695a	success
1620960318.068751 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 84017020 registers.edi: 0 registers.eax: 0 registers.ebp: 84017032 registers.edx: 2130275316 registers.ebx: 0 registers.esi: 0 registers.ecx: 2005871740 exception.instruction_r: cc e8 b1 ff ff ff 8b 44 24 0c c7 80 b8 00 00 00 exception.symbol: dbkFCallWrapperAddr+0x85632d 8a3592b41a7028c36a7a4cfe86338de5+0xd64969 exception.instruction: int3 exception.module: 8a3592b41a7028c36a7a4cfe86338de5.exe exception.exception_code: 0x80000003 exception.offset: 14043497 exception.address: 0x1164969	success

Allocates read-write-execute memory (usually to unpack itself) (50 out of 100 个事件)

Time & API	Arguments	Status
1620960313.536751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03100000	success
1620960313.536751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03200000	success
1620960313.536751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x014c0000	success
1620960313.583751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01560000	success
1620960313.599751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01570000	success
1620960313.630751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03204000	success
1620960313.677751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03214000	success
1620960313.833751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 147456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03214000	success
1620960313.927751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03234000	success
1620960313.958751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03244000	success
1620960313.958751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03244000	success
1620960313.974751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03244000	success
1620960314.052751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03248000	success
1620960314.255751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03248000	success
1620960314.552751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03680000	success
1620960315.130751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03530000	success
1620960315.130751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03fd0000	success
1620960315.130751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01590000	success
1620960315.255751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x015d0000	success
1620960315.271751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x015e0000	success
1620960315.318751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03fd4000	success
1620960315.318751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03fe4000	success
1620960315.380751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 147456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03fe4000	success
1620960315.396751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04004000	success
1620960315.396751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04014000	success
1620960315.396751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04014000	success
1620960315.396751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04014000	success
1620960315.396751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04014000	success
1620960315.411751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04018000	success
1620960315.521751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04018000	success
1620960315.521751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04018000	success
1620960315.521751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04018000	success
1620960315.536751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04018000	success
1620960315.536751 NtProtectVirtualMemory	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00db2000	success
1620960315.724751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03680000	success
1620960315.740751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03680000	success
1620960315.755751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03680000	success
1620960315.755751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03680000	success
1620960315.802751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03680000	success
1620960315.802751 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03694000	success
1620960315.927751 NtProtectVirtualMemory	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1620960315.927751 NtProtectVirtualMemory	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d50000	success
1620960315.927751 NtProtectVirtualMemory	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1620960315.927751 NtProtectVirtualMemory	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1620960315.927751 NtProtectVirtualMemory	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1620960315.927751 NtProtectVirtualMemory	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1620960315.927751 NtProtectVirtualMemory	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1620960315.927751 NtProtectVirtualMemory	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1620960315.927751 NtProtectVirtualMemory	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1620960315.927751 NtProtectVirtualMemory	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success

The binary likely contains encrypted or compressed data indicative of a packer (8 个事件)

entropy

7.9998606000730295

section

{'size_of_data': '0x001b0a00', 'virtual_address': '0x00001000', 'entropy': 7.9998606000730295, 'name': '', 'virtual_size': '0x004ef000'}

description