SmartHawk

3.8

中危

该样本未表现出任何异常！

重新分析

下载样本

110fe6f199298f89f704050eb4dc0d2b19b0985a74ead588441fabac693ab3f5

a3b9337cbcf2f32c9d3d507efcb729b7.exe

分析耗时

50s

最近分析

文件大小

240.0KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 个事件)

section	CODE
section	data

One or more processes crashed (50 out of 65536 个事件)

Time & API	Arguments	Status
1620820930.172124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0xcff3 @ 0x1000cff3 a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637804 registers.edi: 0 registers.eax: 2010505254 registers.ebp: 1638236 registers.edx: 66080 registers.ebx: 260 registers.esi: 1983119360 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.172124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x1874c @ 0x1001874c a3b9337cbcf2f32c9d3d507efcb729b7+0xb89a @ 0x1000b89a a3b9337cbcf2f32c9d3d507efcb729b7+0xcff3 @ 0x1000cff3 a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30607312 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.172124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x1874c @ 0x1001874c a3b9337cbcf2f32c9d3d507efcb729b7+0xb89a @ 0x1000b89a a3b9337cbcf2f32c9d3d507efcb729b7+0xcff3 @ 0x1000cff3 a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30607328 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.172124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x1874c @ 0x1001874c a3b9337cbcf2f32c9d3d507efcb729b7+0xb89a @ 0x1000b89a a3b9337cbcf2f32c9d3d507efcb729b7+0xcff3 @ 0x1000cff3 a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30607344 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.172124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x1874c @ 0x1001874c a3b9337cbcf2f32c9d3d507efcb729b7+0xb89a @ 0x1000b89a a3b9337cbcf2f32c9d3d507efcb729b7+0xcff3 @ 0x1000cff3 a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30607360 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.172124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x1874c @ 0x1001874c a3b9337cbcf2f32c9d3d507efcb729b7+0xb89a @ 0x1000b89a a3b9337cbcf2f32c9d3d507efcb729b7+0xcff3 @ 0x1000cff3 a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30607376 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.172124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x1874c @ 0x1001874c a3b9337cbcf2f32c9d3d507efcb729b7+0xb89a @ 0x1000b89a a3b9337cbcf2f32c9d3d507efcb729b7+0xcff3 @ 0x1000cff3 a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30607392 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.172124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x1874c @ 0x1001874c a3b9337cbcf2f32c9d3d507efcb729b7+0xb89a @ 0x1000b89a a3b9337cbcf2f32c9d3d507efcb729b7+0xcff3 @ 0x1000cff3 a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30607408 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.172124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x1874c @ 0x1001874c a3b9337cbcf2f32c9d3d507efcb729b7+0xb89a @ 0x1000b89a a3b9337cbcf2f32c9d3d507efcb729b7+0xcff3 @ 0x1000cff3 a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30607424 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.172124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x1874c @ 0x1001874c a3b9337cbcf2f32c9d3d507efcb729b7+0xb89a @ 0x1000b89a a3b9337cbcf2f32c9d3d507efcb729b7+0xcff3 @ 0x1000cff3 a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30607440 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.172124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x1874c @ 0x1001874c a3b9337cbcf2f32c9d3d507efcb729b7+0xb89a @ 0x1000b89a a3b9337cbcf2f32c9d3d507efcb729b7+0xcff3 @ 0x1000cff3 a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30607456 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.172124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x1874c @ 0x1001874c a3b9337cbcf2f32c9d3d507efcb729b7+0xb89a @ 0x1000b89a a3b9337cbcf2f32c9d3d507efcb729b7+0xcff3 @ 0x1000cff3 a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30607472 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.172124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x1874c @ 0x1001874c a3b9337cbcf2f32c9d3d507efcb729b7+0xb89a @ 0x1000b89a a3b9337cbcf2f32c9d3d507efcb729b7+0xcff3 @ 0x1000cff3 a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30607488 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.172124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x1874c @ 0x1001874c a3b9337cbcf2f32c9d3d507efcb729b7+0xb89a @ 0x1000b89a a3b9337cbcf2f32c9d3d507efcb729b7+0xcff3 @ 0x1000cff3 a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30607504 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.172124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x1874c @ 0x1001874c a3b9337cbcf2f32c9d3d507efcb729b7+0xb89a @ 0x1000b89a a3b9337cbcf2f32c9d3d507efcb729b7+0xcff3 @ 0x1000cff3 a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30607520 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.172124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x1874c @ 0x1001874c a3b9337cbcf2f32c9d3d507efcb729b7+0xb89a @ 0x1000b89a a3b9337cbcf2f32c9d3d507efcb729b7+0xcff3 @ 0x1000cff3 a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30607536 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.172124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x1874c @ 0x1001874c a3b9337cbcf2f32c9d3d507efcb729b7+0xb89a @ 0x1000b89a a3b9337cbcf2f32c9d3d507efcb729b7+0xcff3 @ 0x1000cff3 a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30607552 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0xba71 @ 0x1000ba71 a3b9337cbcf2f32c9d3d507efcb729b7+0xd01b @ 0x1000d01b a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637004 registers.edi: 1638080 registers.eax: 2010505254 registers.ebp: 1638060 registers.edx: 0 registers.ebx: 1024 registers.esi: 23 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0xd01b @ 0x1000d01b a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638044 registers.edi: 0 registers.eax: 2010505254 registers.ebp: 1638232 registers.edx: 0 registers.ebx: 388 registers.esi: 1983119360 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x184dc @ 0x100184dc a3b9337cbcf2f32c9d3d507efcb729b7+0xbb8a @ 0x1000bb8a a3b9337cbcf2f32c9d3d507efcb729b7+0xd01b @ 0x1000d01b a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30610792 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x184dc @ 0x100184dc a3b9337cbcf2f32c9d3d507efcb729b7+0xbb8a @ 0x1000bb8a a3b9337cbcf2f32c9d3d507efcb729b7+0xd01b @ 0x1000d01b a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30610816 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x184dc @ 0x100184dc a3b9337cbcf2f32c9d3d507efcb729b7+0xbb8a @ 0x1000bb8a a3b9337cbcf2f32c9d3d507efcb729b7+0xd01b @ 0x1000d01b a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30610840 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x184dc @ 0x100184dc a3b9337cbcf2f32c9d3d507efcb729b7+0xbb8a @ 0x1000bb8a a3b9337cbcf2f32c9d3d507efcb729b7+0xd01b @ 0x1000d01b a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30610864 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x184dc @ 0x100184dc a3b9337cbcf2f32c9d3d507efcb729b7+0xbb8a @ 0x1000bb8a a3b9337cbcf2f32c9d3d507efcb729b7+0xd01b @ 0x1000d01b a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30610888 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x184dc @ 0x100184dc a3b9337cbcf2f32c9d3d507efcb729b7+0xbb8a @ 0x1000bb8a a3b9337cbcf2f32c9d3d507efcb729b7+0xd01b @ 0x1000d01b a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30610912 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x184dc @ 0x100184dc a3b9337cbcf2f32c9d3d507efcb729b7+0xbb8a @ 0x1000bb8a a3b9337cbcf2f32c9d3d507efcb729b7+0xd01b @ 0x1000d01b a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30610936 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x184dc @ 0x100184dc a3b9337cbcf2f32c9d3d507efcb729b7+0xbb8a @ 0x1000bb8a a3b9337cbcf2f32c9d3d507efcb729b7+0xd01b @ 0x1000d01b a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30610960 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x184dc @ 0x100184dc a3b9337cbcf2f32c9d3d507efcb729b7+0xbb8a @ 0x1000bb8a a3b9337cbcf2f32c9d3d507efcb729b7+0xd01b @ 0x1000d01b a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30610984 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x184dc @ 0x100184dc a3b9337cbcf2f32c9d3d507efcb729b7+0xbb8a @ 0x1000bb8a a3b9337cbcf2f32c9d3d507efcb729b7+0xd01b @ 0x1000d01b a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30611008 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x184dc @ 0x100184dc a3b9337cbcf2f32c9d3d507efcb729b7+0xbb8a @ 0x1000bb8a a3b9337cbcf2f32c9d3d507efcb729b7+0xd01b @ 0x1000d01b a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30611032 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x184dc @ 0x100184dc a3b9337cbcf2f32c9d3d507efcb729b7+0xbb8a @ 0x1000bb8a a3b9337cbcf2f32c9d3d507efcb729b7+0xd01b @ 0x1000d01b a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30611056 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x184dc @ 0x100184dc a3b9337cbcf2f32c9d3d507efcb729b7+0xbb8a @ 0x1000bb8a a3b9337cbcf2f32c9d3d507efcb729b7+0xd01b @ 0x1000d01b a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30611080 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x184dc @ 0x100184dc a3b9337cbcf2f32c9d3d507efcb729b7+0xbb8a @ 0x1000bb8a a3b9337cbcf2f32c9d3d507efcb729b7+0xd01b @ 0x1000d01b a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30611104 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x184dc @ 0x100184dc a3b9337cbcf2f32c9d3d507efcb729b7+0xbb8a @ 0x1000bb8a a3b9337cbcf2f32c9d3d507efcb729b7+0xd01b @ 0x1000d01b a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30611128 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x184dc @ 0x100184dc a3b9337cbcf2f32c9d3d507efcb729b7+0xbb8a @ 0x1000bb8a a3b9337cbcf2f32c9d3d507efcb729b7+0xd01b @ 0x1000d01b a3b9337cbcf2f32c9d3d507efcb729b7+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30611152 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637888 registers.edi: 0 registers.eax: 1983867560 registers.ebp: 1638264 registers.edx: 4276577636 registers.ebx: 0 registers.esi: 0 registers.ecx: 30611274 exception.instruction_r: cc c3 89 1d 96 a1 02 10 89 1d 8e a1 02 10 89 1d exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x5bae exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 23470 exception.address: 0x10005bae	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x21317 @ 0x10021317 a3b9337cbcf2f32c9d3d507efcb729b7+0x19097 @ 0x10019097 a3b9337cbcf2f32c9d3d507efcb729b7+0x5be5 @ 0x10005be5 a3b9337cbcf2f32c9d3d507efcb729b7+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637784 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637816 registers.edx: 4019882517 registers.ebx: 1637832 registers.esi: 0 registers.ecx: 1637812 exception.instruction_r: cc c3 85 c0 75 1b e8 62 a3 fe ff 85 c0 74 12 57 exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x21293 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 135827 exception.address: 0x10021293	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x21317 @ 0x10021317 a3b9337cbcf2f32c9d3d507efcb729b7+0x19097 @ 0x10019097 a3b9337cbcf2f32c9d3d507efcb729b7+0x5be5 @ 0x10005be5 a3b9337cbcf2f32c9d3d507efcb729b7+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637788 registers.edi: 4 registers.eax: 1985273800 registers.ebp: 1637816 registers.edx: 1686124126 registers.ebx: 1637832 registers.esi: 2621616 registers.ecx: 30611421 exception.instruction_r: cc c3 85 f6 74 1d 83 fe ff 74 18 68 2f 2b 4c 1b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x212ce exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 135886 exception.address: 0x100212ce	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x21317 @ 0x10021317 a3b9337cbcf2f32c9d3d507efcb729b7+0x19097 @ 0x10019097 a3b9337cbcf2f32c9d3d507efcb729b7+0x5be5 @ 0x10005be5 a3b9337cbcf2f32c9d3d507efcb729b7+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637792 registers.edi: 4 registers.eax: 1985274148 registers.ebp: 1637816 registers.edx: 457976623 registers.ebx: 1637832 registers.esi: 2621616 registers.ecx: 30611498 exception.instruction_r: cc c3 5e 5f 5b 8b e5 5d c3 cc cc cc cc cc cc cc exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x212ef exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 135919 exception.address: 0x100212ef	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x190b3 @ 0x100190b3 a3b9337cbcf2f32c9d3d507efcb729b7+0x5be5 @ 0x10005be5 a3b9337cbcf2f32c9d3d507efcb729b7+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637796 registers.edi: 1637856 registers.eax: 2010505254 registers.ebp: 1637832 registers.edx: 30610792 registers.ebx: 64 registers.esi: 64 registers.ecx: 30605312 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x1b822 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x21317 @ 0x10021317 a3b9337cbcf2f32c9d3d507efcb729b7+0x190cc @ 0x100190cc a3b9337cbcf2f32c9d3d507efcb729b7+0x5be5 @ 0x10005be5 a3b9337cbcf2f32c9d3d507efcb729b7+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637784 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637816 registers.edx: 30610792 registers.ebx: 1637832 registers.esi: 127 registers.ecx: 1637812 exception.instruction_r: cc c3 85 c0 75 1b e8 62 a3 fe ff 85 c0 74 12 57 exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x21293 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 135827 exception.address: 0x10021293	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x21317 @ 0x10021317 a3b9337cbcf2f32c9d3d507efcb729b7+0x190cc @ 0x100190cc a3b9337cbcf2f32c9d3d507efcb729b7+0x5be5 @ 0x10005be5 a3b9337cbcf2f32c9d3d507efcb729b7+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637788 registers.edi: 4 registers.eax: 1985273800 registers.ebp: 1637816 registers.edx: 30610792 registers.ebx: 1637832 registers.esi: 2621616 registers.ecx: 30610872 exception.instruction_r: cc c3 85 f6 74 1d 83 fe ff 74 18 68 2f 2b 4c 1b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x212ce exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 135886 exception.address: 0x100212ce	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x21317 @ 0x10021317 a3b9337cbcf2f32c9d3d507efcb729b7+0x190cc @ 0x100190cc a3b9337cbcf2f32c9d3d507efcb729b7+0x5be5 @ 0x10005be5 a3b9337cbcf2f32c9d3d507efcb729b7+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637792 registers.edi: 4 registers.eax: 1985274148 registers.ebp: 1637816 registers.edx: 30610792 registers.ebx: 1637832 registers.esi: 2621616 registers.ecx: 30610896 exception.instruction_r: cc c3 5e 5f 5b 8b e5 5d c3 cc cc cc cc cc cc cc exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x212ef exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 135919 exception.address: 0x100212ef	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x21317 @ 0x10021317 a3b9337cbcf2f32c9d3d507efcb729b7+0x190cc @ 0x100190cc a3b9337cbcf2f32c9d3d507efcb729b7+0x5be5 @ 0x10005be5 a3b9337cbcf2f32c9d3d507efcb729b7+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637784 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637816 registers.edx: 30610792 registers.ebx: 1637832 registers.esi: 127 registers.ecx: 1637812 exception.instruction_r: cc c3 85 c0 75 1b e8 62 a3 fe ff 85 c0 74 12 57 exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x21293 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 135827 exception.address: 0x10021293	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x21317 @ 0x10021317 a3b9337cbcf2f32c9d3d507efcb729b7+0x190cc @ 0x100190cc a3b9337cbcf2f32c9d3d507efcb729b7+0x5be5 @ 0x10005be5 a3b9337cbcf2f32c9d3d507efcb729b7+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637788 registers.edi: 4 registers.eax: 1985273800 registers.ebp: 1637816 registers.edx: 30610792 registers.ebx: 1637832 registers.esi: 2621616 registers.ecx: 30610872 exception.instruction_r: cc c3 85 f6 74 1d 83 fe ff 74 18 68 2f 2b 4c 1b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x212ce exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 135886 exception.address: 0x100212ce	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x21317 @ 0x10021317 a3b9337cbcf2f32c9d3d507efcb729b7+0x190cc @ 0x100190cc a3b9337cbcf2f32c9d3d507efcb729b7+0x5be5 @ 0x10005be5 a3b9337cbcf2f32c9d3d507efcb729b7+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637792 registers.edi: 4 registers.eax: 1985274148 registers.ebp: 1637816 registers.edx: 30610792 registers.ebx: 1637832 registers.esi: 2621616 registers.ecx: 30610896 exception.instruction_r: cc c3 5e 5f 5b 8b e5 5d c3 cc cc cc cc cc cc cc exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x212ef exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 135919 exception.address: 0x100212ef	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x21317 @ 0x10021317 a3b9337cbcf2f32c9d3d507efcb729b7+0x190cc @ 0x100190cc a3b9337cbcf2f32c9d3d507efcb729b7+0x5be5 @ 0x10005be5 a3b9337cbcf2f32c9d3d507efcb729b7+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637784 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637816 registers.edx: 30610792 registers.ebx: 1637832 registers.esi: 127 registers.ecx: 1637812 exception.instruction_r: cc c3 85 c0 75 1b e8 62 a3 fe ff 85 c0 74 12 57 exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x21293 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 135827 exception.address: 0x10021293	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x21317 @ 0x10021317 a3b9337cbcf2f32c9d3d507efcb729b7+0x190cc @ 0x100190cc a3b9337cbcf2f32c9d3d507efcb729b7+0x5be5 @ 0x10005be5 a3b9337cbcf2f32c9d3d507efcb729b7+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637788 registers.edi: 4 registers.eax: 1985273800 registers.ebp: 1637816 registers.edx: 30610792 registers.ebx: 1637832 registers.esi: 2621616 registers.ecx: 30610872 exception.instruction_r: cc c3 85 f6 74 1d 83 fe ff 74 18 68 2f 2b 4c 1b exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x212ce exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 135886 exception.address: 0x100212ce	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x21317 @ 0x10021317 a3b9337cbcf2f32c9d3d507efcb729b7+0x190cc @ 0x100190cc a3b9337cbcf2f32c9d3d507efcb729b7+0x5be5 @ 0x10005be5 a3b9337cbcf2f32c9d3d507efcb729b7+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637792 registers.edi: 4 registers.eax: 1985274148 registers.ebp: 1637816 registers.edx: 30610792 registers.ebx: 1637832 registers.esi: 2621616 registers.ecx: 30610896 exception.instruction_r: cc c3 5e 5f 5b 8b e5 5d c3 cc cc cc cc cc cc cc exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x212ef exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 135919 exception.address: 0x100212ef	success
1620820930.188124 __exception__	stacktrace: a3b9337cbcf2f32c9d3d507efcb729b7+0x21317 @ 0x10021317 a3b9337cbcf2f32c9d3d507efcb729b7+0x190cc @ 0x100190cc a3b9337cbcf2f32c9d3d507efcb729b7+0x5be5 @ 0x10005be5 a3b9337cbcf2f32c9d3d507efcb729b7+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637784 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637816 registers.edx: 30610792 registers.ebx: 1637832 registers.esi: 127 registers.ecx: 1637812 exception.instruction_r: cc c3 85 c0 75 1b e8 62 a3 fe ff 85 c0 74 12 57 exception.symbol: a3b9337cbcf2f32c9d3d507efcb729b7+0x21293 exception.instruction: int3 exception.module: a3b9337cbcf2f32c9d3d507efcb729b7.exe exception.exception_code: 0x80000003 exception.offset: 135827 exception.address: 0x10021293	success

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620820930.110124 NtAllocateVirtualMemory	process_identifier: 1916 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01c00000	success	0	0

The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)

entropy

7.959983099154971

section

{'size_of_data': '0x00024000', 'virtual_address': '0x00006000', 'entropy': 7.959983099154971, 'name': 'CODE', 'virtual_size': '0x00023616'}

description

A section with a high entropy has been found

entropy

7.95516658143008

section

{'size_of_data': '0x00009000', 'virtual_address': '0x0002a000', 'entropy': 7.95516658143008, 'name': 'data', 'virtual_size': '0x00008fea'}

description

A section with a high entropy has been found

entropy

0.7627118644067796

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (2 个事件)

host	14.215.138.55
host	172.217.24.14

Tries to unhook Windows functions monitored by Cuckoo (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620820947.954124 __anomaly__	subcategory: exception tid: 1940 message: Encountered 65537 exceptions, quitting. function_name:	success	0	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-05-06 00:33:22

Imports

Library msvcrt.dll:

• 0x10004028 isalpha

Library OLEAUT32.dll:

• 0x10004014 VarUI2FromStr

• 0x10004018 VarI2FromDate

Library SHLWAPI.dll:

• 0x10004020 SHGetValueA

Library KERNEL32.dll:

• 0x10004000 LoadLibraryA

• 0x10004004 GetLastError

• 0x10004008 GetModuleFileNameA

• 0x1000400c CloseHandle

Exports

Ordinal	Address	Name
1	0x10004145	dervfnc36

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	142.250.66.110
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49236	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.