SmartHawk

4.6

中危

47 个模型检测该样本为恶意！

重新分析

下载样本

17c66a318f48ef5531387fcae08b532e68e7553a8068ae2e37054d5da704645b

c9b352426e3e7a29c5d1c3cf71b44808.exe

分析耗时

80s

最近分析

文件大小

240.0KB

静态报毒动态报毒 100% AI SCORE=100 BLUTEAL CCMW CLOUD CONFIDENCE CRIDEX DRIDEX EJYN ELDORADO GENERICKD GENKRYPTIK HDGY HIGH HIGH CONFIDENCE HW32 KRYPT KRYPTIK LJRU MALICIOUS PE MALWARE@#2JC76X1UJ03F2 PC0@AUKC2CWS QVM20 SCORE SMXE SUSGEN TAYL THEOFBO TSCOPE UNSAFE WACATAC ZENPAK ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee		20200704	6.0.6.653
Baidu		20190318	1.0.0.2
Alibaba	TrojanDownloader:Win32/Cridex.acb8b664	20190527	0.3.0.5
Tencent	Win32.Trojan-downloader.Cridex.Tayl	20200703	1.0.0.1
Kingsoft		20200703	2013.8.14.323
Avast		20200704	18.4.3895.0
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 个事件)

section	CODE
section	data

One or more processes crashed (50 out of 65536 个事件)

Time & API	Arguments	Status
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0xcff3 @ 0x1000cff3 c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637804 registers.edi: 0 registers.eax: 2010505254 registers.ebp: 1638236 registers.edx: 66080 registers.ebx: 260 registers.esi: 1983119360 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x1874c @ 0x1001874c c9b352426e3e7a29c5d1c3cf71b44808+0xb89a @ 0x1000b89a c9b352426e3e7a29c5d1c3cf71b44808+0xcff3 @ 0x1000cff3 c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30541776 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x1874c @ 0x1001874c c9b352426e3e7a29c5d1c3cf71b44808+0xb89a @ 0x1000b89a c9b352426e3e7a29c5d1c3cf71b44808+0xcff3 @ 0x1000cff3 c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30541792 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x1874c @ 0x1001874c c9b352426e3e7a29c5d1c3cf71b44808+0xb89a @ 0x1000b89a c9b352426e3e7a29c5d1c3cf71b44808+0xcff3 @ 0x1000cff3 c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30541808 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x1874c @ 0x1001874c c9b352426e3e7a29c5d1c3cf71b44808+0xb89a @ 0x1000b89a c9b352426e3e7a29c5d1c3cf71b44808+0xcff3 @ 0x1000cff3 c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30541824 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x1874c @ 0x1001874c c9b352426e3e7a29c5d1c3cf71b44808+0xb89a @ 0x1000b89a c9b352426e3e7a29c5d1c3cf71b44808+0xcff3 @ 0x1000cff3 c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30541840 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x1874c @ 0x1001874c c9b352426e3e7a29c5d1c3cf71b44808+0xb89a @ 0x1000b89a c9b352426e3e7a29c5d1c3cf71b44808+0xcff3 @ 0x1000cff3 c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30541856 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x1874c @ 0x1001874c c9b352426e3e7a29c5d1c3cf71b44808+0xb89a @ 0x1000b89a c9b352426e3e7a29c5d1c3cf71b44808+0xcff3 @ 0x1000cff3 c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30541872 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x1874c @ 0x1001874c c9b352426e3e7a29c5d1c3cf71b44808+0xb89a @ 0x1000b89a c9b352426e3e7a29c5d1c3cf71b44808+0xcff3 @ 0x1000cff3 c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30541888 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x1874c @ 0x1001874c c9b352426e3e7a29c5d1c3cf71b44808+0xb89a @ 0x1000b89a c9b352426e3e7a29c5d1c3cf71b44808+0xcff3 @ 0x1000cff3 c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30541904 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x1874c @ 0x1001874c c9b352426e3e7a29c5d1c3cf71b44808+0xb89a @ 0x1000b89a c9b352426e3e7a29c5d1c3cf71b44808+0xcff3 @ 0x1000cff3 c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30541920 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x1874c @ 0x1001874c c9b352426e3e7a29c5d1c3cf71b44808+0xb89a @ 0x1000b89a c9b352426e3e7a29c5d1c3cf71b44808+0xcff3 @ 0x1000cff3 c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30541936 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x1874c @ 0x1001874c c9b352426e3e7a29c5d1c3cf71b44808+0xb89a @ 0x1000b89a c9b352426e3e7a29c5d1c3cf71b44808+0xcff3 @ 0x1000cff3 c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30541952 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x1874c @ 0x1001874c c9b352426e3e7a29c5d1c3cf71b44808+0xb89a @ 0x1000b89a c9b352426e3e7a29c5d1c3cf71b44808+0xcff3 @ 0x1000cff3 c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30541968 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x1874c @ 0x1001874c c9b352426e3e7a29c5d1c3cf71b44808+0xb89a @ 0x1000b89a c9b352426e3e7a29c5d1c3cf71b44808+0xcff3 @ 0x1000cff3 c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30541984 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x1874c @ 0x1001874c c9b352426e3e7a29c5d1c3cf71b44808+0xb89a @ 0x1000b89a c9b352426e3e7a29c5d1c3cf71b44808+0xcff3 @ 0x1000cff3 c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30542000 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x1874c @ 0x1001874c c9b352426e3e7a29c5d1c3cf71b44808+0xb89a @ 0x1000b89a c9b352426e3e7a29c5d1c3cf71b44808+0xcff3 @ 0x1000cff3 c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637764 registers.edi: 30542016 registers.eax: 2010505254 registers.ebp: 1637800 registers.edx: 0 registers.ebx: 128 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0xba71 @ 0x1000ba71 c9b352426e3e7a29c5d1c3cf71b44808+0xd01b @ 0x1000d01b c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637004 registers.edi: 1638080 registers.eax: 2010505254 registers.ebp: 1638060 registers.edx: 0 registers.ebx: 1024 registers.esi: 23 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0xd01b @ 0x1000d01b c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638044 registers.edi: 0 registers.eax: 2010505254 registers.ebp: 1638232 registers.edx: 0 registers.ebx: 388 registers.esi: 1983119360 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x184dc @ 0x100184dc c9b352426e3e7a29c5d1c3cf71b44808+0xbb8a @ 0x1000bb8a c9b352426e3e7a29c5d1c3cf71b44808+0xd01b @ 0x1000d01b c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30545256 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x184dc @ 0x100184dc c9b352426e3e7a29c5d1c3cf71b44808+0xbb8a @ 0x1000bb8a c9b352426e3e7a29c5d1c3cf71b44808+0xd01b @ 0x1000d01b c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30545280 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x184dc @ 0x100184dc c9b352426e3e7a29c5d1c3cf71b44808+0xbb8a @ 0x1000bb8a c9b352426e3e7a29c5d1c3cf71b44808+0xd01b @ 0x1000d01b c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30545304 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x184dc @ 0x100184dc c9b352426e3e7a29c5d1c3cf71b44808+0xbb8a @ 0x1000bb8a c9b352426e3e7a29c5d1c3cf71b44808+0xd01b @ 0x1000d01b c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30545328 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x184dc @ 0x100184dc c9b352426e3e7a29c5d1c3cf71b44808+0xbb8a @ 0x1000bb8a c9b352426e3e7a29c5d1c3cf71b44808+0xd01b @ 0x1000d01b c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30545352 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x184dc @ 0x100184dc c9b352426e3e7a29c5d1c3cf71b44808+0xbb8a @ 0x1000bb8a c9b352426e3e7a29c5d1c3cf71b44808+0xd01b @ 0x1000d01b c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30545376 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x184dc @ 0x100184dc c9b352426e3e7a29c5d1c3cf71b44808+0xbb8a @ 0x1000bb8a c9b352426e3e7a29c5d1c3cf71b44808+0xd01b @ 0x1000d01b c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30545400 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x184dc @ 0x100184dc c9b352426e3e7a29c5d1c3cf71b44808+0xbb8a @ 0x1000bb8a c9b352426e3e7a29c5d1c3cf71b44808+0xd01b @ 0x1000d01b c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30545424 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x184dc @ 0x100184dc c9b352426e3e7a29c5d1c3cf71b44808+0xbb8a @ 0x1000bb8a c9b352426e3e7a29c5d1c3cf71b44808+0xd01b @ 0x1000d01b c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30545448 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x184dc @ 0x100184dc c9b352426e3e7a29c5d1c3cf71b44808+0xbb8a @ 0x1000bb8a c9b352426e3e7a29c5d1c3cf71b44808+0xd01b @ 0x1000d01b c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30545472 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x184dc @ 0x100184dc c9b352426e3e7a29c5d1c3cf71b44808+0xbb8a @ 0x1000bb8a c9b352426e3e7a29c5d1c3cf71b44808+0xd01b @ 0x1000d01b c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30545496 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x184dc @ 0x100184dc c9b352426e3e7a29c5d1c3cf71b44808+0xbb8a @ 0x1000bb8a c9b352426e3e7a29c5d1c3cf71b44808+0xd01b @ 0x1000d01b c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30545520 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x184dc @ 0x100184dc c9b352426e3e7a29c5d1c3cf71b44808+0xbb8a @ 0x1000bb8a c9b352426e3e7a29c5d1c3cf71b44808+0xd01b @ 0x1000d01b c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30545544 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x184dc @ 0x100184dc c9b352426e3e7a29c5d1c3cf71b44808+0xbb8a @ 0x1000bb8a c9b352426e3e7a29c5d1c3cf71b44808+0xd01b @ 0x1000d01b c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30545568 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x184dc @ 0x100184dc c9b352426e3e7a29c5d1c3cf71b44808+0xbb8a @ 0x1000bb8a c9b352426e3e7a29c5d1c3cf71b44808+0xd01b @ 0x1000d01b c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30545592 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x184dc @ 0x100184dc c9b352426e3e7a29c5d1c3cf71b44808+0xbb8a @ 0x1000bb8a c9b352426e3e7a29c5d1c3cf71b44808+0xd01b @ 0x1000d01b c9b352426e3e7a29c5d1c3cf71b44808+0x62ee @ 0x100062ee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638004 registers.edi: 30545616 registers.eax: 2010505254 registers.ebp: 1638040 registers.edx: 0 registers.ebx: 64 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637888 registers.edi: 0 registers.eax: 1983867560 registers.ebp: 1638264 registers.edx: 4276577636 registers.ebx: 0 registers.esi: 0 registers.ecx: 30545738 exception.instruction_r: cc c3 89 1d 96 a1 02 10 89 1d 8e a1 02 10 89 1d exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x5bae exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 23470 exception.address: 0x10005bae	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x21317 @ 0x10021317 c9b352426e3e7a29c5d1c3cf71b44808+0x19097 @ 0x10019097 c9b352426e3e7a29c5d1c3cf71b44808+0x5be5 @ 0x10005be5 c9b352426e3e7a29c5d1c3cf71b44808+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637784 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637816 registers.edx: 4019882517 registers.ebx: 1637832 registers.esi: 0 registers.ecx: 1637812 exception.instruction_r: cc c3 85 c0 75 1b e8 62 a3 fe ff 85 c0 74 12 57 exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x21293 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 135827 exception.address: 0x10021293	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x21317 @ 0x10021317 c9b352426e3e7a29c5d1c3cf71b44808+0x19097 @ 0x10019097 c9b352426e3e7a29c5d1c3cf71b44808+0x5be5 @ 0x10005be5 c9b352426e3e7a29c5d1c3cf71b44808+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637788 registers.edi: 4 registers.eax: 1985273800 registers.ebp: 1637816 registers.edx: 1686124126 registers.ebx: 1637832 registers.esi: 3408048 registers.ecx: 30545885 exception.instruction_r: cc c3 85 f6 74 1d 83 fe ff 74 18 68 2f 2b 4c 1b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x212ce exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 135886 exception.address: 0x100212ce	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x21317 @ 0x10021317 c9b352426e3e7a29c5d1c3cf71b44808+0x19097 @ 0x10019097 c9b352426e3e7a29c5d1c3cf71b44808+0x5be5 @ 0x10005be5 c9b352426e3e7a29c5d1c3cf71b44808+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637792 registers.edi: 4 registers.eax: 1985274148 registers.ebp: 1637816 registers.edx: 457976623 registers.ebx: 1637832 registers.esi: 3408048 registers.ecx: 30545962 exception.instruction_r: cc c3 5e 5f 5b 8b e5 5d c3 cc cc cc cc cc cc cc exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x212ef exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 135919 exception.address: 0x100212ef	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x190b3 @ 0x100190b3 c9b352426e3e7a29c5d1c3cf71b44808+0x5be5 @ 0x10005be5 c9b352426e3e7a29c5d1c3cf71b44808+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637796 registers.edi: 1637856 registers.eax: 2010505254 registers.ebp: 1637832 registers.edx: 30545256 registers.ebx: 64 registers.esi: 64 registers.ecx: 30539776 exception.instruction_r: cc c3 5b c3 33 c0 5b c3 cc cc cc cc cc cc 56 8b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x1b822 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 112674 exception.address: 0x1001b822	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x21317 @ 0x10021317 c9b352426e3e7a29c5d1c3cf71b44808+0x190cc @ 0x100190cc c9b352426e3e7a29c5d1c3cf71b44808+0x5be5 @ 0x10005be5 c9b352426e3e7a29c5d1c3cf71b44808+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637784 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637816 registers.edx: 30545256 registers.ebx: 1637832 registers.esi: 127 registers.ecx: 1637812 exception.instruction_r: cc c3 85 c0 75 1b e8 62 a3 fe ff 85 c0 74 12 57 exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x21293 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 135827 exception.address: 0x10021293	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x21317 @ 0x10021317 c9b352426e3e7a29c5d1c3cf71b44808+0x190cc @ 0x100190cc c9b352426e3e7a29c5d1c3cf71b44808+0x5be5 @ 0x10005be5 c9b352426e3e7a29c5d1c3cf71b44808+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637788 registers.edi: 4 registers.eax: 1985273800 registers.ebp: 1637816 registers.edx: 30545256 registers.ebx: 1637832 registers.esi: 3408048 registers.ecx: 30545336 exception.instruction_r: cc c3 85 f6 74 1d 83 fe ff 74 18 68 2f 2b 4c 1b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x212ce exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 135886 exception.address: 0x100212ce	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x21317 @ 0x10021317 c9b352426e3e7a29c5d1c3cf71b44808+0x190cc @ 0x100190cc c9b352426e3e7a29c5d1c3cf71b44808+0x5be5 @ 0x10005be5 c9b352426e3e7a29c5d1c3cf71b44808+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637792 registers.edi: 4 registers.eax: 1985274148 registers.ebp: 1637816 registers.edx: 30545256 registers.ebx: 1637832 registers.esi: 3408048 registers.ecx: 30545360 exception.instruction_r: cc c3 5e 5f 5b 8b e5 5d c3 cc cc cc cc cc cc cc exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x212ef exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 135919 exception.address: 0x100212ef	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x21317 @ 0x10021317 c9b352426e3e7a29c5d1c3cf71b44808+0x190cc @ 0x100190cc c9b352426e3e7a29c5d1c3cf71b44808+0x5be5 @ 0x10005be5 c9b352426e3e7a29c5d1c3cf71b44808+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637784 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637816 registers.edx: 30545256 registers.ebx: 1637832 registers.esi: 127 registers.ecx: 1637812 exception.instruction_r: cc c3 85 c0 75 1b e8 62 a3 fe ff 85 c0 74 12 57 exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x21293 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 135827 exception.address: 0x10021293	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x21317 @ 0x10021317 c9b352426e3e7a29c5d1c3cf71b44808+0x190cc @ 0x100190cc c9b352426e3e7a29c5d1c3cf71b44808+0x5be5 @ 0x10005be5 c9b352426e3e7a29c5d1c3cf71b44808+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637788 registers.edi: 4 registers.eax: 1985273800 registers.ebp: 1637816 registers.edx: 30545256 registers.ebx: 1637832 registers.esi: 3408048 registers.ecx: 30545336 exception.instruction_r: cc c3 85 f6 74 1d 83 fe ff 74 18 68 2f 2b 4c 1b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x212ce exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 135886 exception.address: 0x100212ce	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x21317 @ 0x10021317 c9b352426e3e7a29c5d1c3cf71b44808+0x190cc @ 0x100190cc c9b352426e3e7a29c5d1c3cf71b44808+0x5be5 @ 0x10005be5 c9b352426e3e7a29c5d1c3cf71b44808+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637792 registers.edi: 4 registers.eax: 1985274148 registers.ebp: 1637816 registers.edx: 30545256 registers.ebx: 1637832 registers.esi: 3408048 registers.ecx: 30545360 exception.instruction_r: cc c3 5e 5f 5b 8b e5 5d c3 cc cc cc cc cc cc cc exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x212ef exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 135919 exception.address: 0x100212ef	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x21317 @ 0x10021317 c9b352426e3e7a29c5d1c3cf71b44808+0x190cc @ 0x100190cc c9b352426e3e7a29c5d1c3cf71b44808+0x5be5 @ 0x10005be5 c9b352426e3e7a29c5d1c3cf71b44808+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637784 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637816 registers.edx: 30545256 registers.ebx: 1637832 registers.esi: 127 registers.ecx: 1637812 exception.instruction_r: cc c3 85 c0 75 1b e8 62 a3 fe ff 85 c0 74 12 57 exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x21293 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 135827 exception.address: 0x10021293	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x21317 @ 0x10021317 c9b352426e3e7a29c5d1c3cf71b44808+0x190cc @ 0x100190cc c9b352426e3e7a29c5d1c3cf71b44808+0x5be5 @ 0x10005be5 c9b352426e3e7a29c5d1c3cf71b44808+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637788 registers.edi: 4 registers.eax: 1985273800 registers.ebp: 1637816 registers.edx: 30545256 registers.ebx: 1637832 registers.esi: 3408048 registers.ecx: 30545336 exception.instruction_r: cc c3 85 f6 74 1d 83 fe ff 74 18 68 2f 2b 4c 1b exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x212ce exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 135886 exception.address: 0x100212ce	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x21317 @ 0x10021317 c9b352426e3e7a29c5d1c3cf71b44808+0x190cc @ 0x100190cc c9b352426e3e7a29c5d1c3cf71b44808+0x5be5 @ 0x10005be5 c9b352426e3e7a29c5d1c3cf71b44808+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637792 registers.edi: 4 registers.eax: 1985274148 registers.ebp: 1637816 registers.edx: 30545256 registers.ebx: 1637832 registers.esi: 3408048 registers.ecx: 30545360 exception.instruction_r: cc c3 5e 5f 5b 8b e5 5d c3 cc cc cc cc cc cc cc exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x212ef exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 135919 exception.address: 0x100212ef	success
1619906639.5625 __exception__	stacktrace: c9b352426e3e7a29c5d1c3cf71b44808+0x21317 @ 0x10021317 c9b352426e3e7a29c5d1c3cf71b44808+0x190cc @ 0x100190cc c9b352426e3e7a29c5d1c3cf71b44808+0x5be5 @ 0x10005be5 c9b352426e3e7a29c5d1c3cf71b44808+0x6398 @ 0x10006398 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637784 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637816 registers.edx: 30545256 registers.ebx: 1637832 registers.esi: 127 registers.ecx: 1637812 exception.instruction_r: cc c3 85 c0 75 1b e8 62 a3 fe ff 85 c0 74 12 57 exception.symbol: c9b352426e3e7a29c5d1c3cf71b44808+0x21293 exception.instruction: int3 exception.module: c9b352426e3e7a29c5d1c3cf71b44808.exe exception.exception_code: 0x80000003 exception.offset: 135827 exception.address: 0x10021293	success

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619906639.5155 NtAllocateVirtualMemory	process_identifier: 2308 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004d0000	success	0	0

The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)

entropy

7.9591815832233035

section

{'size_of_data': '0x00024000', 'virtual_address': '0x00006000', 'entropy': 7.9591815832233035, 'name': 'CODE', 'virtual_size': '0x0002361b'}

description

A section with a high entropy has been found

entropy

7.955523667671843

section

{'size_of_data': '0x00009000', 'virtual_address': '0x0002a000', 'entropy': 7.955523667671843, 'name': 'data', 'virtual_size': '0x00008f9b'}

description

A section with a high entropy has been found

entropy

0.7627118644067796

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (3 个事件)

host	172.217.24.14
host	203.208.41.65
host	203.208.41.98

Tries to unhook Windows functions monitored by Cuckoo (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619906654.1715 __anomaly__	subcategory: exception tid: 1436 message: Encountered 65537 exceptions, quitting. function_name:	success	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.24.14:443

File has been identified by 47 AntiVirus engines on VirusTotal as malicious (47 个事件)

Bkav	HW32.Packed.
MicroWorld-eScan	Trojan.GenericKD.43106854
CAT-QuickHeal	Trojan.Wacatac
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Trojan ( 00549d461 )
BitDefender	Trojan.GenericKD.43106854
K7GW	Trojan ( 00549d461 )
Cybereason	malicious.8bebc5
BitDefenderTheta	Gen:NN.ZexaF.34130.pC0@aukc2cWS
Cyren	W32/Dridex.Z.gen!Eldorado
Symantec	Packed.Generic.553
ESET-NOD32	a variant of Win32/Kryptik.HDGY
APEX	Malicious
Paloalto	generic.ml
Alibaba	TrojanDownloader:Win32/Cridex.acb8b664
NANO-Antivirus	Virus.Win32.Gen.ccmw
AegisLab	Trojan.Win32.Generic.ljRu
Tencent	Win32.Trojan-downloader.Cridex.Tayl
Endgame	malicious (high confidence)
Sophos	Mal/Generic-S
Comodo	Malware@#2jc76x1uj03f2
DrWeb	Trojan.Dridex.694
Zillya	Trojan.Kryptik.Win32.2025309
TrendMicro	Trojan.Win32.WACATAC.THEOFBO
Fortinet	W32/GenKryptik.EJYN!tr
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.c9b352426e3e7a29
Emsisoft	Trojan.GenericKD.43106854 (B)
Ikarus	Trojan.Win32.Krypt
Jiangmin	TrojanDownloader.Cridex.sc
MAX	malware (ai score=100)
Microsoft	Trojan:Win32/Bluteal!rfn
ZoneAlarm	HEUR:Trojan.Win32.Zenpak.vho
Acronis	suspicious
VBA32	TScope.Malware-Cryptor.SB
ALYac	Trojan.GenericKD.43106854
Ad-Aware	Trojan.GenericKD.43106854
Panda	Trj/CI.A
TrendMicro-HouseCall	TrojanSpy.Win32.DRIDEX.SMXE
Rising	Downloader.Cridex!8.F70 (CLOUD)
Yandex	Trojan.GenKryptik!
SentinelOne	DFI - Malicious PE
GData	Trojan.GenericKD.43106854
MaxSecure	Trojan.Malware.100888115.susgen
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Generic/HEUR/QVM20.1.07A6.Malware.Gen

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-05-05 13:28:13

Imports

Library KERNEL32.dll:

• 0x10004000 GetLastError

• 0x10004004 CloseHandle

• 0x10004008 LoadLibraryA

• 0x1000400c GetModuleFileNameA

Library OLEAUT32.dll:

• 0x10004014 VarI2FromDate

• 0x10004018 VarUI2FromStr

Library msvcrt.dll:

• 0x10004028 isalpha

Library SHLWAPI.dll:

• 0x10004020 SHGetValueA

Exports

Ordinal	Address	Name
1	0x10004145	dervfnc36

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	60126	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.