SmartHawk

3.6

中危

59 个模型检测该样本为恶意！

重新分析

下载样本

4a8429e12437ff33866dfbcdc31059e69ffd1e1f15bf3e76d49564050484b3ee

db406b5f94c217e5a3069748ccffd1d4.exe

分析耗时

58s

最近分析

文件大小

212.0KB

静态报毒动态报毒 100% 1D3YAK5IJ8ZSNELEMC+RSQ AI SCORE=81 AIDETECTVM CONFIDENCE CRIDEX DRIDEX DRIXED ELDORADO GDSDA GENCIRC GENERIC@ML GENERICKD HFAX HIGH CONFIDENCE HOQSIL KCLOUD KRYPTIK KVMH008 M11+ZX8W MALICIOUS PE MALWARE1 MALWARE@#D7IW1UB6LQ81 NU0@AMKIWMJ PALLAS POSSIBLETHREAT QVM20 R345764 RDMK S + TROJ SCORE STATIC AI TROJANX TSCOPE UNSAFE VPKUT ZENPAK ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Backdoor:Win32/Dridex.a1506180	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:TrojanX-gen [Trj]	20201210	21.1.5827.0
Kingsoft	Win32.Heur.KVMH008.a.(kcloud)	20201211	2017.9.26.565
McAfee	Drixed-FIY!DB406B5F94C2	20201211	6.0.6.653
Tencent	Malware.Win32.Gencirc.10cde36a	20201211	1.0.0.1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 个事件)

section	.rdar
section	.data0

One or more processes crashed (50 out of 65536 个事件)

Time & API	Arguments	Status
1619956022.122 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0x144e1 @ 0x100144e1 db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637808 registers.edi: 260 registers.eax: 2010505254 registers.ebp: 1638240 registers.edx: 129161 registers.ebx: 4083652503 registers.esi: 0 registers.ecx: 2010505254 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.122 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbf7b @ 0x1000bf7b db406b5f94c217e5a3069748ccffd1d4+0x13d5a @ 0x10013d5a db406b5f94c217e5a3069748ccffd1d4+0x144e1 @ 0x100144e1 db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 31393744 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.122 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbf7b @ 0x1000bf7b db406b5f94c217e5a3069748ccffd1d4+0x13d5a @ 0x10013d5a db406b5f94c217e5a3069748ccffd1d4+0x144e1 @ 0x100144e1 db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 31393760 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.122 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbf7b @ 0x1000bf7b db406b5f94c217e5a3069748ccffd1d4+0x13d5a @ 0x10013d5a db406b5f94c217e5a3069748ccffd1d4+0x144e1 @ 0x100144e1 db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 31393776 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.122 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbf7b @ 0x1000bf7b db406b5f94c217e5a3069748ccffd1d4+0x13d5a @ 0x10013d5a db406b5f94c217e5a3069748ccffd1d4+0x144e1 @ 0x100144e1 db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 31393792 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.122 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbf7b @ 0x1000bf7b db406b5f94c217e5a3069748ccffd1d4+0x13d5a @ 0x10013d5a db406b5f94c217e5a3069748ccffd1d4+0x144e1 @ 0x100144e1 db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 31393808 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.122 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbf7b @ 0x1000bf7b db406b5f94c217e5a3069748ccffd1d4+0x13d5a @ 0x10013d5a db406b5f94c217e5a3069748ccffd1d4+0x144e1 @ 0x100144e1 db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 31393824 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.122 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbf7b @ 0x1000bf7b db406b5f94c217e5a3069748ccffd1d4+0x13d5a @ 0x10013d5a db406b5f94c217e5a3069748ccffd1d4+0x144e1 @ 0x100144e1 db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 31393840 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.122 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbf7b @ 0x1000bf7b db406b5f94c217e5a3069748ccffd1d4+0x13d5a @ 0x10013d5a db406b5f94c217e5a3069748ccffd1d4+0x144e1 @ 0x100144e1 db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 31393856 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.122 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbf7b @ 0x1000bf7b db406b5f94c217e5a3069748ccffd1d4+0x13d5a @ 0x10013d5a db406b5f94c217e5a3069748ccffd1d4+0x144e1 @ 0x100144e1 db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 31393872 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.122 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbf7b @ 0x1000bf7b db406b5f94c217e5a3069748ccffd1d4+0x13d5a @ 0x10013d5a db406b5f94c217e5a3069748ccffd1d4+0x144e1 @ 0x100144e1 db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 31393888 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.122 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbf7b @ 0x1000bf7b db406b5f94c217e5a3069748ccffd1d4+0x13d5a @ 0x10013d5a db406b5f94c217e5a3069748ccffd1d4+0x144e1 @ 0x100144e1 db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 31393904 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.122 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbf7b @ 0x1000bf7b db406b5f94c217e5a3069748ccffd1d4+0x13d5a @ 0x10013d5a db406b5f94c217e5a3069748ccffd1d4+0x144e1 @ 0x100144e1 db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 31393920 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.122 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbf7b @ 0x1000bf7b db406b5f94c217e5a3069748ccffd1d4+0x13d5a @ 0x10013d5a db406b5f94c217e5a3069748ccffd1d4+0x144e1 @ 0x100144e1 db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 31393936 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.122 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbf7b @ 0x1000bf7b db406b5f94c217e5a3069748ccffd1d4+0x13d5a @ 0x10013d5a db406b5f94c217e5a3069748ccffd1d4+0x144e1 @ 0x100144e1 db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 31393952 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.122 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbf7b @ 0x1000bf7b db406b5f94c217e5a3069748ccffd1d4+0x13d5a @ 0x10013d5a db406b5f94c217e5a3069748ccffd1d4+0x144e1 @ 0x100144e1 db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 31393968 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbf7b @ 0x1000bf7b db406b5f94c217e5a3069748ccffd1d4+0x13d5a @ 0x10013d5a db406b5f94c217e5a3069748ccffd1d4+0x144e1 @ 0x100144e1 db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637768 registers.edi: 128 registers.eax: 2010505254 registers.ebp: 1637804 registers.edx: 0 registers.ebx: 64 registers.esi: 31393984 registers.ecx: 128 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0x1429b @ 0x1001429b db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637024 registers.edi: 1024 registers.eax: 2010505254 registers.ebp: 1638084 registers.edx: 0 registers.ebx: 1638104 registers.esi: 23 registers.ecx: 1024 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638068 registers.edi: 388 registers.eax: 2010505254 registers.ebp: 1638256 registers.edx: 0 registers.ebx: 1983119360 registers.esi: 784896 registers.ecx: 388 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbeab @ 0x1000beab db406b5f94c217e5a3069748ccffd1d4+0x143af @ 0x100143af db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 31397224 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbeab @ 0x1000beab db406b5f94c217e5a3069748ccffd1d4+0x143af @ 0x100143af db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 31397248 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbeab @ 0x1000beab db406b5f94c217e5a3069748ccffd1d4+0x143af @ 0x100143af db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 31397272 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbeab @ 0x1000beab db406b5f94c217e5a3069748ccffd1d4+0x143af @ 0x100143af db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 31397296 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbeab @ 0x1000beab db406b5f94c217e5a3069748ccffd1d4+0x143af @ 0x100143af db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 31397320 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbeab @ 0x1000beab db406b5f94c217e5a3069748ccffd1d4+0x143af @ 0x100143af db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 31397344 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbeab @ 0x1000beab db406b5f94c217e5a3069748ccffd1d4+0x143af @ 0x100143af db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 31397368 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbeab @ 0x1000beab db406b5f94c217e5a3069748ccffd1d4+0x143af @ 0x100143af db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 31397392 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbeab @ 0x1000beab db406b5f94c217e5a3069748ccffd1d4+0x143af @ 0x100143af db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 31397416 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbeab @ 0x1000beab db406b5f94c217e5a3069748ccffd1d4+0x143af @ 0x100143af db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 31397440 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbeab @ 0x1000beab db406b5f94c217e5a3069748ccffd1d4+0x143af @ 0x100143af db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 31397464 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbeab @ 0x1000beab db406b5f94c217e5a3069748ccffd1d4+0x143af @ 0x100143af db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 31397488 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbeab @ 0x1000beab db406b5f94c217e5a3069748ccffd1d4+0x143af @ 0x100143af db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 31397512 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbeab @ 0x1000beab db406b5f94c217e5a3069748ccffd1d4+0x143af @ 0x100143af db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 31397536 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbeab @ 0x1000beab db406b5f94c217e5a3069748ccffd1d4+0x143af @ 0x100143af db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 31397560 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xbeab @ 0x1000beab db406b5f94c217e5a3069748ccffd1d4+0x143af @ 0x100143af db406b5f94c217e5a3069748ccffd1d4+0x250e @ 0x1000250e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1638028 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 64 registers.esi: 31397584 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637796 registers.edi: 0 registers.eax: 1983867560 registers.ebp: 1638264 registers.edx: 1637477 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 1983867560 exception.instruction_r: cc c3 c7 05 95 a1 02 10 00 00 00 00 c7 05 8d a1 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0x262d exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 9773 exception.address: 0x1000262d	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0x216b7 @ 0x100216b7 db406b5f94c217e5a3069748ccffd1d4+0xe15b @ 0x1000e15b db406b5f94c217e5a3069748ccffd1d4+0x267b @ 0x1000267b db406b5f94c217e5a3069748ccffd1d4+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637696 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637728 registers.edx: 1637463 registers.ebx: 1637744 registers.esi: 0 registers.ecx: 1637724 exception.instruction_r: cc c3 85 c0 75 09 e8 22 23 ff ff 85 c0 75 44 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0x21713 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 136979 exception.address: 0x10021713	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0x216b7 @ 0x100216b7 db406b5f94c217e5a3069748ccffd1d4+0xe15b @ 0x1000e15b db406b5f94c217e5a3069748ccffd1d4+0x267b @ 0x1000267b db406b5f94c217e5a3069748ccffd1d4+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637700 registers.edi: 4 registers.eax: 1985273800 registers.ebp: 1637728 registers.edx: 1637485 registers.ebx: 1637744 registers.esi: 5015888 registers.ecx: 1985273800 exception.instruction_r: cc c3 85 f6 74 1d 83 fe ff 74 18 68 47 fe ac c2 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0x2173c exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 137020 exception.address: 0x1002173c	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0x216b7 @ 0x100216b7 db406b5f94c217e5a3069748ccffd1d4+0xe15b @ 0x1000e15b db406b5f94c217e5a3069748ccffd1d4+0x267b @ 0x1000267b db406b5f94c217e5a3069748ccffd1d4+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637704 registers.edi: 4 registers.eax: 1985274148 registers.ebp: 1637728 registers.edx: 1637492 registers.ebx: 1637744 registers.esi: 5015888 registers.ecx: 1985274148 exception.instruction_r: cc c3 5e 5f 5b 8b e5 5d c3 57 6a 00 53 e8 91 9e exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0x2175d exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 137053 exception.address: 0x1002175d	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0xe17f @ 0x1000e17f db406b5f94c217e5a3069748ccffd1d4+0x267b @ 0x1000267b db406b5f94c217e5a3069748ccffd1d4+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637708 registers.edi: 64 registers.eax: 2010505254 registers.ebp: 1637744 registers.edx: 31397224 registers.ebx: 64 registers.esi: 1638204 registers.ecx: 64 exception.instruction_r: cc c3 5f c3 33 c0 5f c3 cc cc cc cc cc cc cc 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0xb251 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 45649 exception.address: 0x1000b251	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0x216b7 @ 0x100216b7 db406b5f94c217e5a3069748ccffd1d4+0xe19c @ 0x1000e19c db406b5f94c217e5a3069748ccffd1d4+0x267b @ 0x1000267b db406b5f94c217e5a3069748ccffd1d4+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637696 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637728 registers.edx: 31397224 registers.ebx: 1637744 registers.esi: 0 registers.ecx: 1637724 exception.instruction_r: cc c3 85 c0 75 09 e8 22 23 ff ff 85 c0 75 44 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0x21713 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 136979 exception.address: 0x10021713	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0x216b7 @ 0x100216b7 db406b5f94c217e5a3069748ccffd1d4+0xe19c @ 0x1000e19c db406b5f94c217e5a3069748ccffd1d4+0x267b @ 0x1000267b db406b5f94c217e5a3069748ccffd1d4+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637700 registers.edi: 4 registers.eax: 1985273800 registers.ebp: 1637728 registers.edx: 31397224 registers.ebx: 1637744 registers.esi: 5015888 registers.ecx: 3 exception.instruction_r: cc c3 85 f6 74 1d 83 fe ff 74 18 68 47 fe ac c2 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0x2173c exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 137020 exception.address: 0x1002173c	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0x216b7 @ 0x100216b7 db406b5f94c217e5a3069748ccffd1d4+0xe19c @ 0x1000e19c db406b5f94c217e5a3069748ccffd1d4+0x267b @ 0x1000267b db406b5f94c217e5a3069748ccffd1d4+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637704 registers.edi: 4 registers.eax: 1985274148 registers.ebp: 1637728 registers.edx: 31397224 registers.ebx: 1637744 registers.esi: 5015888 registers.ecx: 4 exception.instruction_r: cc c3 5e 5f 5b 8b e5 5d c3 57 6a 00 53 e8 91 9e exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0x2175d exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 137053 exception.address: 0x1002175d	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0x216b7 @ 0x100216b7 db406b5f94c217e5a3069748ccffd1d4+0xe19c @ 0x1000e19c db406b5f94c217e5a3069748ccffd1d4+0x267b @ 0x1000267b db406b5f94c217e5a3069748ccffd1d4+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637696 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637728 registers.edx: 31397224 registers.ebx: 1637744 registers.esi: 0 registers.ecx: 1637724 exception.instruction_r: cc c3 85 c0 75 09 e8 22 23 ff ff 85 c0 75 44 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0x21713 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 136979 exception.address: 0x10021713	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0x216b7 @ 0x100216b7 db406b5f94c217e5a3069748ccffd1d4+0xe19c @ 0x1000e19c db406b5f94c217e5a3069748ccffd1d4+0x267b @ 0x1000267b db406b5f94c217e5a3069748ccffd1d4+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637700 registers.edi: 4 registers.eax: 1985273800 registers.ebp: 1637728 registers.edx: 31397224 registers.ebx: 1637744 registers.esi: 5015888 registers.ecx: 3 exception.instruction_r: cc c3 85 f6 74 1d 83 fe ff 74 18 68 47 fe ac c2 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0x2173c exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 137020 exception.address: 0x1002173c	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0x216b7 @ 0x100216b7 db406b5f94c217e5a3069748ccffd1d4+0xe19c @ 0x1000e19c db406b5f94c217e5a3069748ccffd1d4+0x267b @ 0x1000267b db406b5f94c217e5a3069748ccffd1d4+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637704 registers.edi: 4 registers.eax: 1985274148 registers.ebp: 1637728 registers.edx: 31397224 registers.ebx: 1637744 registers.esi: 5015888 registers.ecx: 4 exception.instruction_r: cc c3 5e 5f 5b 8b e5 5d c3 57 6a 00 53 e8 91 9e exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0x2175d exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 137053 exception.address: 0x1002175d	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0x216b7 @ 0x100216b7 db406b5f94c217e5a3069748ccffd1d4+0xe19c @ 0x1000e19c db406b5f94c217e5a3069748ccffd1d4+0x267b @ 0x1000267b db406b5f94c217e5a3069748ccffd1d4+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637696 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637728 registers.edx: 31397224 registers.ebx: 1637744 registers.esi: 0 registers.ecx: 1637724 exception.instruction_r: cc c3 85 c0 75 09 e8 22 23 ff ff 85 c0 75 44 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0x21713 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 136979 exception.address: 0x10021713	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0x216b7 @ 0x100216b7 db406b5f94c217e5a3069748ccffd1d4+0xe19c @ 0x1000e19c db406b5f94c217e5a3069748ccffd1d4+0x267b @ 0x1000267b db406b5f94c217e5a3069748ccffd1d4+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637700 registers.edi: 4 registers.eax: 1985273800 registers.ebp: 1637728 registers.edx: 31397224 registers.ebx: 1637744 registers.esi: 5015888 registers.ecx: 3 exception.instruction_r: cc c3 85 f6 74 1d 83 fe ff 74 18 68 47 fe ac c2 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0x2173c exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 137020 exception.address: 0x1002173c	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0x216b7 @ 0x100216b7 db406b5f94c217e5a3069748ccffd1d4+0xe19c @ 0x1000e19c db406b5f94c217e5a3069748ccffd1d4+0x267b @ 0x1000267b db406b5f94c217e5a3069748ccffd1d4+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637704 registers.edi: 4 registers.eax: 1985274148 registers.ebp: 1637728 registers.edx: 31397224 registers.ebx: 1637744 registers.esi: 5015888 registers.ecx: 4 exception.instruction_r: cc c3 5e 5f 5b 8b e5 5d c3 57 6a 00 53 e8 91 9e exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0x2175d exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 137053 exception.address: 0x1002175d	success
1619956022.138 __exception__	stacktrace: db406b5f94c217e5a3069748ccffd1d4+0x216b7 @ 0x100216b7 db406b5f94c217e5a3069748ccffd1d4+0xe19c @ 0x1000e19c db406b5f94c217e5a3069748ccffd1d4+0x267b @ 0x1000267b db406b5f94c217e5a3069748ccffd1d4+0x25bb @ 0x100025bb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637696 registers.edi: 4 registers.eax: 1985273620 registers.ebp: 1637728 registers.edx: 31397224 registers.ebx: 1637744 registers.esi: 0 registers.ecx: 1637724 exception.instruction_r: cc c3 85 c0 75 09 e8 22 23 ff ff 85 c0 75 44 56 exception.symbol: db406b5f94c217e5a3069748ccffd1d4+0x21713 exception.instruction: int3 exception.module: db406b5f94c217e5a3069748ccffd1d4.exe exception.exception_code: 0x80000003 exception.offset: 136979 exception.address: 0x10021713	success

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619956022.107 NtAllocateVirtualMemory	process_identifier: 472 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f0000	success	0	0

The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)

entropy

7.978142205581247

section

{'size_of_data': '0x0001d000', 'virtual_address': '0x00005000', 'entropy': 7.978142205581247, 'name': '.rdata', 'virtual_size': '0x0001cefe'}

description

A section with a high entropy has been found

entropy

7.85760691919064

section

{'size_of_data': '0x00011000', 'virtual_address': '0x00022000', 'entropy': 7.85760691919064, 'name': '.data0', 'virtual_size': '0x000108b4'}

description

A section with a high entropy has been found

entropy

0.8846153846153846

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Tries to unhook Windows functions monitored by Cuckoo (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619956064.497 __anomaly__	subcategory: exception tid: 912 message: Encountered 65537 exceptions, quitting. function_name:	success	0	0

File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34206745
FireEye	Generic.mg.db406b5f94c217e5
ALYac	Spyware.Banker.Dridex
Cylance	Unsafe
Zillya	Trojan.Zenpak.Win32.2458
Sangfor	Malware
K7AntiVirus	Trojan ( 005485311 )
Alibaba	Backdoor:Win32/Dridex.a1506180
K7GW	Trojan ( 005485311 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D209F419
Cyren	W32/Kryptik.BQG.gen!Eldorado
Symantec	Packed.Generic.553
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Zenpak.vho
BitDefender	Trojan.GenericKD.34206745
NANO-Antivirus	Trojan.Win32.Zenpak.hoqsil
Avast	Win32:TrojanX-gen [Trj]
Rising	Trojan.Generic@ML.88 (RDMK:1d3YAk5ij8zSnelEMC+rSQ)
Ad-Aware	Trojan.GenericKD.34206745
Sophos	Mal/Generic-S + Troj/Agent-BFBF
Comodo	Malware@#d7iw1ub6lq81
F-Secure	Trojan.TR/AD.Dridex.vpkut
DrWeb	Trojan.Dridex.716
VIPRE	LooksLike.Win32.Dridex.e (v)
TrendMicro	TrojanSpy.Win32.DRIDEX.BCK
McAfee-GW-Edition	Drixed-FIY!DB406B5F94C2
Emsisoft	Trojan.GenericKD.34206745 (B)
Ikarus	Trojan.Win32.Crypt
Jiangmin	Trojan.Zenpak.cqu
Avira	TR/AD.Dridex.vpkut
Antiy-AVL	Trojan[Downloader]/Win32.Cridex
Kingsoft	Win32.Heur.KVMH008.a.(kcloud)
Gridinsoft	Trojan.Heur!.02052021
Microsoft	Trojan:Win32/Dridex.ARJ!MTB
AegisLab	Trojan.Win32.Malicious.4!c
ZoneAlarm	HEUR:Trojan.Win32.Zenpak.vho
GData	Trojan.GenericKD.34206745
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.R345764
Acronis	suspicious
McAfee	Drixed-FIY!DB406B5F94C2
MAX	malware (ai score=81)
VBA32	TScope.Malware-Cryptor.SB
Malwarebytes	Trojan.Dridex
ESET-NOD32	a variant of Win32/Kryptik.HFAX
TrendMicro-HouseCall	TrojanSpy.Win32.DRIDEX.BCK

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-21 05:19:14

Imports

Library WININET.dll:

• 0x100050ec FindNextUrlCacheEntryW

Library Secur32.dll:

• 0x100050a8 InitializeSecurityContextA

Library mscms.dll:

• 0x100050fc GetColorProfileElement

Library WINSPOOL.DRV:

• 0x100050f4 FindClosePrinterChangeNotification

Library msvcrt.dll:

• 0x10005104 ungetwc

Library KERNEL32.dll:

• 0x10005040 GetLogicalDriveStringsA

• 0x10005044 GetStartupInfoA

• 0x10005048 GetDiskFreeSpaceA

• 0x1000504c lstrcatA

• 0x10005050 GetLastError

• 0x10005054 VirtualAlloc

• 0x10005058 GetCommTimeouts

• 0x1000505c GetTempFileNameW

• 0x10005060 GetUserDefaultUILanguage

• 0x10005064 FreeLibrary

• 0x10005068 FindFirstVolumeW

• 0x1000506c GetTimeFormatA

• 0x10005070 GetProfileIntA

• 0x10005074 GetTempFileNameA

• 0x10005078 LocalSize

• 0x1000507c GetLargestConsoleWindowSize

• 0x10005080 GetCurrentThread

• 0x10005084 GetModuleFileNameA

• 0x10005088 LoadLibraryW

• 0x1000508c GetACP

• 0x10005090 LoadLibraryExW

• 0x10005094 CloseHandle

• 0x10005098 IsValidLanguageGroup

Library USER32.dll:

• 0x100050b0 DefWindowProcW

• 0x100050b4 GetMenuState

• 0x100050b8 DefDlgProcA

• 0x100050bc GetShellWindow

• 0x100050c0 GetUserObjectInformationW

• 0x100050c4 FreeDDElParam

• 0x100050c8 DefWindowProcA

• 0x100050cc GetClipCursor

• 0x100050d0 GetRawInputDeviceInfoW

• 0x100050d4 GetKeyNameTextA

• 0x100050d8 GetClassInfoExA

• 0x100050dc GetProcessDefaultLayout

• 0x100050e0 GetKeyboardLayoutList

• 0x100050e4 GetMenu

Library OLEAUT32.dll:

• 0x100050a0 VarDecFromR8

Library ADVAPI32.dll:

• 0x10005000 LookupAccountSidW

• 0x10005004 DeleteAce

• 0x10005008 IsTextUnicode

• 0x1000500c GetSecurityDescriptorSacl

• 0x10005010 LogonUserA

• 0x10005014 GetServiceKeyNameA

• 0x10005018 GetServiceDisplayNameW

• 0x1000501c GetUserNameW

Library GDI32.dll:

• 0x10005024 GetTextMetricsA

• 0x10005028 GetMetaFileA

• 0x1000502c GetOutlineTextMetricsA

• 0x10005030 GetSystemPaletteUse

• 0x10005034 GetTextMetricsW

• 0x10005038 GetTextExtentPointW

Library urlmon.dll:

• 0x1000510c MkParseDisplayNameEx

• 0x10005110 FindMimeFromData

• 0x10005114 GetClassFileOrMime

Exports

Ordinal	Address	Name
1	0x100216d3	mvbFp6

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.