7.0
高危
63 个模型检测该样本为恶意！
重新分析
更多

7c124384c122263b3c98e2cd1208ae98d8964e1f0d3fc08b326fd62cd75bc59a

f513831ac9768522af6d291c9ca445c0.exe

分析耗时

90s

最近分析

文件大小

713.5KB
静态报毒 动态报毒 100% AI SCORE=86 BTIKAC CONFIDENCE CRIDEX DELF DELFINJ DELPHILESS EAML ELZG FAREIT GENERICKD HIGH CONFIDENCE HKBSJN HPLOKI IGENT KRYPTIK KTSE LCIHE LOKIBOT MALWARE@#HRM41OSGDH72 R + TROJ SCORE SGW@AE@HWNJI SMBD SPYBOTNET STATIC AI SUSGEN SUSPICIOUS PE TSCOPE TSPY UNSAFE WACATAC X2066 ZELPHIF ZPUP 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!F513831AC976 20201226 6.0.6.653
Alibaba Trojan:Win32/Cridex.936928d3 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Other:Malware-gen [Trj] 20201226 21.1.5827.0
Tencent Win32.Trojan.Kryptik.Eaml 20201226 1.0.0.1
Kingsoft 20201226 2017.9.26.565
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (33 个事件)
Time & API Arguments Status Return Repeated
1619999682.531363
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 48561720
registers.edi: 0
registers.eax: 0
registers.ebp: 48562056
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007441.60025
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
f513831ac9768522af6d291c9ca445c0+0x5aa4d @ 0x45aa4d
f513831ac9768522af6d291c9ca445c0+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdc514ad
success 0 0
1620007440.288125
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34274872
registers.edi: 0
registers.eax: 0
registers.ebp: 34275208
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007446.63275
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49151544
registers.edi: 0
registers.eax: 0
registers.ebp: 49151880
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007448.866625
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7510e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7510ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7510b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7510b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7510ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7510aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75105511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7510559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x751c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x751c4de3
f513831ac9768522af6d291c9ca445c0+0x5aa4d @ 0x45aa4d
f513831ac9768522af6d291c9ca445c0+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4d14ad
success 0 0
1620007449.100125
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 50200120
registers.edi: 0
registers.eax: 0
registers.ebp: 50200456
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007452.694625
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49217080
registers.edi: 0
registers.eax: 0
registers.ebp: 49217416
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007454.7105
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
f513831ac9768522af6d291c9ca445c0+0x5aa4d @ 0x45aa4d
f513831ac9768522af6d291c9ca445c0+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdaa14ad
success 0 0
1620007455.06925
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35716664
registers.edi: 0
registers.eax: 0
registers.ebp: 35717000
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007458.335875
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 48234040
registers.edi: 0
registers.eax: 0
registers.ebp: 48234376
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007460.600125
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7510e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7510ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7510b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7510b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7510ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7510aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75105511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7510559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x751c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x751c4de3
f513831ac9768522af6d291c9ca445c0+0x5aa4d @ 0x45aa4d
f513831ac9768522af6d291c9ca445c0+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4f14ad
success 0 0
1620007460.6785
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35388984
registers.edi: 0
registers.eax: 0
registers.ebp: 35389320
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007467.147125
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 48954936
registers.edi: 0
registers.eax: 0
registers.ebp: 48955272
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007468.6005
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
f513831ac9768522af6d291c9ca445c0+0x5aa4d @ 0x45aa4d
f513831ac9768522af6d291c9ca445c0+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfda914ad
success 0 0
1620007468.632875
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49741368
registers.edi: 0
registers.eax: 0
registers.ebp: 49741704
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007472.41375
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 33685048
registers.edi: 0
registers.eax: 0
registers.ebp: 33685384
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007474.63225
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7510e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7510ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7510b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7510b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7510ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7510aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75105511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7510559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x751c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x751c4de3
f513831ac9768522af6d291c9ca445c0+0x5aa4d @ 0x45aa4d
f513831ac9768522af6d291c9ca445c0+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfda914ad
success 0 0
1620007474.772
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35323448
registers.edi: 0
registers.eax: 0
registers.ebp: 35323784
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007478.210125
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34078264
registers.edi: 0
registers.eax: 0
registers.ebp: 34078600
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007480.225625
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
f513831ac9768522af6d291c9ca445c0+0x5aa4d @ 0x45aa4d
f513831ac9768522af6d291c9ca445c0+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe0814ad
success 0 0
1620007480.27225
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34340408
registers.edi: 0
registers.eax: 0
registers.ebp: 34340744
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007484.36675
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34930232
registers.edi: 0
registers.eax: 0
registers.ebp: 34930568
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007485.803125
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7510e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7510ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7510b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7510b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7510ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7510aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75105511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7510559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x751c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x751c4de3
f513831ac9768522af6d291c9ca445c0+0x5aa4d @ 0x45aa4d
f513831ac9768522af6d291c9ca445c0+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff3614ad
success 0 0
1620007486.382875
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49741368
registers.edi: 0
registers.eax: 0
registers.ebp: 49741704
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007489.28825
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34668088
registers.edi: 0
registers.eax: 0
registers.ebp: 34668424
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007491.397
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
f513831ac9768522af6d291c9ca445c0+0x5aa4d @ 0x45aa4d
f513831ac9768522af6d291c9ca445c0+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfda914ad
success 0 0
1620007491.850625
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49151544
registers.edi: 0
registers.eax: 0
registers.ebp: 49151880
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007494.1005
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 48496184
registers.edi: 0
registers.eax: 0
registers.ebp: 48496520
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007496.1165
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x750be97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x750bea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x750bb25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x750bb4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x750bac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x750baed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x750b5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x750b559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75127f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75124de3
f513831ac9768522af6d291c9ca445c0+0x5aa4d @ 0x45aa4d
f513831ac9768522af6d291c9ca445c0+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4214ad
success 0 0
1620007496.147
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 48102968
registers.edi: 0
registers.eax: 0
registers.ebp: 48103304
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007499.67875
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35061304
registers.edi: 0
registers.eax: 0
registers.ebp: 35061640
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
1620007502.225875
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x749ee97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x749eea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x749eb25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x749eb4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x749eac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x749eaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x749e5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x749e559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75127f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75124de3
f513831ac9768522af6d291c9ca445c0+0x5aa4d @ 0x45aa4d
f513831ac9768522af6d291c9ca445c0+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff3314ad
success 0 0
1620007502.507
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34405944
registers.edi: 0
registers.eax: 0
registers.ebp: 34406280
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9
exception.symbol: f513831ac9768522af6d291c9ca445c0+0x58eeb
exception.instruction: div eax
exception.module: f513831ac9768522af6d291c9ca445c0.exe
exception.exception_code: 0xc0000094
exception.offset: 364267
exception.address: 0x458eeb
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 363 个事件)
Time & API Arguments Status Return Repeated
1619999682.187363
NtAllocateVirtualMemory
process_identifier: 2456
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00370000
success 0 0
1619999682.531363
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 45056
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00458000
success 0 0
1619999682.546363
NtAllocateVirtualMemory
process_identifier: 2456
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00890000
success 0 0
1620007440.16325
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1620007440.21025
NtAllocateVirtualMemory
process_identifier: 2196
region_size: 1638400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f70000
success 0 0
1620007440.21025
NtAllocateVirtualMemory
process_identifier: 2196
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020c0000
success 0 0
1620007440.21025
NtAllocateVirtualMemory
process_identifier: 2196
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00610000
success 0 0
1620007440.21025
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 307200
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00612000
success 0 0
1620007440.67825
NtAllocateVirtualMemory
process_identifier: 2196
region_size: 393216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e40000
success 0 0
1620007440.67825
NtAllocateVirtualMemory
process_identifier: 2196
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01e60000
success 0 0
1620007441.56925
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006f2000
success 0 0
1620007441.56925
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620007441.56925
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006f2000
success 0 0
1620007441.56925
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1620007441.56925
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006f2000
success 0 0
1620007441.56925
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1620007441.56925
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006f2000
success 0 0
1620007441.56925
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620007441.58525
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006f2000
success 0 0
1620007441.58525
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1620007441.58525
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006f2000
success 0 0
1620007441.58525
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1620007441.58525
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006f2000
success 0 0
1620007441.58525
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620007441.58525
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006f2000
success 0 0
1620007441.58525
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620007441.58525
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006f2000
success 0 0
1620007441.58525
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1620007441.58525
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006f2000
success 0 0
1620007441.58525
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620007440.272125
NtAllocateVirtualMemory
process_identifier: 420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01dd0000
success 0 0
1620007440.288125
NtProtectVirtualMemory
process_identifier: 420
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 45056
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00458000
success 0 0
1620007440.303125
NtAllocateVirtualMemory
process_identifier: 420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02e20000
success 0 0
1620007446.56975
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00360000
success 0 0
1620007446.63275
NtProtectVirtualMemory
process_identifier: 2136
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 45056
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00458000
success 0 0
1620007446.64775
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00680000
success 0 0
1620007448.522625
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1620007448.538625
NtAllocateVirtualMemory
process_identifier: 2868
region_size: 983040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01df0000
success 0 0
1620007448.538625
NtAllocateVirtualMemory
process_identifier: 2868
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01ea0000
success 0 0
1620007448.538625
NtAllocateVirtualMemory
process_identifier: 2868
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00520000
success 0 0
1620007448.538625
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 307200
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00522000
success 0 0
1620007448.616625
NtAllocateVirtualMemory
process_identifier: 2868
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01df0000
success 0 0
1620007448.616625
NtAllocateVirtualMemory
process_identifier: 2868
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01df0000
success 0 0
1620007448.803625
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f72000
success 0 0
1620007448.803625
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620007448.803625
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f72000
success 0 0
1620007448.803625
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1620007448.803625
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f72000
success 0 0
1620007448.803625
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1620007448.803625
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f72000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (50 out of 53 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.281185694545685 section {'size_of_data': '0x00046a00', 'virtual_address': '0x00072000', 'entropy': 7.281185694545685, 'name': '.rsrc', 'virtual_size': '0x000468d4'} description A section with a high entropy has been found
entropy 0.39649122807017545 description Overall entropy of this PE file is high
Expresses interest in specific running processes (1 个事件)
process f513831ac9768522af6d291c9ca445c0.exe
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (21 个事件)
Time & API Arguments Status Return Repeated
1619999682.562363
Process32NextW
process_name: f513831ac9768522af6d291c9ca445c0.exe
snapshot_handle: 0x000000f8
process_identifier: 2456
failed 0 0
1620007446.178125
Process32NextW
process_name: f513831ac9768522af6d291c9ca445c0.exe
snapshot_handle: 0x000001ac
process_identifier: 420
failed 0 0
1620007446.67875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 2996
failed 0 0
1620007451.928125
Process32NextW
process_name: f513831ac9768522af6d291c9ca445c0.exe
snapshot_handle: 0x00000144
process_identifier: 2988
failed 0 0
1620007452.725625
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 2224
failed 0 0
1620007457.71025
Process32NextW
process_name: f513831ac9768522af6d291c9ca445c0.exe
snapshot_handle: 0x00000148
process_identifier: 920
failed 0 0
1620007458.413875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 2940
failed 0 0
1620007466.3355
Process32NextW
process_name: f513831ac9768522af6d291c9ca445c0.exe
snapshot_handle: 0x0000019c
process_identifier: 1160
failed 0 0
1620007467.178125
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3236
failed 0 0
1620007471.710875
Process32NextW
process_name: f513831ac9768522af6d291c9ca445c0.exe
snapshot_handle: 0x00000138
process_identifier: 3312
failed 0 0
1620007472.42875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3572
failed 0 0
1620007477.647
Process32NextW
process_name: f513831ac9768522af6d291c9ca445c0.exe
snapshot_handle: 0x00000150
process_identifier: 3744
failed 0 0
1620007478.241125
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3908
failed 0 0
1620007483.81925
Process32NextW
process_name: f513831ac9768522af6d291c9ca445c0.exe
snapshot_handle: 0x00000150
process_identifier: 3988
failed 0 0
1620007484.39775
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3120
failed 0 0
1620007488.460875
Process32NextW
process_name: f513831ac9768522af6d291c9ca445c0.exe
snapshot_handle: 0x00000128
process_identifier: 1564
failed 0 0
1620007489.31925
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3428
failed 0 0
1620007493.272625
Process32NextW
process_name: f513831ac9768522af6d291c9ca445c0.exe
snapshot_handle: 0x0000011c
process_identifier: 3644
failed 0 0
1620007494.1785
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3936
failed 0 0
1620007498.897
Process32NextW
process_name: f513831ac9768522af6d291c9ca445c0.exe
snapshot_handle: 0x0000014c
process_identifier: 3816
failed 0 0
1620007499.72575
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 2516
failed 0 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (22 个事件)
Process injection Process 2456 called NtSetContextThread to modify thread in remote process 2196
Process injection Process 2136 called NtSetContextThread to modify thread in remote process 2868
Process injection Process 884 called NtSetContextThread to modify thread in remote process 360
Process injection Process 2008 called NtSetContextThread to modify thread in remote process 2956
Process injection Process 3180 called NtSetContextThread to modify thread in remote process 3252
Process injection Process 3516 called NtSetContextThread to modify thread in remote process 3628
Process injection Process 3852 called NtSetContextThread to modify thread in remote process 3924
Process injection Process 1320 called NtSetContextThread to modify thread in remote process 1124
Process injection Process 3140 called NtSetContextThread to modify thread in remote process 3256
Process injection Process 3844 called NtSetContextThread to modify thread in remote process 3956
Process injection Process 3992 called NtSetContextThread to modify thread in remote process 3196
Time & API Arguments Status Return Repeated
1619999682.890363
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2196
success 0 0
1620007447.71075
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2868
success 0 0
1620007453.132625
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 360
success 0 0
1620007459.428875
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2956
success 0 0
1620007467.538125
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3252
success 0 0
1620007473.47575
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3628
success 0 0
1620007479.194125
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3924
success 0 0
1620007484.77275
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1124
success 0 0
1620007490.16325
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3256
success 0 0
1620007494.8665
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3956
success 0 0
1620007500.42875
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3196
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (22 个事件)
Process injection Process 2456 resumed a thread in remote process 2196
Process injection Process 2136 resumed a thread in remote process 2868
Process injection Process 884 resumed a thread in remote process 360
Process injection Process 2008 resumed a thread in remote process 2956
Process injection Process 3180 resumed a thread in remote process 3252
Process injection Process 3516 resumed a thread in remote process 3628
Process injection Process 3852 resumed a thread in remote process 3924
Process injection Process 1320 resumed a thread in remote process 1124
Process injection Process 3140 resumed a thread in remote process 3256
Process injection Process 3844 resumed a thread in remote process 3956
Process injection Process 3992 resumed a thread in remote process 3196
Time & API Arguments Status Return Repeated
1619999683.156363
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2196
success 0 0
1620007448.31975
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2868
success 0 0
1620007453.944625
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 360
success 0 0
1620007460.007875
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2956
success 0 0
1620007467.960125
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3252
success 0 0
1620007474.06975
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3628
success 0 0
1620007479.616125
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3924
success 0 0
1620007485.22575
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1124
success 0 0
1620007490.56925
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3256
success 0 0
1620007495.4135
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3956
success 0 0
1620007501.44475
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3196
success 0 0
Executed a process and injected code into it, probably while unpacking (50 out of 87 个事件)
Time & API Arguments Status Return Repeated
1619999682.859363
CreateProcessInternalW
thread_identifier: 2996
thread_handle: 0x000000fc
process_identifier: 2196
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619999682.859363
NtUnmapViewOfSection
process_identifier: 2196
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619999682.874363
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 2196
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1619999682.890363
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619999682.890363
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2196
success 0 0
1619999683.156363
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2196
success 0 0
1619999683.187363
CreateProcessInternalW
thread_identifier: 884
thread_handle: 0x00000104
process_identifier: 420
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe" 2 2196 13288078
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1620007446.257125
CreateProcessInternalW
thread_identifier: 3004
thread_handle: 0x000001b0
process_identifier: 2136
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000001b4
inherit_handles: 0
success 1 0
1620007447.61675
CreateProcessInternalW
thread_identifier: 2764
thread_handle: 0x000000fc
process_identifier: 2868
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1620007447.61675
NtUnmapViewOfSection
process_identifier: 2868
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1620007447.63275
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 2868
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1620007447.71075
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1620007447.71075
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2868
success 0 0
1620007448.31975
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2868
success 0 0
1620007448.52275
CreateProcessInternalW
thread_identifier: 1688
thread_handle: 0x00000104
process_identifier: 2988
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe" 2 2868 13296437
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1620007452.163125
CreateProcessInternalW
thread_identifier: 2008
thread_handle: 0x00000148
process_identifier: 884
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000014c
inherit_handles: 0
success 1 0
1620007453.100625
CreateProcessInternalW
thread_identifier: 1564
thread_handle: 0x000000fc
process_identifier: 360
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1620007453.100625
NtUnmapViewOfSection
process_identifier: 360
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1620007453.100625
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 360
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1620007453.132625
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1620007453.132625
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 360
success 0 0
1620007453.944625
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 360
success 0 0
1620007454.397625
CreateProcessInternalW
thread_identifier: 1868
thread_handle: 0x00000104
process_identifier: 920
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe" 2 360 13302062
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1620007457.91325
CreateProcessInternalW
thread_identifier: 3064
thread_handle: 0x0000014c
process_identifier: 2008
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000150
inherit_handles: 0
success 1 0
1620007459.335875
CreateProcessInternalW
thread_identifier: 376
thread_handle: 0x000000fc
process_identifier: 2956
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1620007459.335875
NtUnmapViewOfSection
process_identifier: 2956
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1620007459.350875
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 2956
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1620007459.428875
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1620007459.428875
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2956
success 0 0
1620007460.007875
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2956
success 0 0
1620007460.225875
CreateProcessInternalW
thread_identifier: 2964
thread_handle: 0x00000104
process_identifier: 1160
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe" 2 2956 13308125
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1620007466.4755
CreateProcessInternalW
thread_identifier: 3184
thread_handle: 0x000001a0
process_identifier: 3180
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000001a4
inherit_handles: 0
success 1 0
1620007467.475125
CreateProcessInternalW
thread_identifier: 3256
thread_handle: 0x000000fc
process_identifier: 3252
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1620007467.475125
NtUnmapViewOfSection
process_identifier: 3252
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1620007467.491125
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 3252
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1620007467.538125
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1620007467.538125
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3252
success 0 0
1620007467.960125
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3252
success 0 0
1620007468.303125
CreateProcessInternalW
thread_identifier: 3316
thread_handle: 0x00000104
process_identifier: 3312
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe" 2 3252 13316078
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1620007471.757875
CreateProcessInternalW
thread_identifier: 3520
thread_handle: 0x0000013c
process_identifier: 3516
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000140
inherit_handles: 0
success 1 0
1620007473.42875
CreateProcessInternalW
thread_identifier: 3632
thread_handle: 0x000000fc
process_identifier: 3628
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1620007473.42875
NtUnmapViewOfSection
process_identifier: 3628
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1620007473.42875
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 3628
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1620007473.47575
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1620007473.47575
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3628
success 0 0
1620007474.06975
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3628
success 0 0
1620007474.14775
CreateProcessInternalW
thread_identifier: 3748
thread_handle: 0x00000104
process_identifier: 3744
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe" 2 3628 13322187
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1620007477.897
CreateProcessInternalW
thread_identifier: 3856
thread_handle: 0x00000154
process_identifier: 3852
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000158
inherit_handles: 0
success 1 0
1620007478.897125
CreateProcessInternalW
thread_identifier: 3928
thread_handle: 0x000000fc
process_identifier: 3924
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f513831ac9768522af6d291c9ca445c0.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1620007478.897125
NtUnmapViewOfSection
process_identifier: 3924
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
File has been identified by 63 AntiVirus engines on VirusTotal as malicious (50 out of 63 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.43140088
FireEye Generic.mg.f513831ac9768522
CAT-QuickHeal Trojan.Multi
McAfee Fareit-FTB!F513831AC976
Cylance Unsafe
Zillya Trojan.Injector.Win32.731991
Sangfor Malware
K7AntiVirus Trojan ( 005667651 )
Alibaba Trojan:Win32/Cridex.936928d3
K7GW Trojan ( 005667651 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Generic.D29243F8
Cyren W32/Injector.ZPUP-1501
Symantec Trojan.Gen.MBT
APEX Malicious
Avast Other:Malware-gen [Trj]
ClamAV Win.Dropper.LokiBot-7787977-0
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.GenericKD.43140088
NANO-Antivirus Trojan.Win32.SpyBotNET.hkbsjn
Paloalto generic.ml
Tencent Win32.Trojan.Kryptik.Eaml
Ad-Aware Trojan.GenericKD.43140088
Emsisoft Trojan.GenericKD.43140088 (B)
Comodo Malware@#hrm41osgdh72
F-Secure Trojan.TR/Agent.lcihe
DrWeb BackDoor.SpyBotNET.17
VIPRE Trojan.Win32.Generic!BT
TrendMicro TSPY_HPLOKI.SMBD
McAfee-GW-Edition BehavesLike.Win32.Fareit.bc
Sophos Mal/Generic-R + Troj/DelfInj-DI
SentinelOne Static AI - Suspicious PE
Jiangmin Trojan.Kryptik.ata
Webroot W32.Trojan.Gen
Avira TR/Agent.lcihe
eGambit Unsafe.AI_Score_98%
Antiy-AVL Trojan/Win32.Wacatac
Gridinsoft Trojan.Win32.Kryptik.ba!s1
Microsoft Trojan:Win32/Cridex.VD!MTB
AegisLab Trojan.Win32.Kryptik.4!c
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Win32.Trojan.Injector.PA
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
Acronis suspicious
VBA32 TScope.Trojan.Delf
ALYac Trojan.GenericKD.43140088
MAX malware (ai score=86)
Malwarebytes Trojan.MalPack.DLF
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x466150 VirtualFree
• 0x466154 VirtualAlloc
• 0x466158 LocalFree
• 0x46615c LocalAlloc
• 0x466160 GetVersion
• 0x466164 GetCurrentThreadId
• 0x466170 VirtualQuery
• 0x466174 WideCharToMultiByte
• 0x466178 MultiByteToWideChar
• 0x46617c lstrlenA
• 0x466180 lstrcpynA
• 0x466184 LoadLibraryExA
• 0x466188 GetThreadLocale
• 0x46618c GetStartupInfoA
• 0x466190 GetProcAddress
• 0x466194 GetModuleHandleA
• 0x466198 GetModuleFileNameA
• 0x46619c GetLocaleInfoA
• 0x4661a0 GetCommandLineA
• 0x4661a4 FreeLibrary
• 0x4661a8 FindFirstFileA
• 0x4661ac FindClose
• 0x4661b0 ExitProcess
• 0x4661b4 WriteFile
• 0x4661bc RtlUnwind
• 0x4661c0 RaiseException
• 0x4661c4 GetStdHandle
Library user32.dll:
• 0x4661cc GetKeyboardType
• 0x4661d0 LoadStringA
• 0x4661d4 MessageBoxA
• 0x4661d8 CharNextA
Library advapi32.dll:
• 0x4661e0 RegQueryValueExA
• 0x4661e4 RegOpenKeyExA
• 0x4661e8 RegCloseKey
Library oleaut32.dll:
• 0x4661f0 SysFreeString
• 0x4661f4 SysReAllocStringLen
• 0x4661f8 SysAllocStringLen
Library kernel32.dll:
• 0x466200 TlsSetValue
• 0x466204 TlsGetValue
• 0x466208 LocalAlloc
• 0x46620c GetModuleHandleA
Library advapi32.dll:
• 0x466214 RegQueryValueExA
• 0x466218 RegOpenKeyExA
• 0x46621c RegCloseKey
Library kernel32.dll:
• 0x466224 lstrcpyA
• 0x466228 lstrcmpA
• 0x46622c WriteFile
• 0x466230 WaitForSingleObject
• 0x466234 VirtualQuery
• 0x466238 VirtualProtect
• 0x46623c VirtualAlloc
• 0x466240 Sleep
• 0x466244 SizeofResource
• 0x466248 SetThreadLocale
• 0x46624c SetFilePointer
• 0x466250 SetEvent
• 0x466254 SetErrorMode
• 0x466258 SetEndOfFile
• 0x46625c ResetEvent
• 0x466260 ReadFile
• 0x466264 MulDiv
• 0x466268 LockResource
• 0x46626c LoadResource
• 0x466270 LoadLibraryA
• 0x46627c GlobalUnlock
• 0x466280 GlobalReAlloc
• 0x466284 GlobalHandle
• 0x466288 GlobalLock
• 0x46628c GlobalFree
• 0x466290 GlobalFindAtomA
• 0x466294 GlobalDeleteAtom
• 0x466298 GlobalAlloc
• 0x46629c GlobalAddAtomA
• 0x4662a0 GetVersionExA
• 0x4662a4 GetVersion
• 0x4662a8 GetTickCount
• 0x4662ac GetThreadLocale
• 0x4662b4 GetSystemTime
• 0x4662b8 GetSystemInfo
• 0x4662bc GetStringTypeExA
• 0x4662c0 GetStdHandle
• 0x4662c4 GetProcAddress
• 0x4662c8 GetModuleHandleA
• 0x4662cc GetModuleFileNameA
• 0x4662d0 GetLocaleInfoA
• 0x4662d4 GetLocalTime
• 0x4662d8 GetLastError
• 0x4662dc GetFullPathNameA
• 0x4662e0 GetDiskFreeSpaceA
• 0x4662e4 GetDateFormatA
• 0x4662e8 GetCurrentThreadId
• 0x4662ec GetCurrentProcessId
• 0x4662f0 GetCPInfo
• 0x4662f4 GetACP
• 0x4662f8 FreeResource
• 0x4662fc InterlockedExchange
• 0x466300 FreeLibrary
• 0x466304 FormatMessageA
• 0x466308 FindResourceA
• 0x466310 ExitThread
• 0x466314 EnumCalendarInfoA
• 0x466320 CreateThread
• 0x466324 CreateFileA
• 0x466328 CreateEventA
• 0x46632c CompareStringA
• 0x466330 CloseHandle
Library version.dll:
• 0x466338 VerQueryValueA
• 0x466340 GetFileVersionInfoA
Library gdi32.dll:
• 0x466348 UnrealizeObject
• 0x46634c StretchBlt
• 0x466350 SetWindowOrgEx
• 0x466354 SetViewportOrgEx
• 0x466358 SetTextColor
• 0x46635c SetStretchBltMode
• 0x466360 SetROP2
• 0x466364 SetPixel
• 0x466368 SetDIBColorTable
• 0x46636c SetBrushOrgEx
• 0x466370 SetBkMode
• 0x466374 SetBkColor
• 0x466378 SelectPalette
• 0x46637c SelectObject
• 0x466380 SaveDC
• 0x466384 RestoreDC
• 0x466388 RectVisible
• 0x46638c RealizePalette
• 0x466390 PatBlt
• 0x466394 MoveToEx
• 0x466398 MaskBlt
• 0x46639c LineTo
• 0x4663a0 IntersectClipRect
• 0x4663a4 GetWindowOrgEx
• 0x4663a8 GetTextMetricsA
• 0x4663b4 GetStockObject
• 0x4663b8 GetPixel
• 0x4663bc GetPaletteEntries
• 0x4663c0 GetObjectA
• 0x4663c4 GetDeviceCaps
• 0x4663c8 GetDIBits
• 0x4663cc GetDIBColorTable
• 0x4663d0 GetDCOrgEx
• 0x4663d8 GetClipBox
• 0x4663dc GetBrushOrgEx
• 0x4663e0 GetBitmapBits
• 0x4663e4 ExcludeClipRect
• 0x4663e8 DeleteObject
• 0x4663ec DeleteDC
• 0x4663f0 CreateSolidBrush
• 0x4663f4 CreatePenIndirect
• 0x4663f8 CreatePalette
• 0x466400 CreateFontIndirectA
• 0x466404 CreateDIBitmap
• 0x466408 CreateDIBSection
• 0x46640c CreateCompatibleDC
• 0x466414 CreateBrushIndirect
• 0x466418 CreateBitmap
• 0x46641c BitBlt
Library user32.dll:
• 0x466424 CreateWindowExA
• 0x466428 WindowFromPoint
• 0x46642c WinHelpA
• 0x466430 WaitMessage
• 0x466434 UpdateWindow
• 0x466438 UnregisterClassA
• 0x46643c UnhookWindowsHookEx
• 0x466440 TranslateMessage
• 0x466448 TrackPopupMenu
• 0x466450 ShowWindow
• 0x466454 ShowScrollBar
• 0x466458 ShowOwnedPopups
• 0x46645c ShowCursor
• 0x466460 SetWindowsHookExA
• 0x466464 SetWindowTextA
• 0x466468 SetWindowPos
• 0x46646c SetWindowPlacement
• 0x466470 SetWindowLongA
• 0x466474 SetTimer
• 0x466478 SetScrollRange
• 0x46647c SetScrollPos
• 0x466480 SetScrollInfo
• 0x466484 SetRect
• 0x466488 SetPropA
• 0x46648c SetParent
• 0x466490 SetMenuItemInfoA
• 0x466494 SetMenu
• 0x466498 SetForegroundWindow
• 0x46649c SetFocus
• 0x4664a0 SetCursor
• 0x4664a4 SetClassLongA
• 0x4664a8 SetCapture
• 0x4664ac SetActiveWindow
• 0x4664b0 SendMessageA
• 0x4664b4 ScrollWindow
• 0x4664b8 ScreenToClient
• 0x4664bc RemovePropA
• 0x4664c0 RemoveMenu
• 0x4664c4 ReleaseDC
• 0x4664c8 ReleaseCapture
• 0x4664d4 RegisterClassA
• 0x4664d8 RedrawWindow
• 0x4664dc PtInRect
• 0x4664e0 PostQuitMessage
• 0x4664e4 PostMessageA
• 0x4664e8 PeekMessageA
• 0x4664ec OffsetRect
• 0x4664f0 OemToCharA
• 0x4664f4 MessageBoxA
• 0x4664f8 MapWindowPoints
• 0x4664fc MapVirtualKeyA
• 0x466500 LoadStringA
• 0x466504 LoadKeyboardLayoutA
• 0x466508 LoadIconA
• 0x46650c LoadCursorA
• 0x466510 LoadBitmapA
• 0x466514 KillTimer
• 0x466518 IsZoomed
• 0x46651c IsWindowVisible
• 0x466520 IsWindowEnabled
• 0x466524 IsWindow
• 0x466528 IsRectEmpty
• 0x46652c IsIconic
• 0x466530 IsDialogMessageA
• 0x466534 IsChild
• 0x466538 InvalidateRect
• 0x46653c IntersectRect
• 0x466540 InsertMenuItemA
• 0x466544 InsertMenuA
• 0x466548 InflateRect
• 0x466550 GetWindowTextA
• 0x466554 GetWindowRect
• 0x466558 GetWindowPlacement
• 0x46655c GetWindowLongA
• 0x466560 GetWindowDC
• 0x466564 GetTopWindow
• 0x466568 GetSystemMetrics
• 0x46656c GetSystemMenu
• 0x466570 GetSysColorBrush
• 0x466574 GetSysColor
• 0x466578 GetSubMenu
• 0x46657c GetScrollRange
• 0x466580 GetScrollPos
• 0x466584 GetScrollInfo
• 0x466588 GetPropA
• 0x46658c GetParent
• 0x466590 GetWindow
• 0x466594 GetMenuStringA
• 0x466598 GetMenuState
• 0x46659c GetMenuItemInfoA
• 0x4665a0 GetMenuItemID
• 0x4665a4 GetMenuItemCount
• 0x4665a8 GetMenu
• 0x4665ac GetLastActivePopup
• 0x4665b0 GetKeyboardState
• 0x4665b8 GetKeyboardLayout
• 0x4665bc GetKeyState
• 0x4665c0 GetKeyNameTextA
• 0x4665c4 GetIconInfo
• 0x4665c8 GetForegroundWindow
• 0x4665cc GetFocus
• 0x4665d0 GetDlgItem
• 0x4665d4 GetDesktopWindow
• 0x4665d8 GetDCEx
• 0x4665dc GetDC
• 0x4665e0 GetCursorPos
• 0x4665e4 GetCursor
• 0x4665e8 GetClientRect
• 0x4665ec GetClassNameA
• 0x4665f0 GetClassInfoA
• 0x4665f4 GetCapture
• 0x4665f8 GetActiveWindow
• 0x4665fc FrameRect
• 0x466600 FindWindowA
• 0x466604 FillRect
• 0x466608 EqualRect
• 0x46660c EnumWindows
• 0x466610 EnumThreadWindows
• 0x466614 EndPaint
• 0x466618 EnableWindow
• 0x46661c EnableScrollBar
• 0x466620 EnableMenuItem
• 0x466624 DrawTextA
• 0x466628 DrawMenuBar
• 0x46662c DrawIconEx
• 0x466630 DrawIcon
• 0x466634 DrawFrameControl
• 0x466638 DrawEdge
• 0x46663c DispatchMessageA
• 0x466640 DestroyWindow
• 0x466644 DestroyMenu
• 0x466648 DestroyIcon
• 0x46664c DestroyCursor
• 0x466650 DeleteMenu
• 0x466654 DefWindowProcA
• 0x466658 DefMDIChildProcA
• 0x46665c DefFrameProcA
• 0x466660 CreatePopupMenu
• 0x466664 CreateMenu
• 0x466668 CreateIcon
• 0x46666c ClientToScreen
• 0x466670 CheckMenuItem
• 0x466674 CallWindowProcA
• 0x466678 CallNextHookEx
• 0x46667c BeginPaint
• 0x466680 CharNextA
• 0x466684 CharLowerA
• 0x466688 CharToOemA
• 0x46668c AdjustWindowRectEx
Library kernel32.dll:
• 0x466698 Sleep
Library oleaut32.dll:
• 0x4666a0 SafeArrayPtrOfIndex
• 0x4666a4 SafeArrayGetUBound
• 0x4666a8 SafeArrayGetLBound
• 0x4666ac SafeArrayCreate
• 0x4666b0 VariantChangeType
• 0x4666b4 VariantCopy
• 0x4666b8 VariantClear
• 0x4666bc VariantInit
Library ole32.dll:
• 0x4666c4 CoTaskMemAlloc
• 0x4666c8 CoCreateInstance
• 0x4666cc CoUninitialize
• 0x4666d0 CoInitialize
Library comctl32.dll:
• 0x4666e0 ImageList_Write
• 0x4666e4 ImageList_Read
• 0x4666f4 ImageList_DragMove
• 0x4666f8 ImageList_DragLeave
• 0x4666fc ImageList_DragEnter
• 0x466700 ImageList_EndDrag
• 0x466704 ImageList_BeginDrag
• 0x466708 ImageList_Remove
• 0x46670c ImageList_DrawEx
• 0x466710 ImageList_Draw
• 0x466720 ImageList_Add
• 0x466728 ImageList_Destroy
• 0x46672c ImageList_Create
• 0x466730 InitCommonControls
Library comdlg32.dll:
• 0x466738 GetSaveFileNameA
• 0x46673c GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.