Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 31, 2021, 9:13 a.m.	May 31, 2021, 9:16 a.m.

Size	344.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`05b5c49112ebf3d93b737c5540a28faa`
SHA256	`54011d537926ffde4721d13e1f10e7ed062ae86bac18ab57747ae134dc8b8cec`
CRC32	`E3FF079F`
ssdeep	`6144:xq4leUSUDy5oCx3VoQPFWUeer+zDMARFNpHwEYW6XhV0Ymf:xqcDy5oCxFooWUec+zD7NpGxTq`
PDB Path	C:\socabicokefe2.pdb
Yara	Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check Generic_Malware_Zero - Generic Malware IsPE32 - (no description)

bmw1.exe "C:\Users\test22\AppData\Local\Temp\bmw1.exe"
8024

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

C:\socabicokefe2.pdb

The file contains an unknown PE resource name possibly indicative of a packer (2 events)

resource name	BUKOKOVOTOSO
resource name	NOCOZOLUKUSIDIGE

One or more processes crashed (50 out of 65536 events)

Time & API	Arguments	Status
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 4131 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1
__exception__ May 31, 2021, 9:13 a.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 bmw1+0x25707 @ 0x425707 bmw1+0x266a6 @ 0x4266a6 bmw1+0x63f2 @ 0x4063f2 bmw1+0x629f @ 0x40629f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1630732 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1630784 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 5032	1

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 31, 2021, 9:13 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 36864 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057c000 process_handle: 0xffffffff	1	0	0

Foreign language identified in PE resource (50 out of 82 events)

name

BUKOKOVOTOSO

language

LANG_SERBIAN

filetype

ASCII text, with very long lines, with no line terminators

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x000592e0

size

0x000006f0

name

BUKOKOVOTOSO

language

LANG_SERBIAN

filetype

ASCII text, with very long lines, with no line terminators

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x000592e0

size

0x000006f0

name

NOCOZOLUKUSIDIGE

language

LANG_SERBIAN

filetype

ASCII text, with very long lines, with no line terminators

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x000599d0

size

0x0000127b

name

NOCOZOLUKUSIDIGE

language

LANG_SERBIAN

filetype

ASCII text, with very long lines, with no line terminators

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x000599d0

size

0x0000127b

name

RT_CURSOR

language

LANG_SERBIAN

filetype

dBase III DBT, version number 0, next free block index 40

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x0005b008

size

0x000010a8

name

RT_CURSOR

language

LANG_SERBIAN

filetype

dBase III DBT, version number 0, next free block index 40

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x0005b008

size

0x000010a8

name

RT_CURSOR

language

LANG_SERBIAN

filetype

dBase III DBT, version number 0, next free block index 40

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x0005b008

size

0x000010a8

name

RT_CURSOR

language

LANG_SERBIAN

filetype

dBase III DBT, version number 0, next free block index 40

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x0005b008

size

0x000010a8

name

RT_CURSOR

language

LANG_SERBIAN

filetype

dBase III DBT, version number 0, next free block index 40

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x0005b008

size

0x000010a8

name

RT_CURSOR

language

LANG_SERBIAN

filetype

dBase III DBT, version number 0, next free block index 40

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x0005b008

size

0x000010a8

name

RT_CURSOR

language

LANG_SERBIAN

filetype

dBase III DBT, version number 0, next free block index 40

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x0005b008

size

0x000010a8

name

RT_CURSOR

language

LANG_SERBIAN

filetype

dBase III DBT, version number 0, next free block index 40

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x0005b008

size

0x000010a8

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_ARABIC_TUNISIA

offset

0x00058e18

size

0x00000468

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0002d800', u'virtual_address': u'0x00001000', u'entropy': 6.803682398635164, u'name': u'.text', u'virtual_size': u'0x0002d7c1'}

entropy

6.80368239864

description

A section with a high entropy has been found

entropy

0.529839883552

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Tries to unhook Windows functions monitored by Cuckoo (1 event)

Time & API	Arguments	Status	Return	Repeated
__anomaly__ May 31, 2021, 9:14 a.m.	tid: 5032 message: Encountered 65537 exceptions, quitting. subcategory: exception function_name:	1	0	0

bmw1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All