popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

umbr.exe

AsyncRAT Process Kill Generic Malware CryptGenKey Malicious Packer FindFirstVolume ScreenShot Http API Steal credential AntiDebug .NET EXE PE File Device_File_Check OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 25, 2021, 12:14 a.m. June 25, 2021, 12:17 a.m.
Size 846.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f9d986194bfbc6d9e56e62a7e6f3f1f7
SHA256 8eb065a0ab7b4771f2fb1ec4264cd0c1505a948b358e200b46ce5e540fcbdbf5
CRC32 E25F4CE6
ssdeep 24576:FAHnh+eWsN3skA4RV1Hom2KXMmHa5Gl5:0h+ZkldoPK8Ya5E
Yara
  • PE_Header_Zero - PE File Signature
  • CryptGenKey_Zero - CryptGenKey Zero
  • OS_Processor_Check_Zero - OS Processor Check
  • Device_Check_Zero - Device Check Zero
  • IsPE32 - (no description)
  • FindFirstVolume_Zero - FindFirstVolume Zero
  • Process_Snapshot_Kill_Zero - Process Kill Zero

Name Response Post-Analysis Lookup
newja.webtm.ru
A 92.53.96.150
92.53.96.150
t.me
A 149.154.167.99
149.154.167.99
IP Address Status Action
149.154.167.99 Active Moloch
164.124.101.2 Active Moloch
92.53.96.150 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49197 -> 92.53.96.150:80 2008350 ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile Potential Corporate Privacy Violation
TCP 192.168.56.101:49197 -> 92.53.96.150:80 2027360 ET INFO AutoIt User-Agent Downloading ZIP A Network Trojan was detected
TCP 149.154.167.99:443 -> 192.168.56.101:49222 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49207 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 149.154.167.99:443 -> 192.168.56.101:49229 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 149.154.167.99:443 -> 192.168.56.101:49208 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 149.154.167.99:443 -> 192.168.56.101:49210 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49209 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49231 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 149.154.167.99:443 -> 192.168.56.101:49232 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 149.154.167.99:443 -> 192.168.56.101:49234 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49239 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49211 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 149.154.167.99:443 -> 192.168.56.101:49212 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49213 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 149.154.167.99:443 -> 192.168.56.101:49218 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 149.154.167.99:443 -> 192.168.56.101:49220 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49235 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49215 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 149.154.167.99:443 -> 192.168.56.101:49214 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 149.154.167.99:443 -> 192.168.56.101:49216 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49217 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49219 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49221 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 149.154.167.99:443 -> 192.168.56.101:49224 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 149.154.167.99:443 -> 192.168.56.101:49227 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49228 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49233 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 149.154.167.99:443 -> 192.168.56.101:49236 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 149.154.167.99:443 -> 192.168.56.101:49240 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49223 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49225 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49237 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 149.154.167.99:443 -> 192.168.56.101:49238 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x001e2790
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x001e2690
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x001e2690
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x001e2750
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x001e2750
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x001e2750
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 11926256
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0

__exception__

 stacktrace: 
LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x757a31df
_CallPattern@8+0x488 run+0x7f468 @ 0x47f468
_CallPattern@8+0x13f6 run+0x803d6 @ 0x4803d6
_CallPattern@8-0x7da3a run+0x15a6 @ 0x4015a6
_CallPattern@8-0x7dbb1 run+0x142f @ 0x40142f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84
exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 425151
exception.address: 0x77407cbf
registers.esp: 1627912
registers.edi: 11403264
registers.eax: 4294967288
registers.ebp: 1627964
registers.edx: 998
registers.ebx: 0
registers.esi: 0
registers.ecx: 2760
1 0 0
request GET http://newja.webtm.ru/mad.zip
domain newja.webtm.ru description Russian Federation domain TLD
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2416
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72b62000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2416
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03480000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 668
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 409600
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00afc000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00560000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00690000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70561000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70562000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 1376256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00be0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00cf0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00522000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00565000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0056b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00567000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a80000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00547000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00546000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a81000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bef000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00be0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a82000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a85000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a86000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a87000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a8a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a8b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00be1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a8c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a8d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00de0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00de1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00be2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00de4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00be3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13722066944
free_bytes_available: 13722066944
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0
file C:\Users\Public\run2.exe
file C:\Users\Public\run.exe
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Match Windows Http API call rule Str_Win32_Http_API
description Steal credential rule local_credential_Steal
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2764
region_size: 598016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000023c
1 0 0
Process injection Process 1632 called NtSetContextThread to modify thread in remote process 2764
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 2948452
registers.edi: 0
registers.eax: 4447365
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000238
process_identifier: 2764
1 0 0
Process injection Process 1632 resumed a thread in remote process 2764
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000238
suspend_count: 1
process_identifier: 2764
1 0 0
Time & API Arguments Status Return Repeated

__anomaly__

 tid: 2760
message: Encountered 65537 exceptions, quitting.
subcategory: exception
function_name:
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 872
thread_handle: 0x00000258
process_identifier: 3024
current_directory:
filepath: C:\Windows\System32\rundll32.exe
track: 1
command_line: "C:\Windows\system32\rundll32.exe" "C:\Windows\syswow64\WININET.dll",DispatchAPICall 1
filepath_r: C:\Windows\system32\rundll32.exe
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 0
process_handle: 0x0000025c
1 1 0

CreateProcessInternalW

 thread_identifier: 2760
thread_handle: 0x00000464
process_identifier: 668
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: C:\Users\Public\run.exe
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 0
process_handle: 0x0000045c
1 1 0

CreateProcessInternalW

 thread_identifier: 2772
thread_handle: 0x0000045c
process_identifier: 1632
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: C:\Users\Public\run2.exe
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 0
process_handle: 0x00000464
1 1 0

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1632
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 1632
1 0 0

NtResumeThread

 thread_handle: 0x00000198
suspend_count: 1
process_identifier: 1632
1 0 0

CreateProcessInternalW

 thread_identifier: 2300
thread_handle: 0x00000238
process_identifier: 2764
current_directory: C:\Users\Public
filepath:
track: 1
command_line: C:\Users\Public\run2.exe
filepath_r:
stack_pivoted: 0
creation_flags: 134217740 (CREATE_NO_WINDOW|CREATE_SUSPENDED|DETACHED_PROCESS)
inherit_handles: 0
process_handle: 0x0000023c
1 1 0

NtUnmapViewOfSection

 base_address: 0x00400000
region_size: 15532032
process_identifier: 2764
process_handle: 0x0000023c
3221225497 0

NtAllocateVirtualMemory

 process_identifier: 2764
region_size: 598016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000023c
1 0 0

NtGetContextThread

 thread_handle: 0x00000238
1 0 0

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 2948452
registers.edi: 0
registers.eax: 4447365
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000238
process_identifier: 2764
1 0 0

NtResumeThread

 thread_handle: 0x00000238
suspend_count: 1
process_identifier: 2764
1 0 0

NtResumeThread

 thread_handle: 0x00000144
suspend_count: 1
process_identifier: 2764
1 0 0