popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Nfe03092021.exe

NPKI ASPack Malicious Library PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 11, 2021, 2:58 p.m. Sept. 11, 2021, 3:02 p.m.
Size 3.3MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 513f5b2b6d1a1ccd5d43d83ee1304a8a
SHA256 909224e3ab9525b7ec86a4f85a62fc9a928c791884865d8484a35ee6b086e6e8
CRC32 93A129DA
ssdeep 98304:YSGwVLvbGjUuxtYwWIUJSZbEb54H3ilzu/hgyrC:vGgg4wAM7HRY
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
uniderpfm.com.br
A 186.202.153.75
186.202.153.75
saggiodobrasil.com.br
A 45.33.8.134
45.33.8.134
ip-api.com
A 208.95.112.1
208.95.112.1
IP Address Status Action
185.215.113.84 Active Moloch
164.124.101.2 Active Moloch
186.202.153.75 Active Moloch
208.95.112.1 Active Moloch
45.33.8.134 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49204 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected
TCP 192.168.56.101:49203 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected
TCP 192.168.56.101:49206 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected
TCP 185.215.113.84:8888 -> 192.168.56.101:49211 2400024 ET DROP Spamhaus DROP Listed Traffic Inbound group 25 Misc Attack

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
section .itext
section .didata
section .debug
section .UPX0
section .UPX1
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x127ee TMethodImplementationIntercept-0x44396 1y7+0x2407e @ 0x42407e
TMethodImplementationIntercept+0x129a12 dbkFCallWrapperAddr-0x2f780a 1y7+0x191e26 @ 0x591e26
TMethodImplementationIntercept+0x61766 dbkFCallWrapperAddr-0x3bfab6 1y7+0xc9b7a @ 0x4c9b7a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
TMethodImplementationIntercept+0x1a3ce8 dbkFCallWrapperAddr-0x27d534 1y7+0x20c0fc @ 0x60c0fc

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636320
registers.edi: 0
registers.eax: 1636320
registers.ebp: 1636400
registers.edx: 0
registers.ebx: 4290228
registers.esi: 1636476
registers.ecx: 7
1 0 0
request GET http://uniderpfm.com.br/admin/Scripts/chrme.zip
request GET http://ip-api.com/json/
request GET http://saggiodobrasil.com.br/admin/pg-cadastros/news/users/drakedf/index.php
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72b62000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72962000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2664
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01640000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file C:\Users\test22\AppData\Local\Chromium\User Data\Local State
domain ip-api.com
file C:\Users\test22\AppData\Local\Temp\8z7n4w8w3h\chrme.exe
file C:\Users\test22\AppData\Local\Temp\8z7n4w8w3h\setup
file C:\Users\test22\AppData\Local\Temp\8z7n4w8w3h\chrme.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\\8z7n4w8w3h\1y7.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\8z7n4w8w3h\1y7.exe
1 1 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x000002a0
process_name: smss.exe
process_identifier: 224
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: csrss.exe
process_identifier: 300
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: csrss.exe
process_identifier: 364
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: winlogon.exe
process_identifier: 396
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: services.exe
process_identifier: 440
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: lsass.exe
process_identifier: 456
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: svchost.exe
process_identifier: 568
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: svchost.exe
process_identifier: 640
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: svchost.exe
process_identifier: 700
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: svchost.exe
process_identifier: 776
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: svchost.exe
process_identifier: 824
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: audiodg.exe
process_identifier: 892
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: svchost.exe
process_identifier: 968
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: svchost.exe
process_identifier: 264
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: svchost.exe
process_identifier: 292
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: svchost.exe
process_identifier: 1192
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: srvany.exe
process_identifier: 1244
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: taskhost.exe
process_identifier: 1284
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: KMService.exe
process_identifier: 1324
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: conhost.exe
process_identifier: 1376
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: sppsvc.exe
process_identifier: 1800
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: svchost.exe
process_identifier: 1876
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: dwm.exe
process_identifier: 1496
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: explorer.exe
process_identifier: 1848
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: WmiPrvSE.exe
process_identifier: 1916
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: pw.exe
process_identifier: 2816
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: SearchIndexer.exe
process_identifier: 2940
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: SearchProtocolHost.exe
process_identifier: 1480
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: SearchFilterHost.exe
process_identifier: 3040
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: pw.exe
process_identifier: 2684
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: taskhost.exe
process_identifier: 200
1 1 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: 1y7.exe
process_identifier: 2664
1 1 0
section {u'size_of_data': u'0x000b9e00', u'virtual_address': u'0x00001000', u'entropy': 7.936936432581836, u'name': u'.text', u'virtual_size': u'0x0020b3e8'} entropy 7.93693643258 description A section with a high entropy has been found
section {u'size_of_data': u'0x00001400', u'virtual_address': u'0x0020d000', u'entropy': 7.553227246981566, u'name': u'.itext', u'virtual_size': u'0x000026a8'} entropy 7.55322724698 description A section with a high entropy has been found
section {u'size_of_data': u'0x00006c00', u'virtual_address': u'0x00210000', u'entropy': 7.764924128648665, u'name': u'.data', u'virtual_size': u'0x0000c09c'} entropy 7.76492412865 description A section with a high entropy has been found
section {u'size_of_data': u'0x0001a600', u'virtual_address': u'0x0022c000', u'entropy': 7.873566603549974, u'name': u'.reloc', u'virtual_size': u'0x0002d9c0'} entropy 7.87356660355 description A section with a high entropy has been found
section {u'size_of_data': u'0x0001da00', u'virtual_address': u'0x0025a000', u'entropy': 6.806986328879017, u'name': u'.rsrc', u'virtual_size': u'0x0001da00'} entropy 6.80698632888 description A section with a high entropy has been found
section {u'size_of_data': u'0x001e1400', u'virtual_address': u'0x00278000', u'entropy': 7.834570304065888, u'name': u'.debug', u'virtual_size': u'0x007ee000'} entropy 7.83457030407 description A section with a high entropy has been found
entropy 0.86844840386 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x000002a0
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002a0
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002c8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002c8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002c8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002d8
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002f0
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002f0
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002f0
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002f0
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002f0
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002f0
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002f0
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002f0
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002f0
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002f0
process_name: 1y7.exe
process_identifier: 2664
0 0

Process32NextW

 snapshot_handle: 0x000002f0
process_name: 1y7.exe
process_identifier: 2664
0 0
host 185.215.113.84
file \??\NTICE
Time & API Arguments Status Return Repeated

FindWindowA

 class_name: OLLYDBG
window_name:
0 0

FindWindowA

 class_name: FileMonClass
window_name:
0 0

FindWindowA

 class_name: FileMonClass
window_name:
0 0
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Operating System ® Temp reg_value C:\Users\test22\AppData\Local\FlashPlayer\atagasemil\X9q6.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\Microsoft Windows Operating System ® reg_value C:\Users\test22\AppData\Local\FlashPlayer\atagasemil\X9q6.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Operating System ® reg_value C:\Users\test22\Documents\FlashPlayer\atagasemil\D9b6.exe
registry HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
Bkav W32.AIDetect.malware2
Lionic Trojan.Win32.Snojan.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.37547600
ALYac Trojan.GenericKD.37547600
K7AntiVirus Trojan ( 00581ef41 )
Alibaba Trojan:Win32/Snojan.4599c3d3
K7GW Trojan ( 00581ef41 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Generic.D23CEE50
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/GenKryptik.FKAJ
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan.Win32.Snojan.gen
BitDefender Trojan.GenericKD.37547600
NANO-Antivirus Trojan.Win32.Snojan.jaixxr
Tencent Win32.Trojan.Genkryptik.Sshb
Ad-Aware Trojan.GenericKD.37547600
Sophos Mal/Generic-S
DrWeb Trojan.Siggen15.13733
McAfee-GW-Edition Artemis!Trojan
FireEye Generic.mg.513f5b2b6d1a1ccd
Emsisoft Trojan.GenericKD.37547600 (B)
Ikarus Trojan-Downloader.Win32.Banload
Webroot W32.Trojan.Gen
Avira TR/Crypt.XPACK.Gen
Antiy-AVL Trojan/Generic.ASMalwS.34956CB
Kingsoft Win32.Heur.KVM007.a.(kcloud)
Microsoft Trojan:Win32/Emotet!ml
GData Win32.Trojan.Agent.N5DEDD
Cynet Malicious (score: 99)
AhnLab-V3 Trojan/Win.MalwareX-gen.C4625205
McAfee Artemis!513F5B2B6D1A
MAX malware (ai score=81)
VBA32 Trojan.Snojan
Cylance Unsafe
Panda Trj/Genetic.gen
Rising Worm.VBInjectEx!1.99E6 (CLASSIC)
SentinelOne Static AI - Suspicious PE
MaxSecure Virus.Nimnul.E
Fortinet PossibleThreat.PALLASNET.H
BitDefenderTheta Gen:NN.ZexaF.34142.s70@aC9C5zii
AVG Win32:MalwareX-gen [Trj]
Avast Win32:MalwareX-gen [Trj]