Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 22, 2021, 9:30 a.m.	Oct. 22, 2021, 9:40 a.m.

Size	973.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`efe651adf6dfc657dfe4d65434e2de5c`
SHA256	`5669a61c8828077f2fae98db6f109c7b864109e5b273a9d4e6600335ce051f9b`
CRC32	`DEC30E87`
ssdeep	`12288:fDug7DeIhyEzPsO4z+oxMOQWHphA3hHx8rkRZQ9XYBk9NAOe6k1+hO/O5N8DoQTK:rt7JhyEz0O4z+OQK79HHQT2ODA`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
2232

Name	Response	Post-Analysis Lookup
login.live.com	A 40.126.16.163 A 20.190.144.164 CNAME www.tm.a.prd.aadg.trafficmanager.net CNAME login.msa.msidentity.com CNAME www.tm.lg.prod.aadmsa.trafficmanager.net A 20.190.144.161 A 20.190.144.160 A 40.126.16.165 A 20.190.144.163 CNAME prda.aadg.msidentity.com A 20.190.144.166 A 40.126.16.166	20.190.163.20
onedrive.live.com	CNAME odc-web-geo.onedrive.akadns.net CNAME l-0004.l-msedge.net A 13.107.42.13 CNAME odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net CNAME odc-web-brs.onedrive.akadns.net	13.107.42.13

IP Address	Status	Action
13.107.42.13	Active	Moloch
164.124.101.2	Active	Moloch
40.126.16.163	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49203 -> 40.126.16.163:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49201 -> 13.107.42.13:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49202 -> 40.126.16.163:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49203 40.126.16.163:443	C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA	C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=graph.windows.net	73:7d:2b:8b:14:fd:d9:03:14:62:2e:35:a7:c1:54:33:e0:8b:3b:71
TLSv1 192.168.56.101:49201 13.107.42.13:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	CN=onedrive.com	50:2f:33:10:92:ac:27:7b:17:be:82:68:3b:e2:29:ad:97:41:b7:bb
TLSv1 192.168.56.101:49202 40.126.16.163:443	C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA	C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=graph.windows.net	73:7d:2b:8b:14:fd:d9:03:14:62:2e:35:a7:c1:54:33:e0:8b:3b:71

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (50 out of 125 events)

Time & API	Arguments	Status
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000558592	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000662016	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000558592	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000662016	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000558592	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000662016	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000558592	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000662016	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000558592	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000662016	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000558592	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000662016	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000558592	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000662016	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000558592	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000662016	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000558592	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000662016	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000558592	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000662016	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000558592	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000662016	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000558592	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x773fada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x773faf78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000662016	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x773d317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x773e199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x773e193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 9:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x773cf5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x773cf560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x773e176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x773faf21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x773e18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x773e174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x773e3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76a83b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x755bdb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x72bf7322 0x1fd60e3 0x1fd4117 0x1fd4204 vbc+0x528a7 @ 0x4528a7 vbc+0x532a9 @ 0x4532a9 vbc+0x546f6 @ 0x4546f6 vbc+0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x773cf4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2000558592	1

Performs some HTTP requests (2 events)

request	GET https://onedrive.live.com/download?cid=1836E41CA02A0786&resid=1836E41CA02A0786%21127&authkey=AOx84Mv6sv3iPME
request	GET https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1634863115&rver=7.3.6962.0&wp=MBI_SSL_SHARED&wreply=https:%2F%2Fonedrive.live.com%2Fdownload%3Fcid%3D1836E41CA02A0786%26resid%3D1836E41CA02A0786%2521127%26authkey%3DAOx84Mv6sv3iPME&lc=1033&id=250206&cbcxt=sky&cbcxt=sky

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory Oct. 22, 2021, 9:30 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cc2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 22, 2021, 9:30 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00540000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 22, 2021, 9:30 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 22, 2021, 9:31 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 22, 2021, 9:30 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 81920 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x01fd1000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00090800', u'virtual_address': u'0x00055000', u'entropy': 7.0861796827582255, u'name': u'.data', u'virtual_size': u'0x000907f4'}

entropy

7.08617968276

description

A section with a high entropy has been found

entropy

0.594650205761

description

Overall entropy of this PE file is high

Network activity contains more than one unique useragent (2 events)

process	vbc.exe				useragent	lVali
process	vbc.exe				useragent	aswe

File has been identified by 28 AntiVirus engines on VirusTotal as malicious (28 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.404380
FireEye	Generic.mg.efe651adf6dfc657
Cyren	W32/Delf_Troj.CQ.gen!Eldorado
ESET-NOD32	a variant of Win32/Kryptik.HNAH
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Downloader.Win32.Formbook.gen
BitDefender	Gen:Variant.Zusy.404380
Avast	Win32:MalwareX-gen [Trj]
Ad-Aware	Gen:Variant.Zusy.404380
Sophos	ML/PE-A
DrWeb	Trojan.DownLoader43.48586
McAfee-GW-Edition	BehavesLike.Win32.AdwareDealPly.dc
Ikarus	Trojan.Inject
Microsoft	Trojan:Script/Phonzy.B!ml
ZoneAlarm	HEUR:Trojan-Downloader.Win32.Formbook.gen
GData	Gen:Variant.Zusy.404380
Cynet	Malicious (score: 100)
McAfee	RDN/Generic.grp
MAX	malware (ai score=85)
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Injector.EQAC!tr
BitDefenderTheta	Gen:NN.ZelphiCO.34236.8KW@aCXAGQmi
AVG	Win32:MalwareX-gen [Trj]
Cybereason	malicious.3b0526
MaxSecure	Trojan.Malware.300983.susgen

vbc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All