Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 3, 2021, 9:22 a.m.	Nov. 3, 2021, 9:41 a.m.

Size	918.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`857f6017b36866f5e47a835608b6377c`
SHA256	`214dc633d8cda71fa724675e530ef5e8b554389ee07268d4bcc54d44c6b1cc81`
CRC32	`DA61892F`
ssdeep	`6144:xZEcZy5taWXTZBSG5fB/i/goaOeD32RFbLCdF9ae8FvSxUjewQhM4kqlPyn+yP3:P857TZBpL5jeFWFQeYjdGdkAPyB`
Yara	Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

cc.exe "C:\Users\test22\AppData\Local\Temp\cc.exe"
2772
- cc.exe C:\Users\test22\AppData\Local\Temp\cc.exe
  2988
  - schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\test22\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"
    3060

Name	Response	Post-Analysis Lookup
www.uplooder.net	A 144.76.38.100	144.76.38.100

IP Address	Status	Action
144.76.38.100	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49167 -> 144.76.38.100:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49165 -> 144.76.38.100:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49164 -> 144.76.38.100:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49166 -> 144.76.38.100:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49165 144.76.38.100:443	None	None	None
TLSv1 192.168.56.101:49167 144.76.38.100:443	None	None	None
TLSv1 192.168.56.101:49164 144.76.38.100:443	C=LV, L=Riga, O=GoGetSSL, CN=GoGetSSL RSA DV CA	CN=uplooder.net	67:23:3c:78:6f:10:f5:cc:c5:99:7f:a1:9d:c7:92:e8:75:7d:d3:00
TLSv1 192.168.56.101:49166 144.76.38.100:443	None	None	None

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Nov. 3, 2021, 9:22 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Nov. 3, 2021, 9:22 a.m.	buffer: SUCCESS: The scheduled task "Azure-Update-Task" has successfully been created. console_handle: 0x00000007	1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (50 out of 124 events)

Time & API	Arguments	Status
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7768199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7768193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633124 registers.edi: 1633212 registers.eax: 23117 registers.ebp: 1633184 registers.edx: 0 registers.ebx: 0 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7769af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1632976 registers.edi: 1633072 registers.eax: 23117 registers.ebp: 1633036 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003311104	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7769ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7769af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633108 registers.edi: 1633196 registers.eax: 23117 registers.ebp: 1633168 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633232 registers.edi: 1633328 registers.eax: 23117 registers.ebp: 1633292 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003414528	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7768199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7768193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633124 registers.edi: 1633212 registers.eax: 23117 registers.ebp: 1633184 registers.edx: 0 registers.ebx: 0 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7769af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1632976 registers.edi: 1633072 registers.eax: 23117 registers.ebp: 1633036 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003311104	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7769ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7769af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633108 registers.edi: 1633196 registers.eax: 23117 registers.ebp: 1633168 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633232 registers.edi: 1633328 registers.eax: 23117 registers.ebp: 1633292 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003414528	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7768199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7768193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633124 registers.edi: 1633212 registers.eax: 23117 registers.ebp: 1633184 registers.edx: 0 registers.ebx: 0 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7769af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1632976 registers.edi: 1633072 registers.eax: 23117 registers.ebp: 1633036 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003311104	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7769ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7769af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633108 registers.edi: 1633196 registers.eax: 23117 registers.ebp: 1633168 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633232 registers.edi: 1633328 registers.eax: 23117 registers.ebp: 1633292 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003414528	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7768199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7768193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633124 registers.edi: 1633212 registers.eax: 23117 registers.ebp: 1633184 registers.edx: 0 registers.ebx: 0 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7769af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1632976 registers.edi: 1633072 registers.eax: 23117 registers.ebp: 1633036 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003311104	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7769ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7769af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633108 registers.edi: 1633196 registers.eax: 23117 registers.ebp: 1633168 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633232 registers.edi: 1633328 registers.eax: 23117 registers.ebp: 1633292 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003414528	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7768199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7768193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633124 registers.edi: 1633212 registers.eax: 23117 registers.ebp: 1633184 registers.edx: 0 registers.ebx: 0 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7769af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1632976 registers.edi: 1633072 registers.eax: 23117 registers.ebp: 1633036 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003311104	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7769ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7769af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633108 registers.edi: 1633196 registers.eax: 23117 registers.ebp: 1633168 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633232 registers.edi: 1633328 registers.eax: 23117 registers.ebp: 1633292 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003414528	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7768199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7768193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633124 registers.edi: 1633212 registers.eax: 23117 registers.ebp: 1633184 registers.edx: 0 registers.ebx: 0 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7769af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1632976 registers.edi: 1633072 registers.eax: 23117 registers.ebp: 1633036 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003311104	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7769ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7769af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633108 registers.edi: 1633196 registers.eax: 23117 registers.ebp: 1633168 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633232 registers.edi: 1633328 registers.eax: 23117 registers.ebp: 1633292 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003414528	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7768199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7768193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633124 registers.edi: 1633212 registers.eax: 23117 registers.ebp: 1633184 registers.edx: 0 registers.ebx: 0 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7769af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1632976 registers.edi: 1633072 registers.eax: 23117 registers.ebp: 1633036 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003311104	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7769ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7769af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633108 registers.edi: 1633196 registers.eax: 23117 registers.ebp: 1633168 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633232 registers.edi: 1633328 registers.eax: 23117 registers.ebp: 1633292 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003414528	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7768199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7768193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633124 registers.edi: 1633212 registers.eax: 23117 registers.ebp: 1633184 registers.edx: 0 registers.ebx: 0 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7769af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1632976 registers.edi: 1633072 registers.eax: 23117 registers.ebp: 1633036 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003311104	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7769ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7769af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633108 registers.edi: 1633196 registers.eax: 23117 registers.ebp: 1633168 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633232 registers.edi: 1633328 registers.eax: 23117 registers.ebp: 1633292 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003414528	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7768199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7768193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633124 registers.edi: 1633212 registers.eax: 23117 registers.ebp: 1633184 registers.edx: 0 registers.ebx: 0 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7769af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1632976 registers.edi: 1633072 registers.eax: 23117 registers.ebp: 1633036 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003311104	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7769ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7769af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633108 registers.edi: 1633196 registers.eax: 23117 registers.ebp: 1633168 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633232 registers.edi: 1633328 registers.eax: 23117 registers.ebp: 1633292 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003414528	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7768199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7768193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633124 registers.edi: 1633212 registers.eax: 23117 registers.ebp: 1633184 registers.edx: 0 registers.ebx: 0 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7769af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1632976 registers.edi: 1633072 registers.eax: 23117 registers.ebp: 1633036 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003311104	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7769ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7769af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633108 registers.edi: 1633196 registers.eax: 23117 registers.ebp: 1633168 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633232 registers.edi: 1633328 registers.eax: 23117 registers.ebp: 1633292 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003414528	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7768199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7768193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633124 registers.edi: 1633212 registers.eax: 23117 registers.ebp: 1633184 registers.edx: 0 registers.ebx: 0 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7769af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1632976 registers.edi: 1633072 registers.eax: 23117 registers.ebp: 1633036 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003311104	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7769ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7769af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633108 registers.edi: 1633196 registers.eax: 23117 registers.ebp: 1633168 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633232 registers.edi: 1633328 registers.eax: 23117 registers.ebp: 1633292 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003414528	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7768199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7768193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633124 registers.edi: 1633212 registers.eax: 23117 registers.ebp: 1633184 registers.edx: 0 registers.ebx: 0 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7769af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1632976 registers.edi: 1633072 registers.eax: 23117 registers.ebp: 1633036 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003311104	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7769ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7769af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633108 registers.edi: 1633196 registers.eax: 23117 registers.ebp: 1633168 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633232 registers.edi: 1633328 registers.eax: 23117 registers.ebp: 1633292 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003414528	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7767317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7768199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7768193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1633124 registers.edi: 1633212 registers.eax: 23117 registers.ebp: 1633184 registers.edx: 0 registers.ebx: 0 registers.esi: 9502720 registers.ecx: 1633024	1
__exception__ Nov. 3, 2021, 9:22 a.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7766f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7766f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7768176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7769af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x776818ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7768174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77683e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x760d3b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x76bedb3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x73eb7322 0x9160e3 0x914117 0x914204 cc+0x569bd @ 0x4569bd cc+0x5746b @ 0x45746b cc+0x4593 @ 0x404593 cc+0x45fb @ 0x4045fb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7766f4ef registers.esp: 1632976 registers.edi: 1633072 registers.eax: 23117 registers.ebp: 1633036 registers.edx: 0 registers.ebx: 9502720 registers.esi: 9502720 registers.ecx: 2003311104	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (2 events)

request	GET https://www.uplooder.net/img/image/71/fb4a19c040a5764f8d73a20bd7705d29/Cehxkrvbbleohgccenheflltcmheyvq.bmp%%
request	GET https://www.uplooder.net/img/image/71/fb4a19c040a5764f8d73a20bd7705d29/Cehxkrvbbleohgccenheflltcmheyvq.bmp

Allocates read-write-execute memory (usually to unpack itself) (7 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Nov. 3, 2021, 9:22 a.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Nov. 3, 2021, 9:22 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d32000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Nov. 3, 2021, 9:22 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Nov. 3, 2021, 9:22 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Nov. 3, 2021, 9:22 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04545060 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory Nov. 3, 2021, 9:22 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Nov. 3, 2021, 9:22 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04545060 process_handle: 0xffffffff		3221225477

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Nov. 3, 2021, 9:22 a.m.	thread_identifier: 3064 thread_handle: 0x000000ac process_identifier: 3060 current_directory: filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\test22\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000000b0	1	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 3, 2021, 9:22 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 81920 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00911000 process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (10 events)

description	task schedule	rule	schtasks_Zero
description	[m] Generic Malware	rule	Generic_Malware_Zero_m
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\test22\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 3b68be87442aae16607ba8bc7a67ef8c9396b668

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Nov. 3, 2021, 9:22 a.m.	process_identifier: 2988 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000022c	1	0	0

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Nov. 3, 2021, 9:22 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2988 process_handle: 0x0000022c	1	1	0

Network activity contains more than one unique useragent (2 events)

process	cc.exe				useragent	lVali
process	cc.exe				useragent	aswe

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2772 called NtSetContextThread to modify thread in remote process 2988
NtSetContextThread Nov. 3, 2021, 9:22 a.m.	registers.eip: 2003108292 registers.esp: 1638384 registers.edi: 0 registers.eax: 4202539 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000230 process_identifier: 2988	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2772 resumed a thread in remote process 2988
NtResumeThread Nov. 3, 2021, 9:22 a.m.	thread_handle: 0x00000230 suspend_count: 1 process_identifier: 2988	1	0	0

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

McAfee	GenericRXAA-AA!857F6017B368
Sangfor	Virus.Win32.Save.a
Cybereason	malicious.d2ea1f
Cyren	W32/Trojan.IZIA-3552
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.EQKY
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	FileRepMalware
Rising	Trojan.Generic@ML.88 (RDML:nYi5Hh8Ck6/CKjWNTULY7w)
DrWeb	Trojan.Siggen15.33772
McAfee-GW-Edition	BehavesLike.Win32.Dropper.dh
SentinelOne	Static AI - Suspicious PE
Microsoft	Behavior:Win32/CreateFileMimilibDll.A
AhnLab-V3	Trojan/Win.Tnega.C4750053
VBA32	BScope.TrojanSpy.Noon
Ikarus	Backdoor.Rat.Remcos
eGambit	Unsafe.AI_Score_100%
Fortinet	W32/Delf.DCB!tr
BitDefenderTheta	Gen:NN.ZelphiCO.34236.5GW@amrcUrbi
AVG	FileRepMalware
MaxSecure	Trojan.Malware.300983.susgen

Executed a process and injected code into it, probably while unpacking (9 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Nov. 3, 2021, 9:22 a.m.	thread_identifier: 2992 thread_handle: 0x00000230 process_identifier: 2988 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\cc.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000022c	1	1
NtGetContextThread Nov. 3, 2021, 9:22 a.m.	thread_handle: 0x00000230	1	0
NtUnmapViewOfSection Nov. 3, 2021, 9:22 a.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2988 process_handle: 0x0000022c	1	0
NtAllocateVirtualMemory Nov. 3, 2021, 9:22 a.m.	process_identifier: 2988 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000022c	1	0
WriteProcessMemory Nov. 3, 2021, 9:22 a.m.	buffer: base_address: 0x00400000 process_identifier: 2988 process_handle: 0x0000022c	1	1
WriteProcessMemory Nov. 3, 2021, 9:22 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2988 process_handle: 0x0000022c	1	1
NtSetContextThread Nov. 3, 2021, 9:22 a.m.	registers.eip: 2003108292 registers.esp: 1638384 registers.edi: 0 registers.eax: 4202539 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000230 process_identifier: 2988	1	0
NtResumeThread Nov. 3, 2021, 9:22 a.m.	thread_handle: 0x00000230 suspend_count: 1 process_identifier: 2988	1	0
CreateProcessInternalW Nov. 3, 2021, 9:22 a.m.	thread_identifier: 3064 thread_handle: 0x000000ac process_identifier: 3060 current_directory: filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\test22\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000000b0	1	1

cc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All