Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 8, 2022, 6:24 p.m.	March 8, 2022, 6:26 p.m.

Size	816.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`f8f330f74629761c4d97721eb333ac38`
SHA256	`b9ed36a21e09ff33bef163a4b8f5f041bcc51ef24b12b66e4192a3dc529ba5f5`
CRC32	`A34C2474`
ssdeep	`12288:F9udXq5lwIfJhsVoyv6g2ddE8mgPJP89Q+zl/RRIlRfk:zudXehgWT4gPNmQ+hs7f`
Yara	PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file IsPE32 - (no description)

vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
2336

Name	Response	Post-Analysis Lookup
www.sagedermatology.com	A 198.185.159.144	198.185.159.144
www.xn--laufgefhl-w9a.com	CNAME xn--laufgefhl-w9a.com A 81.169.145.80	81.169.145.80
www.sutnsdmxq.icu	A 107.161.23.204 A 198.251.84.92 A 70.39.125.244 A 45.58.190.82 A 64.32.22.102 A 198.251.81.30 A 204.188.203.155 A 209.141.38.71 A 192.161.187.200 CNAME parking.namesilo.com A 168.235.88.209	198.251.81.30
www.servos-sandbox.com
www.eskomed.store	A 87.236.16.206	87.236.16.206
www.chegocheck.com	A 37.48.65.153	81.171.22.7
www.oneowneronly.com	A 154.196.11.183	154.196.11.183
www.padisarealtygroup.com	CNAME padisarealtygroup.com A 142.44.146.49	142.44.146.49
www.extremeentertainmentgroup.com	CNAME gcdn0.wixdns.net A 34.117.168.233 CNAME td-ccm-168-233.wixdns.net	34.117.168.233
www.glowestudiocreativo.com	A 185.156.219.142 CNAME glowestudiocreativo.com	185.156.219.142
www.loneli.biz
www.sailorswife.online
bondbuild.com.sg	A 101.100.211.101	101.100.211.101

IP Address	Status	Action
101.100.211.101	Active	Moloch
142.44.146.49	Active	Moloch
154.196.11.183	Active	Moloch
164.124.101.2	Active	Moloch
185.156.219.142	Active	Moloch
198.185.159.144	Active	Moloch
198.251.84.92	Active	Moloch
34.117.168.233	Active	Moloch
37.48.65.153	Active	Moloch
81.169.145.80	Active	Moloch
87.236.16.206	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:51935 -> 164.124.101.2:53	2026888	ET INFO DNS Query for Suspicious .icu Domain	Potentially Bad Traffic
UDP 192.168.56.103:51084 -> 164.124.101.2:53	2027863	ET INFO Observed DNS Query to .biz TLD	Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 87.236.16.206:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 87.236.16.206:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 87.236.16.206:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 142.44.146.49:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 142.44.146.49:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 142.44.146.49:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 198.185.159.144:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 198.185.159.144:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 198.185.159.144:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 81.169.145.80:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 81.169.145.80:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 81.169.145.80:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 185.156.219.142:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 185.156.219.142:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 185.156.219.142:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 37.48.65.153:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 37.48.65.153:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 37.48.65.153:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 34.117.168.233:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 34.117.168.233:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 34.117.168.233:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 154.196.11.183:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 154.196.11.183:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 154.196.11.183:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 198.251.84.92:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 198.251.84.92:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 198.251.84.92:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (50 out of 124 events)

Time & API	Arguments	Status
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x772f199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x772f193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633012 registers.edi: 1633100 registers.eax: 23117 registers.ebp: 1633072 registers.edx: 0 registers.ebx: 0 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7730af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632864 registers.edi: 1632960 registers.eax: 23117 registers.ebp: 1632924 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999575552	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7730ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7730af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632996 registers.edi: 1633084 registers.eax: 23117 registers.ebp: 1633056 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633120 registers.edi: 1633216 registers.eax: 23117 registers.ebp: 1633180 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999678976	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x772f199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x772f193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633012 registers.edi: 1633100 registers.eax: 23117 registers.ebp: 1633072 registers.edx: 0 registers.ebx: 0 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7730af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632864 registers.edi: 1632960 registers.eax: 23117 registers.ebp: 1632924 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999575552	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7730ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7730af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632996 registers.edi: 1633084 registers.eax: 23117 registers.ebp: 1633056 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633120 registers.edi: 1633216 registers.eax: 23117 registers.ebp: 1633180 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999678976	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x772f199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x772f193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633012 registers.edi: 1633100 registers.eax: 23117 registers.ebp: 1633072 registers.edx: 0 registers.ebx: 0 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7730af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632864 registers.edi: 1632960 registers.eax: 23117 registers.ebp: 1632924 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999575552	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7730ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7730af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632996 registers.edi: 1633084 registers.eax: 23117 registers.ebp: 1633056 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633120 registers.edi: 1633216 registers.eax: 23117 registers.ebp: 1633180 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999678976	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x772f199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x772f193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633012 registers.edi: 1633100 registers.eax: 23117 registers.ebp: 1633072 registers.edx: 0 registers.ebx: 0 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7730af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632864 registers.edi: 1632960 registers.eax: 23117 registers.ebp: 1632924 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999575552	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7730ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7730af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632996 registers.edi: 1633084 registers.eax: 23117 registers.ebp: 1633056 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633120 registers.edi: 1633216 registers.eax: 23117 registers.ebp: 1633180 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999678976	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x772f199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x772f193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633012 registers.edi: 1633100 registers.eax: 23117 registers.ebp: 1633072 registers.edx: 0 registers.ebx: 0 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7730af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632864 registers.edi: 1632960 registers.eax: 23117 registers.ebp: 1632924 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999575552	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7730ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7730af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632996 registers.edi: 1633084 registers.eax: 23117 registers.ebp: 1633056 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633120 registers.edi: 1633216 registers.eax: 23117 registers.ebp: 1633180 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999678976	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x772f199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x772f193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633012 registers.edi: 1633100 registers.eax: 23117 registers.ebp: 1633072 registers.edx: 0 registers.ebx: 0 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7730af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632864 registers.edi: 1632960 registers.eax: 23117 registers.ebp: 1632924 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999575552	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7730ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7730af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632996 registers.edi: 1633084 registers.eax: 23117 registers.ebp: 1633056 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633120 registers.edi: 1633216 registers.eax: 23117 registers.ebp: 1633180 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999678976	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x772f199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x772f193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633012 registers.edi: 1633100 registers.eax: 23117 registers.ebp: 1633072 registers.edx: 0 registers.ebx: 0 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7730af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632864 registers.edi: 1632960 registers.eax: 23117 registers.ebp: 1632924 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999575552	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7730ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7730af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632996 registers.edi: 1633084 registers.eax: 23117 registers.ebp: 1633056 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633120 registers.edi: 1633216 registers.eax: 23117 registers.ebp: 1633180 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999678976	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x772f199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x772f193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633012 registers.edi: 1633100 registers.eax: 23117 registers.ebp: 1633072 registers.edx: 0 registers.ebx: 0 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7730af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632864 registers.edi: 1632960 registers.eax: 23117 registers.ebp: 1632924 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999575552	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7730ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7730af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632996 registers.edi: 1633084 registers.eax: 23117 registers.ebp: 1633056 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633120 registers.edi: 1633216 registers.eax: 23117 registers.ebp: 1633180 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999678976	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x772f199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x772f193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633012 registers.edi: 1633100 registers.eax: 23117 registers.ebp: 1633072 registers.edx: 0 registers.ebx: 0 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7730af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632864 registers.edi: 1632960 registers.eax: 23117 registers.ebp: 1632924 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999575552	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7730ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7730af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632996 registers.edi: 1633084 registers.eax: 23117 registers.ebp: 1633056 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633120 registers.edi: 1633216 registers.eax: 23117 registers.ebp: 1633180 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999678976	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x772f199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x772f193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633012 registers.edi: 1633100 registers.eax: 23117 registers.ebp: 1633072 registers.edx: 0 registers.ebx: 0 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7730af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632864 registers.edi: 1632960 registers.eax: 23117 registers.ebp: 1632924 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999575552	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7730ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7730af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632996 registers.edi: 1633084 registers.eax: 23117 registers.ebp: 1633056 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633120 registers.edi: 1633216 registers.eax: 23117 registers.ebp: 1633180 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999678976	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x772f199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x772f193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633012 registers.edi: 1633100 registers.eax: 23117 registers.ebp: 1633072 registers.edx: 0 registers.ebx: 0 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7730af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632864 registers.edi: 1632960 registers.eax: 23117 registers.ebp: 1632924 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999575552	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7730ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7730af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632996 registers.edi: 1633084 registers.eax: 23117 registers.ebp: 1633056 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633120 registers.edi: 1633216 registers.eax: 23117 registers.ebp: 1633180 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999678976	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x772f199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x772f193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633012 registers.edi: 1633100 registers.eax: 23117 registers.ebp: 1633072 registers.edx: 0 registers.ebx: 0 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7730af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632864 registers.edi: 1632960 registers.eax: 23117 registers.ebp: 1632924 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999575552	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlRetrieveNtUserPfn+0x2ea RtlOpenCurrentUser-0x2c8 ntdll+0x5ada7 @ 0x7730ada7 RtlRetrieveNtUserPfn+0x4bb RtlOpenCurrentUser-0xf7 ntdll+0x5af78 @ 0x7730af78 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632996 registers.edi: 1633084 registers.eax: 23117 registers.ebp: 1633056 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633120 registers.edi: 1633216 registers.eax: 23117 registers.ebp: 1633180 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999678976	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageNtHeader+0x1b RtlDeleteCriticalSection-0x1476 ntdll+0x3317f @ 0x772e317f RtlDosPathNameToNtPathName_U_WithStatus+0x33e LdrAccessResource-0x572 ntdll+0x4199e @ 0x772f199e RtlDosPathNameToNtPathName_U_WithStatus+0x2de LdrAccessResource-0x5d2 ntdll+0x4193e @ 0x772f193e RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1633012 registers.edi: 1633100 registers.eax: 23117 registers.ebp: 1633072 registers.edx: 0 registers.ebx: 0 registers.esi: 8388608 registers.ecx: 1633024	1
__exception__ March 8, 2022, 6:24 p.m.	stacktrace: RtlImageDirectoryEntryToData+0x5c RtlAddRefActivationContext-0x80 ntdll+0x2f5a2 @ 0x772df5a2 RtlImageDirectoryEntryToData+0x1a RtlAddRefActivationContext-0xc2 ntdll+0x2f560 @ 0x772df560 RtlDosPathNameToNtPathName_U_WithStatus+0x10e LdrAccessResource-0x7a2 ntdll+0x4176e @ 0x772f176e RtlRetrieveNtUserPfn+0x464 RtlOpenCurrentUser-0x14e ntdll+0x5af21 @ 0x7730af21 RtlDosPathNameToNtPathName_U_WithStatus+0x26e LdrAccessResource-0x642 ntdll+0x418ce @ 0x772f18ce RtlDosPathNameToNtPathName_U_WithStatus+0xee LdrAccessResource-0x7c2 ntdll+0x4174e @ 0x772f174e RtlLoadString+0x9c TpSetTimer-0x5bd ntdll+0x43e5f @ 0x772f3e5f LoadStringBaseExW+0x51 LoadStringA-0x91 kernelbase+0x13b2a @ 0x76703b2a LoadStringA+0x1d RegisterClassExA-0x5a user32+0x1db3e @ 0x7559db3e New_user32_LoadStringA@16+0x91 New_user32_LoadStringW@16-0x8b @ 0x74067322 0x8060ff 0x804133 0x804220 vbc+0x737d1 @ 0x4737d1 vbc+0x7474e @ 0x47474e vbc+0x3fa7 @ 0x403fa7 vbc+0x400f @ 0x40400f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 66 39 06 0f 85 7d c8 00 00 8b 46 3c 89 45 dc 3a exception.symbol: RtlImageNtHeaderEx+0x5a RtlImageDirectoryEntryToData-0x57 ntdll+0x2f4ef exception.instruction: cmp word ptr [esi], ax exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 193775 exception.address: 0x772df4ef registers.esp: 1632864 registers.edi: 1632960 registers.eax: 23117 registers.ebp: 1632924 registers.edx: 0 registers.ebx: 8388608 registers.esi: 8388608 registers.ecx: 1999575552	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (9 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.sutnsdmxq.icu/e3rs/?lnud=Txll_FO&Dz=lUbOt4rRqVssxqmaqZkhNrZPSjqmMN1b0lqH3KrFAoA/kAmkGoi9J+xDVaciNpXg1hW1+xPy
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.chegocheck.com/e3rs/?Dz=kBtv+8uMZDgJoctzJJlXxpvJV2xMrEWv2WqMq4iFDpTitVnQ5P6FBiXKhQGMvxSgf3VKVeJe&lnud=Txll_FO
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.eskomed.store/e3rs/?Dz=n3coydpyvxb1+U/IYEaNzLKm1axm1EDoNytGpqjnANqsfX5bFLlHi5W8VHT6sMi3TZZUH2tw&lnud=Txll_FO
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.sagedermatology.com/e3rs/?lnud=Txll_FO&Dz=BmVSufum30+1s4lK8YiwMjghnnMTkZAzSEhTOMstIaEgouylgvmW2x4JL0eg45ZsBeJi6OCm
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.padisarealtygroup.com/e3rs/?Dz=itKkYQ+bPiQagqfFS+Lsc+D5+JH3ErIfx0RJoaKqHvkqLFn0ydm1fEP6hkHSMACAxfdRCwUb&lnud=Txll_FO
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.extremeentertainmentgroup.com/e3rs/?Dz=dEHKxiAhq2PUxljq/uCxdG1AAciJu6kRpaHoK7hwfjqBv1xsh7JTax04MQP6Pek+aK5HhDsd&lnud=Txll_FO
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.xn--laufgefhl-w9a.com/e3rs/?lnud=Txll_FO&Dz=b8jJRQWfF4+OnEJERRv9IAKdrqQukcbHmYLMW0jk5XDvFKBqdxoMO++0Oe2bhe+XWL2/5s9y
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.oneowneronly.com/e3rs/?lnud=Txll_FO&Dz=Ei27cO4R/In4nCpRKe1X+vb6IhSQD7KJ8DOgqI0RS1UyrmbR2z2X6RwWjW3Zl1NqSx6QzXwL
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.glowestudiocreativo.com/e3rs/?Dz=HRF5cBwRaD2pnVjl04lDxZrQc/S39DKKmsOHQJEpf55iLBXquTeAPsbQ5KkbylXLeFPlZQnh&lnud=Txll_FO

Performs some HTTP requests (10 events)

request	GET http://bondbuild.com.sg/vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv/Unqhqorelnlojsbiqegzhsaqjoyrqez
request	GET http://www.sutnsdmxq.icu/e3rs/?lnud=Txll_FO&Dz=lUbOt4rRqVssxqmaqZkhNrZPSjqmMN1b0lqH3KrFAoA/kAmkGoi9J+xDVaciNpXg1hW1+xPy
request	GET http://www.chegocheck.com/e3rs/?Dz=kBtv+8uMZDgJoctzJJlXxpvJV2xMrEWv2WqMq4iFDpTitVnQ5P6FBiXKhQGMvxSgf3VKVeJe&lnud=Txll_FO
request	GET http://www.eskomed.store/e3rs/?Dz=n3coydpyvxb1+U/IYEaNzLKm1axm1EDoNytGpqjnANqsfX5bFLlHi5W8VHT6sMi3TZZUH2tw&lnud=Txll_FO
request	GET http://www.sagedermatology.com/e3rs/?lnud=Txll_FO&Dz=BmVSufum30+1s4lK8YiwMjghnnMTkZAzSEhTOMstIaEgouylgvmW2x4JL0eg45ZsBeJi6OCm
request	GET http://www.padisarealtygroup.com/e3rs/?Dz=itKkYQ+bPiQagqfFS+Lsc+D5+JH3ErIfx0RJoaKqHvkqLFn0ydm1fEP6hkHSMACAxfdRCwUb&lnud=Txll_FO
request	GET http://www.extremeentertainmentgroup.com/e3rs/?Dz=dEHKxiAhq2PUxljq/uCxdG1AAciJu6kRpaHoK7hwfjqBv1xsh7JTax04MQP6Pek+aK5HhDsd&lnud=Txll_FO
request	GET http://www.xn--laufgefhl-w9a.com/e3rs/?lnud=Txll_FO&Dz=b8jJRQWfF4+OnEJERRv9IAKdrqQukcbHmYLMW0jk5XDvFKBqdxoMO++0Oe2bhe+XWL2/5s9y
request	GET http://www.oneowneronly.com/e3rs/?lnud=Txll_FO&Dz=Ei27cO4R/In4nCpRKe1X+vb6IhSQD7KJ8DOgqI0RS1UyrmbR2z2X6RwWjW3Zl1NqSx6QzXwL
request	GET http://www.glowestudiocreativo.com/e3rs/?Dz=HRF5cBwRaD2pnVjl04lDxZrQc/S39DKKmsOHQJEpf55iLBXquTeAPsbQ5KkbylXLeFPlZQnh&lnud=Txll_FO

Allocates read-write-execute memory (usually to unpack itself) (50 out of 83 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047a000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047a000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047a000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00817000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008064e4 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008064e4 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008064e4 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008064e4 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008064e4 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008064e4 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008064e4 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008064e4 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d56000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d56000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d80000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d80000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d56628 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d56628 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d56628 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d56628 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74a8c000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d35000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d32000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d36000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d34000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d35000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 5 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d34000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d31000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d34000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d36000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d34000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d56628 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d56628 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d56628 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d56628 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d56628 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d56628 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d56628 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d56628 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d56628 process_handle: 0xffffffff		3221225477
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d56628 process_handle: 0xffffffff		3221225477

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 86016 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00801000 process_handle: 0xffffffff	1	0	0

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 76911edc640716aa42e33af2a7cc8106d5ef7027

Allocates execute permission to another process indicative of possible code injection (3 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2504 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000374	1
NtAllocateVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000374	1
NtAllocateVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000374	1

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Unqhqor

reg_value

C:\Users\Public\roqhqnU.url

Creates a thread using CreateRemoteThread in a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2336 created a remote thread in non-child process 2504
CreateRemoteThread March 8, 2022, 6:24 p.m.	thread_identifier: 2540 process_identifier: 2504 function_address: 0x000c0000 flags: 0 stack_size: 0 parameter: 0x000b0000 process_handle: 0x00000374	1	888	0

Manipulates memory of a non-child process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2336 manipulating memory of non-child process 2504
NtAllocateVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2504 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000374	1	0	0
NtAllocateVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000374	1	0	0
NtAllocateVirtualMemory March 8, 2022, 6:24 p.m.	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000374	1	0	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2336 injected into non-child 2504
WriteProcessMemory March 8, 2022, 6:24 p.m.	buffer: HrðÔIr base_address: 0x000b0000 process_identifier: 2504 process_handle: 0x00000374	1	1	0
WriteProcessMemory March 8, 2022, 6:24 p.m.	buffer: UìÄøEUøPUü1ÀPjÿuøÿUüYY]Â@UìÄÔSVWúðEÔ×èÝ/þÿ3ÀUhù×dÿ0d ÆEÿG<ÇEô»rÃj@h0Eô@PPEô@4ÃPè¸LþÿEð}ðt0hjEðPè¯Lþÿj@h0Eô@PPEô@4ÃPVèLþÿEð}ðuûtvEÔPÏUðÆèEÔÀt7EèUàUìUøRUØRPEðPVè~LþÿjjMèºÄ×Æè_ýÿÿÀtÆEÿ3ÀZYYdh×EÔ×è°/þÿÃ base_address: 0x000c0000 process_identifier: 2504 process_handle: 0x00000374	1	1	0

Network activity contains more than one unique useragent (2 events)

process	vbc.exe				useragent	lVali
process	vbc.exe				useragent	71

File has been identified by 21 AntiVirus engines on VirusTotal as malicious (21 events)

Elastic	malicious (high confidence)
McAfee	Artemis!F8F330F74629
Cylance	Unsafe
K7GW	Trojan ( 0058eb411 )
K7AntiVirus	Trojan ( 0058eb411 )
ESET-NOD32	a variant of Win32/Injector.ERDG
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	FileRepMalware
McAfee-GW-Edition	BehavesLike.Win32.Fareit.ch
SentinelOne	Static AI - Suspicious PE
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-S
Microsoft	Trojan:Win32/Fareit!ml
VBA32	BScope.TrojanPSW.Fareit
Malwarebytes	Malware.AI.327759016
APEX	Malicious
Rising	Spyware.Noon!8.E7C9 (CLOUD)
MaxSecure	Trojan.Malware.300983.susgen
AVG	FileRepMalware
Panda	Trj/RnkBend.A

vbc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All