Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Dec. 21, 2022, 5:42 p.m.	Dec. 21, 2022, 5:48 p.m.

Size	275.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d19425fc6dfb409d028b8b415a357fb4`
SHA256	`d82c09076d5daee0cf72c69e92658f798b74ed4ac505ac144bd68823b240f233`
CRC32	`5137758F`
ssdeep	`6144:GIELCXQxsLeHms2oa7nXfNPBTSoXYWzz/:GIEWudOBBz`
PDB Path	C:\hoyo\65\zaf\yerefanetijin_bak kewizutitufi.pdb
Yara	IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file

poro.exe "C:\Users\test22\AppData\Local\Temp\poro.exe"
884

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
212.86.115.220	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

C:\hoyo\65\zaf\yerefanetijin_bak kewizutitufi.pdb

The file contains an unknown PE resource name possibly indicative of a packer (2 events)

resource name	AFX_DIALOG_LAYOUT
resource name	None

One or more processes crashed (50 out of 65536 events)

Time & API	Arguments	Status
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 5930040 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1
__exception__ Dec. 21, 2022, 5:42 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x758631df poro+0x2e61 @ 0x402e61 poro+0x33e9 @ 0x4033e9 poro+0x39ab @ 0x4039ab BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1631504 registers.edi: 5636096 registers.eax: 4294967288 registers.ebp: 1631556 registers.edx: 998 registers.ebx: 0 registers.esi: 0 registers.ecx: 1932	1

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Dec. 21, 2022, 5:42 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058a000 process_handle: 0xffffffff	1	0	0

Foreign language identified in PE resource (44 events)

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a2c0

size

0x00000468

name

RT_STRING

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006cc20

size

0x00000272

name

RT_STRING

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006cc20

size

0x00000272

name

RT_STRING

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006cc20

size

0x00000272

name

RT_STRING

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006cc20

size

0x00000272

name

RT_ACCELERATOR

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a790

size

0x00000070

name

RT_ACCELERATOR

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a790

size

0x00000070

name

RT_GROUP_ICON

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a728

size

0x00000068

name

RT_GROUP_ICON

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a728

size

0x00000068

name

RT_GROUP_ICON

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a728

size

0x00000068

name

RT_GROUP_ICON

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a728

size

0x00000068

name

RT_GROUP_ICON

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a728

size

0x00000068

name

None

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a8d0

size

0x0000000a

name

None

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a8d0

size

0x0000000a

name

None

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a8d0

size

0x0000000a

name

None

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a8d0

size

0x0000000a

name

None

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0006a8d0

size

0x0000000a

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0001ea00', u'virtual_address': u'0x0000e000', u'entropy': 7.9281904202703855, u'name': u'.data', u'virtual_size': u'0x00045f00'}

entropy

7.92819042027

description

A section with a high entropy has been found

entropy

0.446265938069

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

212.86.115.220

Tries to unhook Windows functions monitored by Cuckoo (1 event)

Time & API	Arguments	Status	Return	Repeated
__anomaly__ Dec. 21, 2022, 5:42 p.m.	tid: 1932 message: Encountered 65537 exceptions, quitting. subcategory: exception function_name:	1	0	0

File has been identified by 30 AntiVirus engines on VirusTotal as malicious (30 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
FireEye	Generic.mg.d19425fc6dfb409d
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
K7GW	Trojan ( 005690671 )
K7AntiVirus	Trojan ( 005690671 )
Cyren	W32/Kryptik.IFU.gen!Eldorado
Symantec	Packed.Generic.528
tehtris	Generic.Malware
ClamAV	Win.Packed.Pwsx-9980703-0
Kaspersky	VHO:Trojan-Downloader.Win32.Upatre.gen
Cynet	Malicious (score: 100)
Avast	Win32:Evo-gen [Trj]
Sophos	ML/PE-A + Troj/Krypt-TG
McAfee-GW-Edition	BehavesLike.Win32.Lockbit.dh
SentinelOne	Static AI - Suspicious PE
Trapmine	malicious.moderate.ml.score
APEX	Malicious
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	VHO:Trojan-Downloader.Win32.Upatre.gen
Google	Detected
Acronis	suspicious
VBA32	Malware-Cryptor.2LA.gen
Rising	Trojan.Generic@AI.100 (RDML:tgcT4dr9z/dM37hZmHOtxQ)
Ikarus	Trojan.Win32.Azorult
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:Evo-gen [Trj]
Cybereason	malicious.d8c90e

poro.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All