Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 6, 2023, 6:13 p.m.	April 6, 2023, 6:17 p.m.

Size	210.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d02ac7b008243704a4d4b5b16764ada8`
SHA256	`ab1e8e80ec74470864dd2abf71a6f33e379a57ebacc1a5f88cb97d3b0349c2b0`
CRC32	`45C6347D`
ssdeep	`3072:Rsk+z2MrQmSTShuh3GDuM5M9wbiSE8wO45sjbThrFA:ako2CgTShYGO9wbZ/tjbTP`
PDB Path	C:\cule10 wumilasivikesa-renivif 88-roy\ziv-bop.pdb
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature

25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35.exe "C:\Users\test22\AppData\Local\Temp\25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35.exe"
2552
- 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35.exe "C:\Users\test22\AppData\Local\Temp\25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35.exe"
  2648

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 6, 2023, 6:13 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\cule10 wumilasivikesa-renivif 88-roy\ziv-bop.pdb

One or more processes crashed (50 out of 65536 events)

Time & API	Arguments	Status
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x89b8 @ 0x4089b8 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x89d4 @ 0x4089d4 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x89f2 @ 0x4089f2 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x89ff @ 0x4089ff BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8a2f @ 0x408a2f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8a33 @ 0x408a33 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8a51 @ 0x408a51 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8a6a @ 0x408a6a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8a6e @ 0x408a6e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8a7f @ 0x408a7f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8adb @ 0x408adb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8af1 @ 0x408af1 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8af5 @ 0x408af5 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8b0f @ 0x408b0f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8b1b @ 0x408b1b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8b1f @ 0x408b1f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8b4f @ 0x408b4f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8b5b @ 0x408b5b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8ba1 @ 0x408ba1 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8bad @ 0x408bad BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8bb1 @ 0x408bb1 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8bd4 @ 0x408bd4 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8bd8 @ 0x408bd8 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8bee @ 0x408bee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8bf6 @ 0x408bf6 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8c10 @ 0x408c10 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8c14 @ 0x408c14 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8c18 @ 0x408c18 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8c24 @ 0x408c24 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8c28 @ 0x408c28 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8c35 @ 0x408c35 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8c39 @ 0x408c39 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8c46 @ 0x408c46 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8c5f @ 0x408c5f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8c63 @ 0x408c63 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8c67 @ 0x408c67 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8c74 @ 0x408c74 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8c96 @ 0x408c96 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8c9e @ 0x408c9e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8d0a @ 0x408d0a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8d1b @ 0x408d1b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8d1f @ 0x408d1f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8d23 @ 0x408d23 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8d2b @ 0x408d2b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8d38 @ 0x408d38 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8d3c @ 0x408d3c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8d44 @ 0x408d44 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8d4c @ 0x408d4c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8d60 @ 0x408d60 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1
__exception__ April 6, 2023, 6:13 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x755de825 25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35+0x8d8e @ 0x408d8e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1638044 registers.edi: 8519680 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2652	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 6, 2023, 6:13 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 90112 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0051e000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 6, 2023, 6:13 p.m.	process_identifier: 2552 region_size: 118784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00024600', u'virtual_address': u'0x00001000', u'entropy': 7.59050330601726, u'name': u'.text', u'virtual_size': u'0x0002446e'}

entropy

7.59050330602

description

A section with a high entropy has been found

entropy

0.696172248804

description

Overall entropy of this PE file is high

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory April 6, 2023, 6:13 p.m.	process_identifier: 2648 region_size: 126976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000009c	1	0	0

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory April 6, 2023, 6:13 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2648 process_handle: 0x0000009c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2552 called NtSetContextThread to modify thread in remote process 2648
NtSetContextThread April 6, 2023, 6:13 p.m.	registers.eip: 1995571652 registers.esp: 1638384 registers.edi: 0 registers.eax: 4229499 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000098 process_identifier: 2648	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2552 resumed a thread in remote process 2648
NtResumeThread April 6, 2023, 6:13 p.m.	thread_handle: 0x00000098 suspend_count: 1 process_identifier: 2648	1	0	0

Tries to unhook Windows functions monitored by Cuckoo (1 event)

Time & API	Arguments	Status	Return	Repeated
__anomaly__ April 6, 2023, 6:13 p.m.	tid: 2652 message: Encountered 65537 exceptions, quitting. subcategory: exception function_name:	1	0	0

Executed a process and injected code into it, probably while unpacking (7 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW April 6, 2023, 6:13 p.m.	thread_identifier: 2652 thread_handle: 0x00000098 process_identifier: 2648 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000009c	1	1
NtGetContextThread April 6, 2023, 6:13 p.m.	thread_handle: 0x00000098	1	0
NtUnmapViewOfSection April 6, 2023, 6:13 p.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2648 process_handle: 0x0000009c	1	0
NtAllocateVirtualMemory April 6, 2023, 6:13 p.m.	process_identifier: 2648 region_size: 126976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000009c	1	0
WriteProcessMemory April 6, 2023, 6:13 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2648 process_handle: 0x0000009c	1	1
NtSetContextThread April 6, 2023, 6:13 p.m.	registers.eip: 1995571652 registers.esp: 1638384 registers.edi: 0 registers.eax: 4229499 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000098 process_identifier: 2648	1	0
NtResumeThread April 6, 2023, 6:13 p.m.	thread_handle: 0x00000098 suspend_count: 1 process_identifier: 2648	1	0

File has been identified by 47 AntiVirus engines on VirusTotal as malicious (47 events)

Lionic	Trojan.Win32.Zusy.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.456253
FireEye	Generic.mg.d02ac7b008243704
CAT-QuickHeal	Ransom.Stop.P5
McAfee	Artemis!D02AC7B00824
Malwarebytes	Trojan.MalPack.GS
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005690671 )
K7GW	Trojan ( 005690671 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Zusy.D6F63D
Cyren	W32/Kryptik.JLW.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HTGL
Cynet	Malicious (score: 100)
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packer.pkr_ce1a-9980177-0
Kaspersky	UDS:Trojan-Spy.Win32.Stealer.gen
BitDefender	Gen:Variant.Zusy.456253
Avast	Win32:CrypterX-gen [Trj]
Sophos	Mal/Generic-S
VIPRE	Gen:Variant.Zusy.456253
McAfee-GW-Edition	BehavesLike.Win32.Lockbit.dh
Trapmine	malicious.moderate.ml.score
Emsisoft	Gen:Variant.Zusy.456253 (B)
Ikarus	Trojan-Banker.UrSnif
Webroot	W32.Trojan.Gen
Gridinsoft	Ransom.Win32.AzorUlt.sa
Microsoft	Trojan:Win32/Amadey.HRY!MTB
ZoneAlarm	UDS:Trojan-Spy.Win32.Stealer.gen
GData	Win32.Trojan-Stealer.Racealer.BBOV5K
Google	Detected
AhnLab-V3	Trojan/Win.Amadey.R568317
Acronis	suspicious
ALYac	Gen:Variant.Zusy.456253
MAX	malware (ai score=81)
VBA32	Malware-Cryptor.2LA.gen
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H09D523
Rising	Trojan.Generic@AI.100 (RDML:cafMvv8d5q29XbWoj4hCkA)
SentinelOne	Static AI - Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.HTGK!tr
AVG	Win32:CrypterX-gen [Trj]
DeepInstinct	MALICIOUS

25e0a8e3b75e5695fcd18aa97568d5d3c40ab0f572d098f985d488dc939e4f35

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All