Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	April 12, 2023, 6:30 p.m.	April 12, 2023, 6:32 p.m.

Size	197.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`79c1be7c958d5cded0534d37b0104305`
SHA256	`59873832d59ac86759e5df7dd96e49049b3b221da1ab1b71ede21b271c3168a7`
CRC32	`8A823F81`
ssdeep	`6144:r28W38HAsKSVUu+f4wd7UUA/A1QcL0mUpUgb:3XHAsKfJ77A/An4x`
PDB Path	C:\yajoheni-yewef\vuvibixul nivobocayi_giy.pdb
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) PE_Header_Zero - PE File Signature

60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc.exe "C:\Users\test22\AppData\Local\Temp\60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc.exe"
1648
- 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc.exe "C:\Users\test22\AppData\Local\Temp\60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc.exe"
  1440

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 12, 2023, 6:30 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\yajoheni-yewef\vuvibixul nivobocayi_giy.pdb

One or more processes crashed (50 out of 65536 events)

Time & API	Arguments	Status
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x89b8 @ 0x4089b8 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x89d4 @ 0x4089d4 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x89f2 @ 0x4089f2 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x89ff @ 0x4089ff BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8a2f @ 0x408a2f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8a33 @ 0x408a33 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8a51 @ 0x408a51 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8a6a @ 0x408a6a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8a6e @ 0x408a6e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8a7f @ 0x408a7f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8adb @ 0x408adb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8af1 @ 0x408af1 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8af5 @ 0x408af5 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8b0f @ 0x408b0f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8b1b @ 0x408b1b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8b1f @ 0x408b1f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8b4f @ 0x408b4f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8b5b @ 0x408b5b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8ba1 @ 0x408ba1 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8bad @ 0x408bad BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8bb1 @ 0x408bb1 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8bd4 @ 0x408bd4 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8bd8 @ 0x408bd8 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8bee @ 0x408bee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8bf6 @ 0x408bf6 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8c10 @ 0x408c10 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8c14 @ 0x408c14 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8c18 @ 0x408c18 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8c24 @ 0x408c24 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8c28 @ 0x408c28 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8c35 @ 0x408c35 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8c39 @ 0x408c39 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8c46 @ 0x408c46 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8c5f @ 0x408c5f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8c63 @ 0x408c63 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8c67 @ 0x408c67 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8c74 @ 0x408c74 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8c96 @ 0x408c96 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8c9e @ 0x408c9e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8d0a @ 0x408d0a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8d1b @ 0x408d1b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8d1f @ 0x408d1f BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8d23 @ 0x408d23 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8d2b @ 0x408d2b BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8d38 @ 0x408d38 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8d3c @ 0x408d3c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8d44 @ 0x408d44 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8d4c @ 0x408d4c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8d60 @ 0x408d60 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1
__exception__ April 12, 2023, 6:30 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7580e825 60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc+0x8d8e @ 0x408d8e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77907cbf registers.esp: 1638044 registers.edi: 4718592 registers.eax: 4294967288 registers.ebp: 1638096 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2052	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 12, 2023, 6:30 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 86016 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059c000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2023, 6:30 p.m.	process_identifier: 1648 region_size: 118784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00025400', u'virtual_address': u'0x00001000', u'entropy': 7.640244527217739, u'name': u'.text', u'virtual_size': u'0x00025358'}

entropy

7.64024452722

description

A section with a high entropy has been found

entropy

0.758269720102

description

Overall entropy of this PE file is high

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory April 12, 2023, 6:30 p.m.	process_identifier: 1440 region_size: 126976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000080	1	0	0

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory April 12, 2023, 6:30 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1440 process_handle: 0x00000080	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1648 called NtSetContextThread to modify thread in remote process 1440
NtSetContextThread April 12, 2023, 6:30 p.m.	registers.eip: 2005598660 registers.esp: 1638384 registers.edi: 0 registers.eax: 4229499 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 1440	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1648 resumed a thread in remote process 1440
NtResumeThread April 12, 2023, 6:30 p.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 1440	1	0	0

Tries to unhook Windows functions monitored by Cuckoo (1 event)

Time & API	Arguments	Status	Return	Repeated
__anomaly__ April 12, 2023, 6:30 p.m.	tid: 2052 message: Encountered 65537 exceptions, quitting. subcategory: exception function_name:	1	0	0

Executed a process and injected code into it, probably while unpacking (7 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW April 12, 2023, 6:30 p.m.	thread_identifier: 2052 thread_handle: 0x0000007c process_identifier: 1440 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000080	1	1
NtGetContextThread April 12, 2023, 6:30 p.m.	thread_handle: 0x0000007c	1	0
NtUnmapViewOfSection April 12, 2023, 6:30 p.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 1440 process_handle: 0x00000080	1	0
NtAllocateVirtualMemory April 12, 2023, 6:30 p.m.	process_identifier: 1440 region_size: 126976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000080	1	0
WriteProcessMemory April 12, 2023, 6:30 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1440 process_handle: 0x00000080	1	1
NtSetContextThread April 12, 2023, 6:30 p.m.	registers.eip: 2005598660 registers.esp: 1638384 registers.edi: 0 registers.eax: 4229499 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 1440	1	0
NtResumeThread April 12, 2023, 6:30 p.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 1440	1	0

60f6582886a92241e116efbb17804e5487987d58659a2399df434f01928e7acc

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All