Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 16, 2024, 7:25 a.m.	May 16, 2024, 7:31 a.m.

Size	5.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`7d26f511c2149b527c48face0a8a476d`
SHA256	`773d60c23c002eb49e5ee695b2a1d5dfa8e1ba10258f79fa4cd22d686aaa0ae6`
CRC32	`8197981F`
ssdeep	`98304:mxMQlk4GOrSPArd2YfZCZANPLXDbVpssdlVqT0tooGZmlXGvDlFBwEKX6zkHVaLX:Ulk4rSPOdyILTbVrHoT0too9lXGhgEK0`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) mzp_file_format - MZP(Delphi) file format Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet UPX_Zero - UPX packed file

crt.exe "C:\Users\test22\AppData\Local\Temp\crt.exe"
2656
- crt.tmp "C:\Users\test22\AppData\Local\Temp\is-DB2FV.tmp\crt.tmp" /SL5="$80178,5064732,54272,C:\Users\test22\AppData\Local\Temp\crt.exe"
  2728
  - victoriapigments32.exe "C:\Users\test22\AppData\Local\Victoria Pigments\victoriapigments32.exe" -i
    2824
  - victoriapigments32.exe "C:\Users\test22\AppData\Local\Victoria Pigments\victoriapigments32.exe" -s
    2936

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA May 16, 2024, 7:25 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 16, 2024, 7:25 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 16, 2024, 7:25 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

One or more processes crashed (50 out of 131074 events)

Time & API	Arguments	Status
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: crt+0x40c42 @ 0x440c42 crt+0x42a87 @ 0x442a87 crt+0x48150 @ 0x448150 crt+0x3e055 @ 0x43e055 crt+0x3cf8b @ 0x43cf8b crt+0x8ed0c @ 0x48ed0c crt+0x7b393 @ 0x47b393 crt+0x92a60 @ 0x492a60 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 06 c7 45 fc fe ff ff ff 85 db 0f 85 97 34 00 exception.symbol: WNetCloseEnum+0x14 WNetOpenEnumW-0x11c mpr+0x2dea exception.instruction: mov eax, dword ptr [esi] exception.module: mpr.dll exception.exception_code: 0xc0000005 exception.offset: 11754 exception.address: 0x74162dea registers.esp: 1637612 registers.edi: 31568072 registers.eax: 1637640 registers.ebp: 1637656 registers.edx: 44 registers.ebx: 0 registers.esi: 44 registers.ecx: 0	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: crt+0x3db7a @ 0x43db7a crt+0x3cf8b @ 0x43cf8b crt+0x8ed0c @ 0x48ed0c crt+0x7b393 @ 0x47b393 crt+0x92a60 @ 0x492a60 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: f7 37 89 06 e9 dd 07 00 00 8b 06 33 d2 8a 17 8b exception.symbol: crt+0x3ae6f exception.instruction: div dword ptr [edi] exception.module: crt.tmp exception.exception_code: 0xc0000094 exception.offset: 241263 exception.address: 0x43ae6f registers.esp: 1637784 registers.edi: 31574800 registers.eax: 31256268 registers.ebp: 1637864 registers.edx: 0 registers.ebx: 1 registers.esi: 31574792 registers.ecx: 31574800	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: FindClose+0x3a FindFirstFileExW-0xa0 kernelbase+0x194b4 @ 0x759894b4 victoriapigments32+0x17a4a @ 0x417a4a victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: f0 0f ba 30 00 0f 83 6e 02 01 00 64 a1 18 00 00 exception.symbol: RtlEnterCriticalSection+0x12 RtlRestoreLastWin32Error-0x2d ntdll+0x222c2 exception.instruction: btr dword ptr [eax], 0 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 139970 exception.address: 0x76f322c2 registers.esp: 1638012 registers.edi: 28 registers.eax: 32 registers.ebp: 1638032 registers.edx: 4294826996 registers.ebx: 4294828032 registers.esi: 32 registers.ecx: 0	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x1daea3 @ 0x5daea3 victoriapigments32+0x1c1e65 @ 0x5c1e65 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638004 registers.edi: 0 registers.eax: 1968959488 registers.ebp: 1638056 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 0 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x1daea3 @ 0x5daea3 victoriapigments32+0x1c1e65 @ 0x5c1e65 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638004 registers.edi: 0 registers.eax: 1968955392 registers.ebp: 1638056 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 0 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x1daea3 @ 0x5daea3 victoriapigments32+0x1c1e65 @ 0x5c1e65 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638004 registers.edi: 0 registers.eax: 1968951296 registers.ebp: 1638056 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 0 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x1daea3 @ 0x5daea3 victoriapigments32+0x1c1e65 @ 0x5c1e65 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638004 registers.edi: 0 registers.eax: 1968947200 registers.ebp: 1638056 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 0 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x1daea3 @ 0x5daea3 victoriapigments32+0x1c1e65 @ 0x5c1e65 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638004 registers.edi: 0 registers.eax: 1968943104 registers.ebp: 1638056 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 0 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x1daea3 @ 0x5daea3 victoriapigments32+0x1c1e65 @ 0x5c1e65 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638004 registers.edi: 0 registers.eax: 1968939008 registers.ebp: 1638056 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 0 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x1daea3 @ 0x5daea3 victoriapigments32+0x1c1e65 @ 0x5c1e65 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638004 registers.edi: 0 registers.eax: 1968934912 registers.ebp: 1638056 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 0 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x1daea3 @ 0x5daea3 victoriapigments32+0x1c1e65 @ 0x5c1e65 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638004 registers.edi: 0 registers.eax: 1968930816 registers.ebp: 1638056 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 0 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x1daea3 @ 0x5daea3 victoriapigments32+0x1c1e65 @ 0x5c1e65 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638004 registers.edi: 0 registers.eax: 1968926720 registers.ebp: 1638056 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 0 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x1daea3 @ 0x5daea3 victoriapigments32+0x1c1e65 @ 0x5c1e65 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638004 registers.edi: 0 registers.eax: 1968922624 registers.ebp: 1638056 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 0 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x1daea3 @ 0x5daea3 victoriapigments32+0x1c1e65 @ 0x5c1e65 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638004 registers.edi: 0 registers.eax: 1968918528 registers.ebp: 1638056 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 0 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x1daea3 @ 0x5daea3 victoriapigments32+0x1c1e65 @ 0x5c1e65 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638004 registers.edi: 0 registers.eax: 1968914432 registers.ebp: 1638056 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 0 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x1daea3 @ 0x5daea3 victoriapigments32+0x1c1e65 @ 0x5c1e65 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638004 registers.edi: 0 registers.eax: 1968910336 registers.ebp: 1638056 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 0 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x1daea3 @ 0x5daea3 victoriapigments32+0x1c1e65 @ 0x5c1e65 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638004 registers.edi: 0 registers.eax: 1968906240 registers.ebp: 1638056 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 0 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x1daea3 @ 0x5daea3 victoriapigments32+0x1c1e65 @ 0x5c1e65 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638004 registers.edi: 0 registers.eax: 1968902144 registers.ebp: 1638056 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 0 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134217728 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134217728 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134221824 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134221824 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134225920 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134225920 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134230016 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134230016 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134234112 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134234112 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134238208 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134238208 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134242304 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134242304 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134246400 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134246400 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134250496 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134250496 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134254592 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134254592 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134258688 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134258688 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134262784 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134262784 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134266880 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134266880 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134270976 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134270976 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134275072 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134275072 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134279168 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134279168 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134283264 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134283264 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134287360 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134287360 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134291456 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134291456 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134295552 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134295552 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134299648 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134299648 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134303744 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134303744 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134307840 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134307840 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134311936 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134311936 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134316032 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134316032 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134320128 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134320128 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134324224 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134324224 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134328320 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134328320 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134332416 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134332416 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134336512 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134336512 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134340608 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134340608 registers.ecx: 23	1
__exception__ May 16, 2024, 7:25 a.m.	stacktrace: victoriapigments32+0x177725 @ 0x577725 victoriapigments32+0x12d64b @ 0x52d64b victoriapigments32+0x1d38e7 @ 0x5d38e7 victoriapigments32+0xb837c @ 0x4b837c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 30 8b 04 24 53 89 e3 81 c3 04 00 00 00 50 b8 exception.symbol: victoriapigments32+0x157b02 exception.instruction: push dword ptr [eax] exception.module: victoriapigments32.exe exception.exception_code: 0xc0000005 exception.offset: 1407746 exception.address: 0x557b02 registers.esp: 1638012 registers.edi: 20817 registers.eax: 134344704 registers.ebp: 1638064 registers.edx: 0 registers.ebx: 4294828032 registers.esi: 134344704 registers.ecx: 23	1

Allocates read-write-execute memory (usually to unpack itself) (6 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 16, 2024, 7:25 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 16, 2024, 7:25 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 40960 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 16, 2024, 7:25 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 16, 2024, 7:25 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 7:25 a.m.	process_identifier: 2728 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00360000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 16, 2024, 7:25 a.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\is-5135V.tmp\_isetup\_iscrypt.dll
file	C:\Users\test22\AppData\Local\Temp\is-5135V.tmp\_isetup\_isdecmp.dll
file	C:\Users\test22\AppData\Local\Temp\is-5135V.tmp\_isetup\_shfoldr.dll
file	C:\Users\test22\AppData\Local\Victoria Pigments\victoriapigments32.exe

Drops an executable to the user AppData folder (5 events)

file	C:\Users\test22\AppData\Local\Temp\is-DB2FV.tmp\crt.tmp
file	C:\Users\test22\AppData\Local\Temp\is-5135V.tmp\_isetup\_shfoldr.dll
file	C:\Users\test22\AppData\Local\Temp\is-5135V.tmp\_isetup\_isdecmp.dll
file	C:\Users\test22\AppData\Local\Temp\is-5135V.tmp\_isetup\_iscrypt.dll
file	C:\Users\test22\AppData\Local\Temp\is-5135V.tmp\_isetup\_RegDLL.tmp

Queries for potentially installed applications (4 events)

Time & API	Arguments	Return
RegOpenKeyExA May 16, 2024, 7:25 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Victoria Pigments_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Victoria Pigments_is1	2
RegOpenKeyExA May 16, 2024, 7:25 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Victoria Pigments_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Victoria Pigments_is1	2
RegOpenKeyExA May 16, 2024, 7:25 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Victoria Pigments_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000008 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Victoria Pigments_is1	2
RegOpenKeyExA May 16, 2024, 7:25 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Victoria Pigments_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000008 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Victoria Pigments_is1	2

Tries to unhook Windows functions monitored by Cuckoo (1 event)

Time & API	Arguments	Status	Return	Repeated
__anomaly__ May 16, 2024, 7:25 a.m.	tid: 2828 message: Encountered 65537 exceptions, quitting. subcategory: exception function_name:	1	0	0

crt.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All