Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 17, 2024, 1:33 p.m.	Sept. 17, 2024, 1:42 p.m.

Size	240.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`1b2cab632cc4fb94652f4237b4f98342`
SHA256	`895100760e67763505b9cad311be16b533db48d1f2cb28424a98495406220a2f`
CRC32	`9B931641`
ssdeep	`6144:6QkrHG1cslmmRFSBTJeeLGgJsebq9LMguD4M:YrHM/m23eLTzILSD4M`
Yara	Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature IsPE32 - (no description) Generic_Malware_Zero - Generic Malware Raccoon_Stealer_1_Zero - Raccoon Stealer UPX_Zero - UPX packed file

kg.exe "C:\Users\test22\AppData\Local\Temp\kg.exe"
1792
- dfswsex.exe "C:\Users\test22\AppData\Local\Temp\dfswsex.exe"
  2052
  - dfswsex.exe "C:\Users\test22\AppData\Local\Temp\dfswsex.exe"
    2172
- RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2116

Name	Response	Post-Analysis Lookup
tinyurl.com	A 104.18.111.161 A 104.17.112.233	104.18.111.161
markinda.top
kode.ac.ug
ddlakava.ac.ug
rebrand.ly	A 3.33.143.57 A 15.197.137.111	3.33.143.57
fran.ac.ug
tuekisa.ac.ug
hubvera.ac.ug
bit.do	A 23.21.31.78	23.21.31.78
fransceysse.ac.ug
kodekode.ac.ug
partadino.ac.ug
markinda.xyz

IP Address	Status	Action
104.17.112.233	Active	Moloch
15.197.137.111	Active	Moloch
164.124.101.2	Active	Moloch
23.21.31.78	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:56613 -> 164.124.101.2:53	2039472	ET INFO URL Shortener Service Domain in DNS Lookup (rebrand .ly)	Misc activity
TCP 104.17.112.233:80 -> 192.168.56.103:49174	2054422	ET INFO Referrer-Policy set to unsafe-url	Potentially Bad Traffic
UDP 192.168.56.103:65119 -> 8.8.8.8:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic
TCP 104.17.112.233:80 -> 192.168.56.103:49174	2054422	ET INFO Referrer-Policy set to unsafe-url	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 17, 2024, 1:33 p.m.			0	0
IsDebuggerPresent Sept. 17, 2024, 1:33 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 17, 2024, 1:33 p.m.		1	1	0

One or more processes crashed (50 out of 23773 events)

Time & API	Arguments	Status
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x189d exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6301 exception.address: 0x40189d registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x189e exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6302 exception.address: 0x40189e registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x189f exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6303 exception.address: 0x40189f registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18a0 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6304 exception.address: 0x4018a0 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18a1 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6305 exception.address: 0x4018a1 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18a2 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6306 exception.address: 0x4018a2 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18a3 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6307 exception.address: 0x4018a3 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18a4 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6308 exception.address: 0x4018a4 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18a5 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6309 exception.address: 0x4018a5 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18a6 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6310 exception.address: 0x4018a6 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18a7 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6311 exception.address: 0x4018a7 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18a8 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6312 exception.address: 0x4018a8 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18a9 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6313 exception.address: 0x4018a9 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18aa exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6314 exception.address: 0x4018aa registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18ab exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6315 exception.address: 0x4018ab registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18ac exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6316 exception.address: 0x4018ac registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18ad exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6317 exception.address: 0x4018ad registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18ae exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6318 exception.address: 0x4018ae registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18af exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6319 exception.address: 0x4018af registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18b0 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6320 exception.address: 0x4018b0 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18b1 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6321 exception.address: 0x4018b1 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18b2 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6322 exception.address: 0x4018b2 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18b3 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6323 exception.address: 0x4018b3 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18b4 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6324 exception.address: 0x4018b4 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18b5 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6325 exception.address: 0x4018b5 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18b6 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6326 exception.address: 0x4018b6 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18b7 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6327 exception.address: 0x4018b7 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18b8 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6328 exception.address: 0x4018b8 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18b9 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6329 exception.address: 0x4018b9 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18ba exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6330 exception.address: 0x4018ba registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18bb exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6331 exception.address: 0x4018bb registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18bc exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6332 exception.address: 0x4018bc registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18bd exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6333 exception.address: 0x4018bd registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18be exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6334 exception.address: 0x4018be registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18bf exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6335 exception.address: 0x4018bf registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18c0 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6336 exception.address: 0x4018c0 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18c1 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6337 exception.address: 0x4018c1 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18c2 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6338 exception.address: 0x4018c2 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18c3 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6339 exception.address: 0x4018c3 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18c4 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6340 exception.address: 0x4018c4 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18c5 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6341 exception.address: 0x4018c5 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: kg+0x18c6 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6342 exception.address: 0x4018c6 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec exception.symbol: kg+0x18c7 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6343 exception.address: 0x4018c7 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec 00 exception.symbol: kg+0x18c8 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6344 exception.address: 0x4018c8 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 ec 00 00 exception.symbol: kg+0x18c9 exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6345 exception.address: 0x4018c9 registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 ec 00 00 00 exception.symbol: kg+0x18ca exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6346 exception.address: 0x4018ca registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 ec 00 00 00 00 exception.symbol: kg+0x18cb exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6347 exception.address: 0x4018cb registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 ec 00 00 00 00 00 exception.symbol: kg+0x18cc exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6348 exception.address: 0x4018cc registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 ec 00 00 00 00 00 00 exception.symbol: kg+0x18cd exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6349 exception.address: 0x4018cd registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 17, 2024, 1:33 p.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 kg+0x23ae @ 0x4023ae RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 ec 00 00 00 00 00 00 00 exception.symbol: kg+0x18ce exception.instruction: add byte ptr [eax], al exception.module: kg.exe exception.exception_code: 0xc0000005 exception.offset: 6350 exception.address: 0x4018ce registers.esp: 1637384 registers.edi: 1 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (4 events)

request	GET http://rebrand.ly/329cc6
request	GET http://rebrand.ly/8e86de
request	GET http://tinyurl.com/6y2zn4wu
request	GET http://tinyurl.com/4jecay9v

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

markinda.top

description

Generic top level domain TLD

Allocates read-write-execute memory (usually to unpack itself) (36 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778bf000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 1792 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02af0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02340000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778bf000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2052 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02350000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2172 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00410000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778bf000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00390000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778bf000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e82000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b30000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ca0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73522000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73dfb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02820000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00482000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d2a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74361000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c1f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70651000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 2116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70531000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (14 events)

file	C:\Users\test22\AppData\Local\Temp\DropVakxa.exe
file	C:\Users\test22\AppData\Local\Temp\DropakQxa.exe
file	C:\Users\test22\AppData\Local\Temp\DropakDxa.exe
file	C:\Users\test22\AppData\Local\Temp\dfswsex.exe
file	C:\Users\test22\AppData\Local\Temp\DroCpakxa.exe
file	C:\Users\test22\AppData\Local\Temp\DroHpakxa.exe
file	C:\Users\test22\AppData\Local\Temp\DropaGkxa.exe
file	C:\Users\test22\AppData\Local\Temp\DropaAkxa.exe
file	C:\Users\test22\AppData\Local\Temp\ropakxa.exe
file	C:\Users\test22\AppData\Local\Temp\Dropakxa.exe
file	C:\Users\test22\AppData\Local\Temp\DropaDkxa.exe
file	C:\Users\test22\AppData\Local\Temp\DroWEpakxa.exe
file	C:\Users\test22\AppData\Local\Temp\Dropkxa.exe
file	C:\Users\test22\AppData\Local\Temp\DropaUkxa.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\dfswsex.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\dfswsex.exe

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 17, 2024, 1:33 p.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00440000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00037000', u'virtual_address': u'0x00001000', u'entropy': 6.858190137912357, u'name': u'.text', u'virtual_size': u'0x0003656c'}

entropy

6.85819013791

description

A section with a high entropy has been found

entropy

0.932203389831

description

Overall entropy of this PE file is high

Potentially malicious URLs were found in the process memory dump (20 events)

url	http://tinyurl.com/6y2zn4wu
url	http://tuekisa.ac.ug/ghjk.exe
url	http://markinda.xyz/ghjk.exe
url	http://google.com
url	http://rebrand.ly/329cc6
url	http://partiad.xyz/ghjkl.exe
url	http://muylove.ac.ug/ghjkl.exe
url	http://bit.do/fRCja
url	http://cointra.ac.ug/ghjk.exe
url	http://rebrand.ly/8e86de
url	http://hubvera.ac.ug/ghjk.exe
url	http://bit.do/fRCi8
url	http://bit.do/fRCiY
url	http://markinda.top/ghjkl.exe
url	http://partadino.ac.ug/ghjkl.exe
url	http://partiad.top/ghjk.exe
url	http://ddlakava.ac.ug/ghjkl.exe
url	http://bit.do/fRCjk
url	http://rebrand.ly/k9l9l9j
url	http://tinyurl.com/4jecay9v

Yara rule detected in process memory (16 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vba
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 457826646ff9eea8b0c22fdd17311329c4e8bafc
buffer	Buffer with sha1: 24bd67c4cfff6d74da9364da8eba1dfaa6c9d238

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1792 called NtSetContextThread to modify thread in remote process 2116
Process injection	Process 2052 called NtSetContextThread to modify thread in remote process 2172
NtSetContextThread Sept. 17, 2024, 1:33 p.m.	registers.eip: 4259840 registers.esp: 1441292 registers.edi: 0 registers.eax: 4231514 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2005598660 thread_handle: 0x0000022c process_identifier: 2116	1	0	0
NtSetContextThread Sept. 17, 2024, 1:33 p.m.	registers.eip: 4214784 registers.esp: 1638384 registers.edi: 0 registers.eax: 4198508 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2005598660 thread_handle: 0x00000114 process_identifier: 2172	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1792 resumed a thread in remote process 2116
Process injection	Process 2052 resumed a thread in remote process 2172
NtResumeThread Sept. 17, 2024, 1:33 p.m.	thread_handle: 0x0000022c suspend_count: 1 process_identifier: 2116	1	0	0
NtResumeThread Sept. 17, 2024, 1:33 p.m.	thread_handle: 0x00000114 suspend_count: 1 process_identifier: 2172	1	0	0

Generates some ICMP traffic

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

23.21.31.78:80

Executed a process and injected code into it, probably while unpacking (16 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Sept. 17, 2024, 1:33 p.m.	thread_identifier: 2056 thread_handle: 0x000002a4 process_identifier: 2052 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\dfswsex.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\dfswsex.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\dfswsex.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002ac	1	1
CreateProcessInternalW Sept. 17, 2024, 1:33 p.m.	thread_identifier: 2120 thread_handle: 0x0000022c process_identifier: 2116 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000220	1	1
NtGetContextThread Sept. 17, 2024, 1:33 p.m.	thread_handle: 0x0000022c	1	0
NtUnmapViewOfSection Sept. 17, 2024, 1:33 p.m.	base_address: 0x00400000 region_size: 1999372288 process_identifier: 2116 process_handle: 0x00000220		3221225497
NtMapViewOfSection Sept. 17, 2024, 1:33 p.m.	section_handle: 0x00000224 process_identifier: 2116 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: base_address: 0x00400000 allocation_type: 0 () section_offset: 0 view_size: 77824 process_handle: 0x00000220	1	0
NtSetContextThread Sept. 17, 2024, 1:33 p.m.	registers.eip: 4259840 registers.esp: 1441292 registers.edi: 0 registers.eax: 4231514 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2005598660 thread_handle: 0x0000022c process_identifier: 2116	1	0
NtResumeThread Sept. 17, 2024, 1:33 p.m.	thread_handle: 0x0000022c suspend_count: 1 process_identifier: 2116	1	0
CreateProcessInternalW Sept. 17, 2024, 1:33 p.m.	thread_identifier: 2176 thread_handle: 0x00000114 process_identifier: 2172 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\dfswsex.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\dfswsex.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000011c	1	1
NtGetContextThread Sept. 17, 2024, 1:33 p.m.	thread_handle: 0x00000114	1	0
NtUnmapViewOfSection Sept. 17, 2024, 1:33 p.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2172 process_handle: 0x0000011c	1	0
NtMapViewOfSection Sept. 17, 2024, 1:33 p.m.	section_handle: 0x000000e0 process_identifier: 2172 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: base_address: 0x00400000 allocation_type: 0 () section_offset: 0 view_size: 40960 process_handle: 0x0000011c	1	0
NtSetContextThread Sept. 17, 2024, 1:33 p.m.	registers.eip: 4214784 registers.esp: 1638384 registers.edi: 0 registers.eax: 4198508 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2005598660 thread_handle: 0x00000114 process_identifier: 2172	1	0
NtResumeThread Sept. 17, 2024, 1:33 p.m.	thread_handle: 0x00000114 suspend_count: 1 process_identifier: 2172	1	0
NtResumeThread Sept. 17, 2024, 1:33 p.m.	thread_handle: 0x00000184 suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread Sept. 17, 2024, 1:33 p.m.	thread_handle: 0x000001f4 suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread Sept. 17, 2024, 1:33 p.m.	thread_handle: 0x0000023c suspend_count: 1 process_identifier: 2116	1	0

File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 events)

Bkav	W32.Common.26C8E7C1
Lionic	Trojan.Win32.Azorult.i!c
Cynet	Malicious (score: 99)
Skyhigh	BehavesLike.Win32.VBObfus.dh
ALYac	Spyware.Infostealer.Azorult
Cylance	Unsafe
VIPRE	Gen:Variant.Ransom.Loki.13278
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Ransom.Loki.13278
K7GW	Trojan ( 005807ea1 )
K7AntiVirus	Trojan ( 005807ea1 )
Arcabit	Trojan.Ransom.Loki.D33DE
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Injector.EPVS
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Dropper.Raccoon-9884067-0
Kaspersky	Trojan-PSW.Win32.Azorult.apuh
Alibaba	TrojanPSW:Win32/Azorult.86dd4127
MicroWorld-eScan	Gen:Variant.Ransom.Loki.13278
Rising	Trojan.Injector!1.C6AF (CLASSIC)
Emsisoft	Gen:Variant.Ransom.Loki.13278 (B)
F-Secure	Heuristic.HEUR/AGEN.1335411
DrWeb	Trojan.Siggen14.56985
TrendMicro	TROJ_GEN.R002C0DIF24
McAfeeD	Real Protect-LS!1B2CAB632CC4
Trapmine	malicious.high.ml.score
CTX	exe.trojan.azorult
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
FireEye	Generic.mg.1b2cab632cc4fb94
Jiangmin	Trojan.PSW.Azorult.hse
Webroot	W32.Malware.Gen
Google	Detected
Avira	HEUR/AGEN.1335411
Antiy-AVL	Trojan[PSW]/Win32.AZORult
Kingsoft	malware.kb.a.998
Gridinsoft	Trojan.Win32.Downloader.oa!s1
Xcitium	Malware@#30iocbwx7jvxt
Microsoft	Trojan:Win32/Remcos!pz
ViRobot	Trojan.Win.Z.Injector.245760.A
ZoneAlarm	Trojan-PSW.Win32.Azorult.apuh
GData	Gen:Variant.Ransom.Loki.13278
AhnLab-V3	Trojan/Win.Fareit.R582735
McAfee	GenericRXPO-DO!1B2CAB632CC4
DeepInstinct	MALICIOUS
VBA32	BScope.TrojanPSW.Stelega
Malwarebytes	Generic.Malware.AI.DDS

kg.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All