What is Licensing.exe?
Licensing.exe is usually located in the 'c:\downloads\' folder.
Some of the anti-virus scanners at VirusTotal detected Licensing.exe.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
Vendor and version information [?]
The following is the available information on Licensing.exe:
| Property | Value |
|---|---|
| File version | 3, 3, 8, 1 |
Here's a screenshot of the file properties when displayed by Windows Explorer:
| File version | 3, 3, 8, 1 |
Digital signatures [?]
Licensing.exe is not signed.
VirusTotal report
48 of the 70 anti-virus programs at VirusTotal detected the Licensing.exe file. That's a 69% detection rate.
| Scanner | Detection Name |
|---|---|
| Acronis | suspicious |
| Ad-Aware | Trojan.Autoit.IHT |
| AegisLab | Trojan.Win32.Banload.a!c |
| AhnLab-V3 | Trojan/Win32.Inject.C582263 |
| APEX | Malicious |
| Arcabit | Trojan.Autoit.IHT |
| Avast | Win32:GenMalicious-TK [Trj] |
| AVG | Win32:GenMalicious-TK [Trj] |
| Avira | TR/Dropper.Gen |
| BitDefender | Trojan.Autoit.IHT |
| Bkav | W32.DropperZbotS.Trojan |
| CAT-QuickHeal | Backdoor.AutoIt.Fynloski.OC |
| CMC | Trojan-Spy.Win32.Zbot!O |
| Comodo | Malware@#vk864cjknudn |
| Cybereason | malicious.00af16 |
| Cylance | Unsafe |
| Cyren | W32/Trojan.POUO-0170 |
| Emsisoft | Trojan.Autoit.IHT (B) |
| Endgame | malicious (high confidence) |
| ESET-NOD32 | Win32/Packed.Autoit.F suspicious |
| F-Secure | Trojan.TR/Dropper.Gen |
| FireEye | Generic.mg.3b4383c00af16edf |
| Fortinet | W32/Fynloski.AM!tr |
| GData | Trojan.Autoit.IHT |
| Ikarus | Packer.Win32.Krap |
| Invincea | heuristic |
| K7AntiVirus | Trojan ( 700000111 ) |
| K7GW | Trojan ( 700000111 ) |
| Kaspersky | Trojan-Downloader.Win32.Banload.cvpp |
| MAX | malware (ai score=100) |
| McAfee | Artemis!3B4383C00AF1 |
| McAfee-GW-Edition | BehavesLike.Win32.Agent.wc |
| Microsoft | Trojan:Win32/Malagent!gmb |
| MicroWorld-eScan | Trojan.Autoit.IHT |
| NANO-Antivirus | Trojan.Script.Agent.debxaj |
| Paloalto | generic.ml |
| Panda | Trj/CI.A |
| Qihoo-360 | Win32/Trojan.Downloader.bdc |
| SentinelOne | DFI - Suspicious PE |
| Sophos | Troj/Malit-FE |
| Symantec | ML.Attribute.HighConfidence |
| TheHacker | Backdoor/Poison.evja |
| Trapmine | malicious.moderate.ml.score |
| TrendMicro | TROJ_DROPPER.QAA |
| TrendMicro-HouseCall | TROJ_DROPPER.QAA |
| VBA32 | BScope.Trojan.Toga |
| Zillya | Downloader.Banload.Win32.58776 |
| ZoneAlarm | Trojan-Downloader.Win32.Banload.cvpp |
Sandbox Report
The following information was gathered by executing the file inside Cuckoo Sandbox.
Summary
Successfully executed process in sandbox.
Summary
{
"file_created": [
"C:\\Users\\cuck\\AppData\\Local\\3.5.cfg"
],
"regkey_written": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ExtendedUIHoverTime",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Microsoft Run"
],
"dll_loaded": [
"Fwpuclnt.dll",
"kernel32.dll",
"UxTheme.dll",
"dwmapi.dll",
"ntdll.dll",
"WS2_32.DLL",
"C:\\Windows\\system32\\uxtheme.dll",
"API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
"comctl32",
"ole32.dll",
"imm32.dll",
"IMM32.dll",
"olepro32.dll",
"uxtheme.dll",
"OLEAUT32.dll",
"SHELL32.dll",
"CLBCatQ.DLL",
"comctl32.dll",
"SXS.DLL",
"ADVAPI32.dll",
"rpcrt4.dll",
"SETUPAPI.dll",
"user32.dll"
],
"file_opened": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"C:\\Users\\cuck\\AppData",
"C:\\",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
"C:\\Users\\desktop.ini",
"C:\\Windows\\System32\\wbem\\wbemdisp.tlb",
"C:\\Users\\cuck",
"C:\\Users",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck\\AppData\\Local"
],
"file_copied": [
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"C:\\Users\\cuck\\AppData\\Local\\cuck.exe"
]
],
"regkey_opened": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\PropertyBag",
"HKEY_CLASSES_ROOT\\Directory",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{565783C6-CB41-11D1-8B02-00600806D9B6}\\1.2\\0\\win32",
"HKEY_CURRENT_USER\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Keyboard Layouts\\04090409",
"HKEY_CURRENT_USER\\WbemScripting.SWbemLocator",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\Clsid",
"HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume",
"HKEY_CURRENT_USER\\Software\\CodeGear\\Locales",
"HKEY_CURRENT_USER\\Software\\Borland\\Locales",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\IconHandler",
"HKEY_CURRENT_USER\\Control Panel\\Mouse",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\Progid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\ShellEx\\IconHandler",
"HKEY_CURRENT_USER\\Software\\Embarcadero\\Locales",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\(Default)",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Explorer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\Clsid",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Explorer",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32",
"HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\Software\\CodeGear\\Locales",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\Directory",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WbemScripting.SWbemLocator\\CLSID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject",
"HKEY_CURRENT_USER\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\CurVer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{565783C6-CB41-11D1-8B02-00600806D9B6}\\1.2\\409",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{565783C6-CB41-11D1-8B02-00600806D9B6}\\1.2\\0",
"HKEY_CURRENT_USER\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{565783C6-CB41-11D1-8B02-00600806D9B6}\\1.2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{565783C6-CB41-11D1-8B02-00600806D9B6}\\1.0",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\InprocHandler32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}",
"HKEY_CURRENT_USER\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Shell\\RegisteredApplications\\UrlAssociations\\Directory\\OpenWithProgids",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocHandler",
"HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler",
"HKEY_CLASSES_ROOT\\Folder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{565783C6-CB41-11D1-8B02-00600806D9B6}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32",
"HKEY_CURRENT_USER\\Software\\AutoIt v3\\AutoIt",
"HKEY_CURRENT_USER\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32",
"HKEY_CURRENT_USER\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\Clsid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\InprocHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\TreatAs",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{565783C6-CB41-11D1-8B02-00600806D9B6}\\1.2\\9",
"HKEY_CURRENT_USER\\Interface\\{027947E1-D731-11CE-A357-000000000001}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\Progid",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\IconHandler",
"HKEY_CURRENT_USER\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\Progid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\Progid",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"HKEY_CURRENT_USER\\Software\\Borland\\Delphi\\Locales",
"HKEY_CLASSES_ROOT\\AllFilesystemObjects",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TreatAs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Keyboard Layouts\\041D0409",
"HKEY_LOCAL_MACHINE\\Software\\Embarcadero\\Locales",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\Progid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace",
"HKEY_CURRENT_USER\\TypeLib",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocHandler32"
],
"resolves_host": [
"smartvidas2014.no-ip.org",
"localhost"
],
"command_line": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin"
],
"file_exists": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"C:\\Program Files (x86)\\AVAST Software",
"C:\\Program Files (x86)\\AVG\\AVG2013\\avgmfapx.exe",
"C:\\Users\\cuck\\AppData\\Local\\3.5.cfg",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\0"
],
"mutex": [
"fdsfsdfsdf"
],
"guid": [
"{76a64158-cb41-11d1-8b02-00600806d9b6}",
"{f309ad18-d86a-11d0-a075-00c04fb68820}",
"{5762f2a7-4658-4c7a-a4ac-bdabfe154e0d}",
"{44aca674-e8fc-11d0-a07c-00c04fb68820}",
"{cf4cc405-e2c5-4ddd-b3ce-5e7582d8c9fa}",
"{674b6698-ee92-11d0-ad71-00c04fd8fdff}",
"{8bc3f05e-d86b-11d0-a075-00c04fb68820}",
"{d5f569d0-593b-101a-b569-08002b2dbf7a}",
"{7c857801-7381-11cf-884d-00aa004b2e24}",
"{3bc15af2-736c-477e-9e51-238af8667dcc}",
"{00020400-0000-0000-c000-000000000046}",
"{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"C:\\Users\\desktop.ini",
"C:\\Windows\\System32\\wbem\\wbemdisp.tlb"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\InitFolderHandler",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Filter",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORDISPLAY",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Attributes",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Domain",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideIcons",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsUniversalDelegate",
"HKEY_CURRENT_USER\\Control Panel\\Mouse\\SwapMouseButtons",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\PublishExpandedPath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForOverlay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\MapNetDriveVerbs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForInfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\NoFileFolderJunction",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\AlwaysShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsParseDisplayName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsAliasedNotifications",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\UseDropHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\IconsOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\PinToNameSpaceTree",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORPARSING",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\SeparateProcess",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\InProcServer32\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\AllowFileCLSIDJunctions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideFolderVerbs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetCrawling",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\ProductId",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Hostname",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\InProcServer32\\ThreadingModel",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideInWebView",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Roamable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\ThreadingModel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\InprocServer32",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\DevicePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowTypeOverlay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\InfoTip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\InProcServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HasNavigationEnum",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{565783C6-CB41-11D1-8B02-00600806D9B6}\\1.2\\0\\win32\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideOnDesktopPerUser",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WbemScripting.SWbemLocator\\CLSID\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSimpleStartMenu",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\\ProxyStubClsid32\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\ProgID\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Category"
],
"directory_enumerated": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.en-US",
"C:\\Users\\cuck\\AppData",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.EN",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.ENU",
"C:\\Users\\cuck",
"C:\\Users",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.en",
"C:\\Users\\cuck\\AppData\\Local"
]
}Generic
[
{
"process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"process_name": "ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"pid": 1664,
"summary": {
"dll_loaded": [
"UxTheme.dll",
"SETUPAPI.dll",
"IMM32.dll",
"dwmapi.dll",
"API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
"SHELL32.dll",
"kernel32.dll",
"uxtheme.dll",
"OLEAUT32.dll",
"rpcrt4.dll",
"ADVAPI32.dll",
"comctl32",
"ole32.dll",
"C:\\Windows\\system32\\uxtheme.dll",
"user32.dll",
"comctl32.dll"
],
"file_opened": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"C:\\Users\\cuck\\AppData",
"C:\\",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
"C:\\Users\\desktop.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck",
"C:\\Users",
"C:\\Users\\cuck\\AppData\\Local"
],
"regkey_opened": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\Clsid",
"HKEY_CLASSES_ROOT\\Directory",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\IconHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\ShellEx\\IconHandler",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Shell\\RegisteredApplications\\UrlAssociations\\Directory\\OpenWithProgids",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\Clsid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\IconHandler",
"HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Explorer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced",
"HKEY_CLASSES_ROOT\\Folder",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
"HKEY_CURRENT_USER\\Software\\AutoIt v3\\AutoIt",
"HKEY_CLASSES_ROOT\\AllFilesystemObjects",
"HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\Directory",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\Clsid",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_CURRENT_USER\\Control Panel\\Mouse",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\CurVer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\(Default)",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Explorer",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"
],
"command_line": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin"
],
"file_exists": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin"
],
"guid": [
"{5762f2a7-4658-4c7a-a4ac-bdabfe154e0d}",
"{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"C:\\Users\\desktop.ini"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\InitFolderHandler",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Filter",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORDISPLAY",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideIcons",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsUniversalDelegate",
"HKEY_CURRENT_USER\\Control Panel\\Mouse\\SwapMouseButtons",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\PublishExpandedPath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForOverlay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\MapNetDriveVerbs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForInfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\AlwaysShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsParseDisplayName",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsAliasedNotifications",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\UseDropHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\IconsOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\PinToNameSpaceTree",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORPARSING",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\FolderTypeID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\SeparateProcess",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\AllowFileCLSIDJunctions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideFolderVerbs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetCrawling",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Stream",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Roamable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\NoFileFolderJunction",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\DevicePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowTypeOverlay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideInWebView",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HasNavigationEnum",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\LocalizedName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideOnDesktopPerUser",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSimpleStartMenu",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Category"
],
"directory_enumerated": [
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck",
"C:\\Users\\cuck\\AppData",
"C:\\Users\\cuck\\AppData\\Local",
"C:\\Users"
]
},
"first_seen": 1567399985.6406,
"ppid": 2448
},
{
"process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"process_name": "ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"pid": 1516,
"summary": {
"file_created": [
"C:\\Users\\cuck\\AppData\\Local\\3.5.cfg"
],
"regkey_written": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ExtendedUIHoverTime",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Microsoft Run"
],
"dll_loaded": [
"ADVAPI32.dll",
"olepro32.dll",
"SXS.DLL",
"Fwpuclnt.dll",
"kernel32.dll",
"OLEAUT32.dll",
"dwmapi.dll",
"ntdll.dll",
"WS2_32.DLL",
"CLBCatQ.DLL",
"imm32.dll"
],
"file_opened": [
"C:\\Windows\\System32\\wbem\\wbemdisp.tlb",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
],
"file_copied": [
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"C:\\Users\\cuck\\AppData\\Local\\cuck.exe"
]
],
"regkey_opened": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TreatAs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\InprocHandler32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs",
"HKEY_CURRENT_USER\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\Progid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{565783C6-CB41-11D1-8B02-00600806D9B6}\\1.2\\0\\win32",
"HKEY_CURRENT_USER\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler",
"HKEY_CURRENT_USER\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}",
"HKEY_CURRENT_USER\\Interface\\{027947E1-D731-11CE-A357-000000000001}",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Keyboard Layouts\\04090409",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion",
"HKEY_CURRENT_USER\\WbemScripting.SWbemLocator",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocHandler",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\Progid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\Progid",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{565783C6-CB41-11D1-8B02-00600806D9B6}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32",
"HKEY_CURRENT_USER\\Software\\Borland\\Delphi\\Locales",
"HKEY_CURRENT_USER\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\Software\\CodeGear\\Locales",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WbemScripting.SWbemLocator\\CLSID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32",
"HKEY_CURRENT_USER\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}",
"HKEY_CURRENT_USER\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\InprocHandler",
"HKEY_CURRENT_USER\\Software\\Borland\\Locales",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\TreatAs",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Keyboard Layouts\\041D0409",
"HKEY_LOCAL_MACHINE\\Software\\Embarcadero\\Locales",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\Progid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{565783C6-CB41-11D1-8B02-00600806D9B6}\\1.2\\409",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\Progid",
"HKEY_CURRENT_USER\\Software\\CodeGear\\Locales",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\\ProxyStubClsid32",
"HKEY_CURRENT_USER\\Software\\Embarcadero\\Locales",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32",
"HKEY_CURRENT_USER\\TypeLib",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocHandler32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{565783C6-CB41-11D1-8B02-00600806D9B6}\\1.2\\9",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{565783C6-CB41-11D1-8B02-00600806D9B6}\\1.2\\0",
"HKEY_CURRENT_USER\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{565783C6-CB41-11D1-8B02-00600806D9B6}\\1.2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{565783C6-CB41-11D1-8B02-00600806D9B6}\\1.0"
],
"resolves_host": [
"smartvidas2014.no-ip.org",
"localhost"
],
"file_exists": [
"C:\\Program Files (x86)\\AVAST Software",
"C:\\Program Files (x86)\\AVG\\AVG2013\\avgmfapx.exe",
"C:\\Users\\cuck\\AppData\\Local\\3.5.cfg",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\0"
],
"mutex": [
"fdsfsdfsdf"
],
"guid": [
"{76a64158-cb41-11d1-8b02-00600806d9b6}",
"{f309ad18-d86a-11d0-a075-00c04fb68820}",
"{44aca674-e8fc-11d0-a07c-00c04fb68820}",
"{cf4cc405-e2c5-4ddd-b3ce-5e7582d8c9fa}",
"{674b6698-ee92-11d0-ad71-00c04fd8fdff}",
"{8bc3f05e-d86b-11d0-a075-00c04fb68820}",
"{d5f569d0-593b-101a-b569-08002b2dbf7a}",
"{7c857801-7381-11cf-884d-00aa004b2e24}",
"{3bc15af2-736c-477e-9e51-238af8667dcc}",
"{00020400-0000-0000-c000-000000000046}"
],
"file_read": [
"C:\\Windows\\System32\\wbem\\wbemdisp.tlb"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\InProcServer32\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\InProcServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\ProductId",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Hostname",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\InProcServer32\\ThreadingModel",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{565783C6-CB41-11D1-8B02-00600806D9B6}\\1.2\\0\\win32\\(Default)",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Domain",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WbemScripting.SWbemLocator\\CLSID\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\ThreadingModel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{76A64158-CB41-11D1-8B02-00600806D9B6}\\ProgID\\(Default)",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en"
],
"directory_enumerated": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.EN",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.ENU",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.en",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.en-US"
]
},
"first_seen": 1567399990.5149,
"ppid": 1664
},
{
"process_path": "C:\\Windows\\System32\\lsass.exe",
"process_name": "lsass.exe",
"pid": 476,
"summary": {},
"first_seen": 1567399985.3906,
"ppid": 376
}
]Signatures
[
{
"markcount": 2,
"families": [],
"description": "Queries for the computername",
"severity": 1,
"marks": [
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1567399990.6559,
"tid": 3016,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 493
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1567399990.6709,
"tid": 3016,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 508
}
],
"references": [],
"name": "antivm_queries_computername"
},
{
"markcount": 2,
"families": [],
"description": "Checks if process is being debugged by a debugger",
"severity": 1,
"marks": [
{
"call": {
"category": "system",
"status": 0,
"stacktrace": [],
"last_error": 0,
"nt_status": -1073741772,
"api": "IsDebuggerPresent",
"return_value": 0,
"arguments": {},
"time": 1567399985.7506,
"tid": 2736,
"flags": {}
},
"pid": 1664,
"type": "call",
"cid": 35
},
{
"call": {
"category": "system",
"status": 0,
"stacktrace": [],
"last_error": 0,
"nt_status": -1073741772,
"api": "IsDebuggerPresent",
"return_value": 0,
"arguments": {},
"time": 1567399985.7656,
"tid": 2736,
"flags": {}
},
"pid": 1664,
"type": "call",
"cid": 92
}
],
"references": [],
"name": "checks_debugger"
},
{
"markcount": 1,
"families": [],
"description": "Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available",
"severity": 1,
"marks": [
{
"call": {
"category": "system",
"status": 1,
"stacktrace": [],
"api": "GlobalMemoryStatusEx",
"return_value": 1,
"arguments": {},
"time": 1567399985.9066,
"tid": 1676,
"flags": {}
},
"pid": 1664,
"type": "call",
"cid": 709
}
],
"references": [],
"name": "antivm_memory_available"
},
{
"markcount": 117,
"families": [],
"description": "One or more processes crashed",
"severity": 1,
"marks": [
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nd\n3\n3\n7\n0\n \n@\n \n0\nx\n1\nc\n3\n3\n7\n0\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nd\n3\n5\na\n5\n \n@\n \n0\nx\n1\nc\n3\n5\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nd\n3\n6\n0\nd\n \n@\n \n0\nx\n1\nc\n3\n6\n0\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nd\n3\na\n2\n3\n \n@\n \n0\nx\n1\nc\n3\na\n2\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n3\nd\nc\n9\nb\n \n@\n \n0\nx\n2\n2\nd\nc\n9\nb\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\na\n0\n8\n \n@\n \n0\nx\nf\n6\na\n0\n8\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\na\n7\n4\n \n@\n \n0\nx\nf\n6\na\n7\n4\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 9174656,
"edi": 171,
"eax": 1447909480,
"ebp": 9174712,
"edx": 36787800,
"ebx": 89,
"esi": 2284668,
"ecx": 10
},
"exception": {
"instruction_r": "ed 89 5d fc 89 4d f8 5a 59 5b 58 33 c0 5a 59 59",
"symbol": "ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5+0xd32e9",
"instruction": "in eax, dx",
"module": "ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"exception_code": "0xc0000096",
"offset": 865001,
"address": "0x1c32e9"
}
},
"time": 1567399990.5929,
"tid": 3016,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 230
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nd\n3\n5\nb\ne\n \n@\n \n0\nx\n1\nc\n3\n5\nb\ne\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nd\n3\n6\n0\nd\n \n@\n \n0\nx\n1\nc\n3\n6\n0\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nd\n3\na\n2\n3\n \n@\n \n0\nx\n1\nc\n3\na\n2\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n3\nd\nc\n9\nb\n \n@\n \n0\nx\n2\n2\nd\nc\n9\nb\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\na\n0\n8\n \n@\n \n0\nx\nf\n6\na\n0\n8\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\na\n7\n4\n \n@\n \n0\nx\nf\n6\na\n7\n4\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 9174712,
"edi": 171,
"eax": 1,
"ebp": 9174724,
"edx": 1848072,
"ebx": 0,
"esi": 2284668,
"ecx": 1848658
},
"exception": {
"instruction_r": "0f 3f 07 0b 36 8b 04 24 64 89 05 00 00 00 00 83",
"symbol": "ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5+0xd352a",
"address": "0x1c352a",
"module": "ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"exception_code": "0xc000001d",
"offset": 865578
}
},
"time": 1567399990.5929,
"tid": 3016,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 231
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567399990.6399,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 423
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567399991.6399,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 692
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567399992.6399,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 707
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567399993.6709,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 722
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567399994.7029,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 739
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567399995.7339,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 754
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567399996.7339,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 769
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567399997.7339,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 784
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567399998.7339,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 799
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567399999.7339,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 814
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400000.7339,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 829
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400001.7339,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 844
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400002.7339,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 859
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400003.7339,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 874
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400004.7339,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 889
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400005.7339,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 904
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400006.7339,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 919
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400007.7339,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 934
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400008.7339,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 949
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400009.7339,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 964
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400010.7499,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 979
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400011.7499,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 994
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400012.7499,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1009
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400013.7649,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1024
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400014.7809,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1039
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400015.7809,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1054
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400016.7809,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1069
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400017.7809,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1084
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400018.7809,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1099
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400019.7959,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1114
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400020.8119,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1129
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400021.8119,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1144
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400022.8119,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1159
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400023.8279,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1174
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400024.8279,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1189
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400025.8279,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1204
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400026.8279,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1219
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400027.8279,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1234
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400028.8429,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1249
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400029.8429,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1264
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400030.8429,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1279
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400031.8429,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1294
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400032.8589,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1309
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400033.8589,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1324
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400034.8589,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1339
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400035.8589,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1354
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400036.8589,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1369
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n8\n1\n4\n \n@\n \n0\nx\n1\nd\n9\n8\n1\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n6\n9\na\n4\n \n@\n \n0\nx\n1\nd\n6\n9\na\n4\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\ne\n9\n3\n7\n3\n \n@\n \n0\nx\n1\nd\n9\n3\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\n6\ne\nb\n5\n \n@\n \n0\nx\n1\ne\n6\ne\nb\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nf\na\nb\na\n5\n \n@\n \n0\nx\n1\ne\na\nb\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n0\n1\n0\n7\n3\n \n@\n \n0\nx\n1\nf\n1\n0\n7\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n4\na\n4\n6\nd\n \n@\n \n0\nx\n1\n3\na\n4\n6\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\ne\n7\n2\n \n@\n \n0\nx\nf\n6\ne\n7\n2\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 61996320,
"edi": 11001,
"eax": 61996320,
"ebp": 61996400,
"edx": 0,
"ebx": 1918408,
"esi": 36835072,
"ecx": 7
},
"exception": {
"instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
"symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
"instruction": "leave",
"module": "KERNELBASE.dll",
"exception_code": "0xeedfade",
"offset": 46887,
"address": "0x75dbb727"
}
},
"time": 1567400037.8589,
"tid": 2256,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 1384
}
],
"references": [],
"name": "raises_exception"
},
{
"markcount": 0,
"families": [],
"description": "One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.",
"severity": 2,
"marks": [],
"references": [],
"name": "dumped_buffer"
},
{
"markcount": 4,
"families": [],
"description": "Allocates read-write-execute memory (usually to unpack itself)",
"severity": 2,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 1516,
"region_size": 4096,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 4096,
"base_address": "0x02390000"
},
"time": 1567399990.5929,
"tid": 3016,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT"
}
},
"pid": 1516,
"type": "call",
"cid": 150
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 1516,
"region_size": 4096,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 4096,
"base_address": "0x03b60000"
},
"time": 1567399990.7029,
"tid": 3016,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT"
}
},
"pid": 1516,
"type": "call",
"cid": 675
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtProtectVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 1516,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"length": 4096,
"protection": 64,
"process_handle": "0xffffffff",
"base_address": "0x75bc4000"
},
"time": 1567399990.7029,
"tid": 3016,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE"
}
},
"pid": 1516,
"type": "call",
"cid": 676
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtProtectVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 1516,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"length": 4096,
"protection": 64,
"process_handle": "0xffffffff",
"base_address": "0x75bc4000"
},
"time": 1567399990.7029,
"tid": 3016,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE"
}
},
"pid": 1516,
"type": "call",
"cid": 679
}
],
"references": [],
"name": "allocates_rwx"
},
{
"markcount": 0,
"families": [],
"description": "Checks whether any human activity is being performed by constantly checking whether the foreground window changed",
"severity": 2,
"marks": [],
"references": [
"https:\/\/www.virusbtn.com\/virusbulletin\/archive\/2015\/09\/vb201509-custom-packer.dkb"
],
"name": "antisandbox_foregroundwindows"
},
{
"markcount": 1,
"families": [],
"description": "A process attempted to delay the analysis task.",
"severity": 2,
"marks": [
{
"type": "generic",
"description": "ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin tried to sleep 288 seconds, actually delayed analysis time by 288 seconds"
}
],
"references": [],
"name": "antisandbox_sleep"
},
{
"markcount": 1,
"families": [],
"description": "One or more of the buffers contains an embedded PE file",
"severity": 3,
"marks": [
{
"category": "buffer",
"ioc": "Buffer with sha1: 5e8394d790ab0d2ffe9b8fccd87a6b52b9a7d08e",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "dumped_buffer2"
},
{
"markcount": 1,
"families": [],
"description": "Allocates execute permission to another process indicative of possible code injection",
"severity": 3,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 1516,
"region_size": 2535424,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000184",
"allocation_type": 12288,
"base_address": "0x000f0000"
},
"time": 1567399986.1096,
"tid": 2736,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 1664,
"type": "call",
"cid": 819
}
],
"references": [],
"name": "allocates_execute_remote_process"
},
{
"markcount": 2,
"families": [],
"description": "Attempts to identify installed AV products by installation directory",
"severity": 3,
"marks": [
{
"category": "file",
"ioc": "C:\\Program Files (x86)\\AVAST Software",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Program Files (x86)\\AVG\\AVG2013\\avgmfapx.exe",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "antiav_detectfile"
},
{
"markcount": 1,
"families": [],
"description": "Installs itself for autorun at Windows startup",
"severity": 3,
"marks": [
{
"type": "generic",
"reg_key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Microsoft Run",
"reg_value": "\"C:\\Users\\cuck\\AppData\\Local\\cuck.exe\""
}
],
"references": [],
"name": "persistence_autorun"
},
{
"markcount": 1,
"families": [],
"description": "Potential code injection by writing to the memory of another process",
"severity": 3,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 1516,
"buffer": "\u0000\u0000\u0000\u0000\u00ff\u00ff\u00ff\u00ff\u0000\u0000\u000f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00fb\u00ff(\u0002\u00fc\u00ffP\u0006\u00fd\u00ff\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0080\u009b\u0007m\u00e8\u00ff\u00ff\u0000\u0000\u0010\u0000\u0000 \u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000j\u0003\u0000\u0000H\u00e2\u00fd\u00ff\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u00b1\u001d\u0000\u0001\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000",
"process_handle": "0x00000184",
"base_address": "0xfffde000"
},
"time": 1567399988.4686,
"tid": 2736,
"flags": {}
},
"pid": 1664,
"type": "call",
"cid": 854
}
],
"references": [],
"name": "injection_write_memory"
},
{
"markcount": 2,
"families": [],
"description": "Used NtSetContextThread to modify a thread in a remote process indicative of process injection",
"severity": 3,
"marks": [
{
"category": "Process injection",
"ioc": "Process 1664 called NtSetContextThread to modify thread in remote process 1516",
"type": "ioc",
"description": null
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtSetContextThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x0000018c",
"registers": {
"eip": 2008678852,
"esp": 9175024,
"edi": 0,
"eax": 2285608,
"ebp": 0,
"edx": 0,
"ebx": -139264,
"esi": 0,
"ecx": 0
},
"process_identifier": 1516
},
"time": 1567399988.4686,
"tid": 2736,
"flags": {}
},
"pid": 1664,
"type": "call",
"cid": 858
}
],
"references": [
"www.endgame.com\/blog\/technical-blog\/ten-process-injection-techniques-technical-survey-common-and-trending-process"
],
"name": "injection_ntsetcontextthread"
},
{
"markcount": 2,
"families": [],
"description": "Resumed a suspended thread in a remote process potentially indicative of process injection",
"severity": 3,
"marks": [
{
"category": "Process injection",
"ioc": "Process 1664 resumed a thread in remote process 1516",
"type": "ioc",
"description": null
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtResumeThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x0000018c",
"suspend_count": 1,
"process_identifier": 1516
},
"time": 1567399990.4536,
"tid": 2736,
"flags": {}
},
"pid": 1664,
"type": "call",
"cid": 862
}
],
"references": [
"www.endgame.com\/blog\/technical-blog\/ten-process-injection-techniques-technical-survey-common-and-trending-process"
],
"name": "injection_resumethread"
},
{
"markcount": 1,
"families": [],
"description": "Detects VMWare through the in instruction feature",
"severity": 3,
"marks": [
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "f\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nd\n3\n3\n7\n0\n \n@\n \n0\nx\n1\nc\n3\n3\n7\n0\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nd\n3\n5\na\n5\n \n@\n \n0\nx\n1\nc\n3\n5\na\n5\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nd\n3\n6\n0\nd\n \n@\n \n0\nx\n1\nc\n3\n6\n0\nd\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\nd\n3\na\n2\n3\n \n@\n \n0\nx\n1\nc\n3\na\n2\n3\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n1\n3\nd\nc\n9\nb\n \n@\n \n0\nx\n2\n2\nd\nc\n9\nb\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\na\n0\n8\n \n@\n \n0\nx\nf\n6\na\n0\n8\n\n\nf\nf\na\na\nc\nc\n8\n8\na\n4\n3\n5\n4\n0\n3\n5\n1\n7\na\n0\n6\n1\nb\n7\n3\n2\n9\n2\n1\n3\nb\n1\n4\n9\na\nd\ne\n6\nf\n0\n7\n1\n5\nf\n0\nb\n2\na\n1\nf\n3\n2\n4\n9\n1\n5\na\n2\n8\ne\n0\n2\nc\n5\n+\n0\nx\n6\na\n7\n4\n \n@\n \n0\nx\nf\n6\na\n7\n4\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 9174656,
"edi": 171,
"eax": 1447909480,
"ebp": 9174712,
"edx": 36787800,
"ebx": 89,
"esi": 2284668,
"ecx": 10
},
"exception": {
"instruction_r": "ed 89 5d fc 89 4d f8 5a 59 5b 58 33 c0 5a 59 59",
"symbol": "ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5+0xd32e9",
"instruction": "in eax, dx",
"module": "ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"exception_code": "0xc0000096",
"offset": 865001,
"address": "0x1c32e9"
}
},
"time": 1567399990.5929,
"tid": 3016,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 230
}
],
"references": [],
"name": "antivm_vmware_in_instruction"
},
{
"markcount": 2,
"families": [],
"description": "Detects the presence of Wine emulator",
"severity": 3,
"marks": [
{
"call": {
"category": "system",
"status": 0,
"stacktrace": [],
"last_error": 0,
"nt_status": -1073741772,
"api": "LdrGetProcedureAddress",
"return_value": 3221225785,
"arguments": {
"ordinal": 0,
"module": "ntdll",
"module_address": "0x77b90000",
"function_address": "0x023284ec",
"function_name": "wine_get_version"
},
"time": 1567399990.5929,
"tid": 3016,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 227
},
{
"call": {
"category": "system",
"status": 0,
"stacktrace": [],
"last_error": 127,
"nt_status": -1073741511,
"api": "LdrGetProcedureAddress",
"return_value": 3221225785,
"arguments": {
"ordinal": 0,
"module": "ntdll",
"module_address": "0x77b90000",
"function_address": "0x0232f6fc",
"function_name": "wine_nt_to_unix_file_name"
},
"time": 1567399990.5929,
"tid": 3016,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 228
}
],
"references": [],
"name": "antiemu_wine"
},
{
"markcount": 10,
"families": [],
"description": "Executed a process and injected code into it, probably while unpacking",
"severity": 5,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "CreateProcessInternalW",
"return_value": 1,
"arguments": {
"thread_identifier": 3016,
"thread_handle": "0x0000018c",
"process_identifier": 1516,
"current_directory": "",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"track": 1,
"command_line": "",
"filepath_r": "C:\\Users\\cuck\\AppData\\Local\\Temp\\ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5.bin",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000184",
"inherit_handles": 0
},
"time": 1567399986.0316,
"tid": 2736,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 1664,
"type": "call",
"cid": 810
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtGetContextThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x0000018c"
},
"time": 1567399986.0786,
"tid": 2736,
"flags": {}
},
"pid": 1664,
"type": "call",
"cid": 815
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 1516,
"region_size": 2535424,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000184",
"allocation_type": 12288,
"base_address": "0x000f0000"
},
"time": 1567399986.1096,
"tid": 2736,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 1664,
"type": "call",
"cid": 819
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"buffer": "5e8394d790ab0d2ffe9b8fccd87a6b52b9a7d08e",
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 1516,
"buffer": "",
"process_handle": "0x00000184",
"base_address": "0x000f0000"
},
"time": 1567399987.4376,
"tid": 2736,
"flags": {}
},
"pid": 1664,
"type": "call",
"cid": 842
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 1516,
"buffer": "\u0000\u0000\u0000\u0000\u00ff\u00ff\u00ff\u00ff\u0000\u0000\u000f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00fb\u00ff(\u0002\u00fc\u00ffP\u0006\u00fd\u00ff\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0080\u009b\u0007m\u00e8\u00ff\u00ff\u0000\u0000\u0010\u0000\u0000 \u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000j\u0003\u0000\u0000H\u00e2\u00fd\u00ff\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u00b1\u001d\u0000\u0001\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000",
"process_handle": "0x00000184",
"base_address": "0xfffde000"
},
"time": 1567399988.4686,
"tid": 2736,
"flags": {}
},
"pid": 1664,
"type": "call",
"cid": 854
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtSetContextThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x0000018c",
"registers": {
"eip": 2008678852,
"esp": 9175024,
"edi": 0,
"eax": 2285608,
"ebp": 0,
"edx": 0,
"ebx": -139264,
"esi": 0,
"ecx": 0
},
"process_identifier": 1516
},
"time": 1567399988.4686,
"tid": 2736,
"flags": {}
},
"pid": 1664,
"type": "call",
"cid": 858
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtResumeThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x0000018c",
"suspend_count": 1,
"process_identifier": 1516
},
"time": 1567399990.4536,
"tid": 2736,
"flags": {}
},
"pid": 1664,
"type": "call",
"cid": 862
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtResumeThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x00000130",
"suspend_count": 1,
"process_identifier": 1516
},
"time": 1567399990.6089,
"tid": 3016,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 295
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtResumeThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x00000170",
"suspend_count": 1,
"process_identifier": 1516
},
"time": 1567399990.7029,
"tid": 3016,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 670
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtResumeThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x00000170",
"suspend_count": 0,
"process_identifier": 1516
},
"time": 1567399990.7029,
"tid": 3016,
"flags": {}
},
"pid": 1516,
"type": "call",
"cid": 671
}
],
"references": [],
"name": "injection_runpe"
}
]Yara
The Yara rules did not detect anything in the file.
Network
{
"tls": [],
"udp": [
{
"src": "192.168.56.101",
"dst": "192.168.56.255",
"offset": 662,
"time": 6.2036650180817,
"dport": 137,
"sport": 137
},
{
"src": "192.168.56.101",
"dst": "192.168.56.255",
"offset": 5342,
"time": 12.203904151917,
"dport": 138,
"sport": 138
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7186,
"time": 6.1398091316223,
"dport": 5355,
"sport": 51001
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7514,
"time": 4.1373460292816,
"dport": 5355,
"sport": 53595
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7842,
"time": 6.1494801044464,
"dport": 5355,
"sport": 53848
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 8170,
"time": 4.7900879383087,
"dport": 5355,
"sport": 54255
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 8498,
"time": 3.025563955307,
"dport": 5355,
"sport": 55314
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 8826,
"time": 4.7045900821686,
"dport": 1900,
"sport": 1900
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 28236,
"time": 4.172835111618,
"dport": 3702,
"sport": 49152
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 36620,
"time": 6.2499899864197,
"dport": 1900,
"sport": 53598
}
],
"dns_servers": [],
"http": [],
"icmp": [],
"smtp": [],
"tcp": [],
"smtp_ex": [],
"mitm": [],
"hosts": [],
"pcap_sha256": "b679ccc18eca8e07f8cf45add42a23dc47fb533d3baad114df43db45036b5b89",
"dns": [],
"http_ex": [],
"domains": [],
"dead_hosts": [],
"sorted_pcap_sha256": "cfdb285a4a8da1844042a1b1d43a80ad635b977187401e17d04dbdec806ce8c0",
"irc": [],
"https_ex": []
}Screenshots
Licensing.exe removal instructions
The instructions below shows how to remove Licensing.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the Licensing.exe file for removal, restart your computer and scan it again to verify that Licensing.exe has been successfully removed. Here are the removal instructions in more detail:
- Download and install FreeFixer: http://www.freefixer.com/download.html
- Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes.
- When the scan is finished, locate Licensing.exe in the scan result and tick the checkbox next to the Licensing.exe file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate Licensing.exe in the scan result.
c:\downloads\Licensing.exe 
- Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the Licensing.exe file.
- Restart your computer.
- Start FreeFixer and scan your computer again. If Licensing.exe still remains in the scan result, proceed with the next step. If Licensing.exe is gone from the scan result you're done.
- If Licensing.exe still remains in the scan result, check its checkbox again in the scan result and click Fix.
- Restart your computer.
- Start FreeFixer and scan your computer again. Verify that Licensing.exe no longer appear in the scan result.
Hashes [?]
| Property | Value |
|---|---|
| MD5 | 3b4383c00af16edf141a00ba94548357 |
| SHA256 | ffaacc88a435403517a061b7329213b149ade6f0715f0b2a1f324915a28e02c5 |
Error Messages
These are some of the error messages that can appear related to licensing.exe:
licensing.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
licensing.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
licensing.exe has stopped working.
End Program - licensing.exe. This program is not responding.
licensing.exe is not a valid Win32 application.
licensing.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
What will you do with Licensing.exe?
To help other users, please let us know what you will do with Licensing.exe:
Comments
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
No comments posted yet.