popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ADV.exe

Generic Malware UPX Malicious Packer SMTP KeyLogger AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Aug. 2, 2021, 5:51 p.m. Aug. 2, 2021, 6:02 p.m.
Size 952.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 325fb848ba8b93295817fff534bd1a75
SHA256 ad34fe380bb9d7aca419a4da6729eb22cfc64f3003bda67acc3267cdc4ccdb21
CRC32 83CA269B
ssdeep 12288:pig98EJXfXUynYURmNX8afLesVLJKMkPKqjeTfhf4phj+Q+JzlmaH0bDZ5FncWdD:pig9VU6mDLB0om2C7TK9HIt5FcsD
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • UPX_Zero - UPX packed file
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
checkip.dyndns.org
A 132.226.8.169
CNAME checkip.dyndns.com
A 193.122.130.0
A 132.226.247.73
A 158.101.44.242
A 193.122.6.168
193.122.6.168
freegeoip.app
A 104.21.19.200
A 172.67.188.154
104.21.19.200
IP Address Status Action
132.226.247.73 Active Moloch
164.124.101.2 Active Moloch
172.67.188.154 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49165 -> 172.67.188.154:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.102:63203 -> 164.124.101.2:53 2012758 ET INFO DYNAMIC_DNS Query to *.dyndns. Domain Misc activity
TCP 192.168.56.102:49164 -> 132.226.247.73:80 2021378 ET POLICY External IP Lookup - checkip.dyndns.org Device Retrieving External IP Address Detected
TCP 192.168.56.102:49164 -> 132.226.247.73:80 2021378 ET POLICY External IP Lookup - checkip.dyndns.org Device Retrieving External IP Address Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49165
172.67.188.154:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com b4:1d:91:d8:54:ad:34:b6:35:88:c9:90:a4:e5:95:8d:b0:d1:ec:05

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
0x5379d3
0x532778
0x53187b
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 8b 50 04 83 c2 ff 71 05 e8 ff a3 82 73 83 c2 01
exception.instruction: mov edx, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x538cd6
registers.esp: 3073460
registers.edi: 3074296
registers.eax: 0
registers.ebp: 3075488
registers.edx: 0
registers.ebx: 44218560
registers.esi: 44218532
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x5379d3
0x532778
0x53187b
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 8b 40 04 83 c0 ff 71 05 e8 ab a3 82 73 89 85 70
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x538d2a
registers.esp: 3073460
registers.edi: 3074296
registers.eax: 0
registers.ebp: 3075488
registers.edx: 0
registers.ebx: 44218560
registers.esi: 44218532
registers.ecx: 3073460
1 0 0

__exception__

 stacktrace: 
0x5379d3
0x532778
0x53187b
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 c4 a2 82 73 c1 e0 04 8d 44 02
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x538d5e
registers.esp: 3073460
registers.edi: 3074296
registers.eax: 0
registers.ebp: 3075488
registers.edx: 0
registers.ebx: 44218560
registers.esi: 44218532
registers.ecx: 3073460
1 0 0

__exception__

 stacktrace: 
0x5379d3
0x532778
0x53187b
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 76 a2 82 73 c1 e0 04 8d 44 02
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x538dac
registers.esp: 3073460
registers.edi: 3074296
registers.eax: 0
registers.ebp: 3075488
registers.edx: 0
registers.ebx: 44218560
registers.esi: 44218532
registers.ecx: 3073460
1 0 0

__exception__

 stacktrace: 
0x5379d3
0x532778
0x53187b
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 0a a0 82 73 c1 e0 04 8d 44 02
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x539018
registers.esp: 3073456
registers.edi: 3073700
registers.eax: 0
registers.ebp: 3075488
registers.edx: 0
registers.ebx: 44218560
registers.esi: 44218532
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x5379d3
0x532778
0x53187b
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 4b 04 72 05 e8 4f 96 82 73 c1 e1 04 8d 4c 0b
exception.instruction: cmp ecx, dword ptr [ebx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x5399d3
registers.esp: 3073460
registers.edi: 3073700
registers.eax: 0
registers.ebp: 3075488
registers.edx: 0
registers.ebx: 0
registers.esi: 44218532
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x53a748
0x5327d2
0x53187b
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 0f 9d c0 0f b6 c0 89 45 c8 83 7d c8 00
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x53a954
registers.esp: 3075508
registers.edi: 0
registers.eax: 0
registers.ebp: 3075592
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 44672120
1 0 0

__exception__

 stacktrace: 
0x53a748
0x5327f5
0x53187b
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 0f 9d c0 0f b6 c0 89 45 c8 83 7d c8 00
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x53a954
registers.esp: 3075508
registers.edi: 0
registers.eax: 3
registers.ebp: 3075592
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 44672120
1 0 0

__exception__

 stacktrace: 
0x53a748
0x532818
0x53187b
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 0f 9d c0 0f b6 c0 89 45 c8 83 7d c8 00
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x53a954
registers.esp: 3075508
registers.edi: 0
registers.eax: 5
registers.ebp: 3075592
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 44672120
1 0 0

__exception__

 stacktrace: 
0x532830
0x53187b
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 39 09 e8 7c c0 59 71 89 45 ec 6a 00 8b 15 e0 20
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x53ab0d
registers.esp: 3075696
registers.edi: 0
registers.eax: 3961084
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x5318c2
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 39 09 e8 bf 75 50 71 89 85 d8 fe ff ff 8b 8d d8
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x53cb6a
registers.esp: 3075512
registers.edi: 3075912
registers.eax: 0
registers.ebp: 3075928
registers.edx: 43258264
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x53d5fe
0x5318c9
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 8b 40 04 89 45 c8 33 d2 89 55 c4 90 e9 96 00 00
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537580
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 44206856
1 0 0

__exception__

 stacktrace: 
0x53d5fe
0x5318c9
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 81 ba 82 73 c1 e0 05 8d 44 02
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x5375a1
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53d5fe
0x5318c9
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 b3 b9 82 73 c1 e0 05 8d 44 02
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x53766f
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53d5fe
0x5318c9
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 8b 40 04 83 c0 ff 71 05 e8 a1 b9 82 73 89 45 b8
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537734
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53d5fe
0x5318c9
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 b1 b8 82 73 8b 4c 82 0c e8 9c
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537771
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53d5fe
0x5318c9
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 74 b8 82 73 8b 4c 82 0c 8b 15
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x5377ae
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53d5fe
0x5318c9
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 c4 b7 82 73 8b 4c 82 0c 8b 15
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x53785e
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53d5fe
0x5318c9
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 99 b6 82 73 c1 e0 05 8d 44 02
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537989
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53da4e
0x5318d0
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 8b 40 04 89 45 c8 33 d2 89 55 c4 90 e9 96 00 00
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537580
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 44206856
1 0 0

__exception__

 stacktrace: 
0x53da4e
0x5318d0
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 81 ba 82 73 c1 e0 05 8d 44 02
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x5375a1
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53da4e
0x5318d0
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 b3 b9 82 73 c1 e0 05 8d 44 02
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x53766f
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53da4e
0x5318d0
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 8b 40 04 83 c0 ff 71 05 e8 a1 b9 82 73 89 45 b8
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537734
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53da4e
0x5318d0
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 b1 b8 82 73 8b 4c 82 0c e8 9c
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537771
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53da4e
0x5318d0
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 74 b8 82 73 8b 4c 82 0c 8b 15
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x5377ae
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53da4e
0x5318d0
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 c4 b7 82 73 8b 4c 82 0c 8b 15
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x53785e
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53da4e
0x5318d0
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 99 b6 82 73 c1 e0 05 8d 44 02
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537989
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53de9e
0x5318d7
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 8b 40 04 89 45 c8 33 d2 89 55 c4 90 e9 96 00 00
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537580
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 44206856
1 0 0

__exception__

 stacktrace: 
0x53de9e
0x5318d7
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 81 ba 82 73 c1 e0 05 8d 44 02
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x5375a1
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53de9e
0x5318d7
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 b3 b9 82 73 c1 e0 05 8d 44 02
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x53766f
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53de9e
0x5318d7
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 8b 40 04 83 c0 ff 71 05 e8 a1 b9 82 73 89 45 b8
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537734
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53de9e
0x5318d7
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 b1 b8 82 73 8b 4c 82 0c e8 9c
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537771
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53de9e
0x5318d7
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 74 b8 82 73 8b 4c 82 0c 8b 15
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x5377ae
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53de9e
0x5318d7
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 c4 b7 82 73 8b 4c 82 0c 8b 15
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x53785e
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53de9e
0x5318d7
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 99 b6 82 73 c1 e0 05 8d 44 02
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537989
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53e2ee
0x5318de
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 8b 40 04 89 45 c8 33 d2 89 55 c4 90 e9 96 00 00
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537580
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 44206856
1 0 0

__exception__

 stacktrace: 
0x53e2ee
0x5318de
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 81 ba 82 73 c1 e0 05 8d 44 02
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x5375a1
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53e2ee
0x5318de
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 b3 b9 82 73 c1 e0 05 8d 44 02
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x53766f
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53e2ee
0x5318de
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 8b 40 04 83 c0 ff 71 05 e8 a1 b9 82 73 89 45 b8
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537734
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53e2ee
0x5318de
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 b1 b8 82 73 8b 4c 82 0c e8 9c
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537771
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53e2ee
0x5318de
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 74 b8 82 73 8b 4c 82 0c 8b 15
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x5377ae
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53e2ee
0x5318de
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 c4 b7 82 73 8b 4c 82 0c 8b 15
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x53785e
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53e2ee
0x5318de
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 99 b6 82 73 c1 e0 05 8d 44 02
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537989
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53e73e
0x5318e5
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 8b 40 04 89 45 c8 33 d2 89 55 c4 90 e9 96 00 00
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537580
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 44206856
1 0 0

__exception__

 stacktrace: 
0x53e73e
0x5318e5
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 81 ba 82 73 c1 e0 05 8d 44 02
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x5375a1
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53e73e
0x5318e5
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 b3 b9 82 73 c1 e0 05 8d 44 02
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x53766f
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53e73e
0x5318e5
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 8b 40 04 83 c0 ff 71 05 e8 a1 b9 82 73 89 45 b8
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537734
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53e73e
0x5318e5
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 b1 b8 82 73 8b 4c 82 0c e8 9c
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x537771
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53e73e
0x5318e5
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 74 b8 82 73 8b 4c 82 0c 8b 15
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x5377ae
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0

__exception__

 stacktrace: 
0x53e73e
0x5318e5
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73ae1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73af8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73b06a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73b06a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73b06a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ba6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ba69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ba6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ba70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ba6fe4
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7409f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 3b 42 04 72 05 e8 c4 b7 82 73 8b 4c 82 0c 8b 15
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x53785e
registers.esp: 3075504
registers.edi: 0
registers.eax: 0
registers.ebp: 3075720
registers.edx: 0
registers.ebx: 3075996
registers.esi: 7933616
registers.ecx: 3075504
1 0 0
suspicious_features GET method with no useragent header suspicious_request GET https://freegeoip.app/xml/175.208.134.150
domain checkip.dyndns.org
request GET http://checkip.dyndns.org/
request GET https://freegeoip.app/xml/175.208.134.150
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2068
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00770000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2068
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73b61000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2068
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73b62000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2068
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00532000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2068
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00542000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2068
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00543000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2068
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0057b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2068
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00577000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2068
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2068
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00710000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2068
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00711000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2068
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0107f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0107f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f90000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f90000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f90000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f92000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01054000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2068
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00544000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2068
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0056a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
description ADV.exe tried to sleep 206 seconds, actually delayed analysis time by 206 seconds
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera\profile\wand.dat
file C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Ya Login Data
domain checkip.dyndns.org
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
section {u'size_of_data': u'0x000ed800', u'virtual_address': u'0x00002000', u'entropy': 7.503268735873878, u'name': u'.text', u'virtual_size': u'0x000ed6b4'} entropy 7.50326873587 description A section with a high entropy has been found
entropy 0.997899159664 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Communications smtp rule Network_SMTP_dotNet
description Run a KeyLogger rule KeyLogger
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2452
region_size: 294912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002b0
1 0 0
file C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\test22\AppData\Roaming\.purple\accounts.xml
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELZ–·`à 2 @@ €@…¼1O@Þ`  H.text  `.rsrcÞ@@@.reloc `@B
base_address: 0x00400000
process_identifier: 2452
process_handle: 0x000002b0
1 1 0

WriteProcessMemory

 buffer:  €P€8€€h€ @TôCêT4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°´StringFileInfo000004b0Comments"CompanyNameZFileDescriptionSnake Keylogger Stub New0FileVersion1.0.0.06 InternalNameStubV2.exeHLegalCopyrightCopyright © 2021*LegalTrademarks> OriginalFilenameStubV2.exeRProductNameSnake Keylogger Stub New4ProductVersion1.0.0.08Assembly Version1.0.0.0<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x00444000
process_identifier: 2452
process_handle: 0x000002b0
1 1 0

WriteProcessMemory

 buffer: 0 2
base_address: 0x00446000
process_identifier: 2452
process_handle: 0x000002b0
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2452
process_handle: 0x000002b0
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELZ–·`à 2 @@ €@…¼1O@Þ`  H.text  `.rsrcÞ@@@.reloc `@B
base_address: 0x00400000
process_identifier: 2452
process_handle: 0x000002b0
1 1 0
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x009d0b9a
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x00000000
1 8847715 0
registry HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
registry HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Process injection Process 2068 called NtSetContextThread to modify thread in remote process 2452
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4469262
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000002ac
process_identifier: 2452
1 0 0
Process injection Process 2068 resumed a thread in remote process 2452
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000002ac
suspend_count: 1
process_identifier: 2452
1 0 0
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Bulz.584517
FireEye Generic.mg.325fb848ba8b9329
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Arcabit Trojan.Bulz.D8EB45
Cyren W32/MSIL_Kryptik.EZZ.gen!Eldorado
Symantec Scr.Malcode!gdn30
ESET-NOD32 a variant of MSIL/Kryptik.ACEU
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Gen:Variant.Bulz.584517
Ad-Aware Gen:Variant.Bulz.584517
Sophos ML/PE-A
McAfee-GW-Edition BehavesLike.Win32.Fareit.dc
Emsisoft Gen:Variant.Bulz.584517 (B)
Microsoft Trojan:Win32/Wacatac.B!ml
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Gen:Variant.Bulz.584517
Cynet Malicious (score: 100)
MAX malware (ai score=86)
VBA32 CIL.HeapOverride.Heur
Malwarebytes Malware.AI.3242361281
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
BitDefenderTheta Gen:NN.ZemsilF.34050.7m0@a0Xu5Ie
CrowdStrike win/malicious_confidence_100% (D)
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 2068
1 0 0

NtResumeThread

 thread_handle: 0x00000158
suspend_count: 1
process_identifier: 2068
1 0 0

NtResumeThread

 thread_handle: 0x00000224
suspend_count: 1
process_identifier: 2068
1 0 0

NtResumeThread

 thread_handle: 0x00000238
suspend_count: 1
process_identifier: 2068
1 0 0

CreateProcessInternalW

 thread_identifier: 2456
thread_handle: 0x000002ac
process_identifier: 2452
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\ADV.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\test22\AppData\Local\Temp\ADV.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000002b0
1 1 0

NtGetContextThread

 thread_handle: 0x000002ac
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2452
region_size: 294912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002b0
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELZ–·`à 2 @@ €@…¼1O@Þ`  H.text  `.rsrcÞ@@@.reloc `@B
base_address: 0x00400000
process_identifier: 2452
process_handle: 0x000002b0
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 2452
process_handle: 0x000002b0
1 1 0

WriteProcessMemory

 buffer:  €P€8€€h€ @TôCêT4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°´StringFileInfo000004b0Comments"CompanyNameZFileDescriptionSnake Keylogger Stub New0FileVersion1.0.0.06 InternalNameStubV2.exeHLegalCopyrightCopyright © 2021*LegalTrademarks> OriginalFilenameStubV2.exeRProductNameSnake Keylogger Stub New4ProductVersion1.0.0.08Assembly Version1.0.0.0<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x00444000
process_identifier: 2452
process_handle: 0x000002b0
1 1 0

WriteProcessMemory

 buffer: 0 2
base_address: 0x00446000
process_identifier: 2452
process_handle: 0x000002b0
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2452
process_handle: 0x000002b0
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4469262
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000002ac
process_identifier: 2452
1 0 0

NtResumeThread

 thread_handle: 0x000002ac
suspend_count: 1
process_identifier: 2452
1 0 0

NtResumeThread

 thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 2452
1 0 0

NtResumeThread

 thread_handle: 0x00000158
suspend_count: 1
process_identifier: 2452
1 0 0

NtResumeThread

 thread_handle: 0x00000380
suspend_count: 1
process_identifier: 2452
1 0 0

NtResumeThread

 thread_handle: 0x000005d8
suspend_count: 1
process_identifier: 2452
1 0 0

NtResumeThread

 thread_handle: 0x000005ec
suspend_count: 1
process_identifier: 2452
1 0 0