Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Dec. 22, 2023, 8:14 a.m.	Dec. 22, 2023, 8:21 a.m.

Size	5.2MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`04f93f610df4d1c941ec7f64679e3039`
SHA256	`351fadc9f1ddd2bd6bd34ceed2353b8211123e057b52c6aeb60a28643d92f137`
CRC32	`485F7230`
ssdeep	`49152:8jxUCLBTkbWcYz5rTyMHUORJeiHkcO09cl2xeAEynEOsFDqnNg9QFiDxAdlv+nZq:6UCpkUHUyeiHK2r8FDkNgyFo51C2ARt`
PDB Path	free_program_developed_by_students.pdb
Yara	IsPE32 - (no description) PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult UPX_Zero - UPX packed file

v1220-55000.exe "C:\Users\test22\AppData\Local\Temp\v1220-55000.exe"
1960
- RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  2364

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 22, 2023, 8:14 a.m.			0	0
IsDebuggerPresent Dec. 22, 2023, 8:14 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey Dec. 22, 2023, 8:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004c02f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 22, 2023, 8:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004c0330 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 22, 2023, 8:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004c0330 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 22, 2023, 8:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004c0630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 22, 2023, 8:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004c0630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 22, 2023, 8:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004c06f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

free_program_developed_by_students.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 22, 2023, 8:14 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sdata

One or more processes crashed (27 events)

Time & API	Arguments	Status
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 RtlDeleteBoundaryDescriptor+0x1b RtlAnsiStringToUnicodeString-0x2d ntdll+0x2e688 @ 0x778ce688 RtlMultiByteToUnicodeN+0x11a RtlDeleteBoundaryDescriptor-0xe ntdll+0x2e65f @ 0x778ce65f EtwEventRegister+0x17f EtwRegisterTraceGuidsW-0xa ntdll+0x3f839 @ 0x778df839 LdrGetProcedureAddressEx+0x11f wcsstr-0x99d ntdll+0x302ea @ 0x778d02ea LdrGetProcedureAddress+0x18 LdrGetProcedureAddressEx-0x9 ntdll+0x301c2 @ 0x778d01c2 New_ntdll_LdrGetProcedureAddress@16+0xcd New_ntdll_LdrLoadDll@16-0x87 @ 0x7466d3cd GetProcAddress+0x44 GetVersion-0x38 kernelbase+0x111c4 @ 0x755a11c4 CreateAssemblyNameObject+0xe4d1 GetMetaDataInternalInterface-0x29f9e clr+0x3b96a @ 0x73f6b96a CoUninitializeEE+0xa200 CreateAssemblyNameObject-0x3a55 clr+0x29a44 @ 0x73f59a44 CoUninitializeEE+0xa149 CreateAssemblyNameObject-0x3b0c clr+0x2998d @ 0x73f5998d CoUninitializeEE+0xa055 CreateAssemblyNameObject-0x3c00 clr+0x29899 @ 0x73f59899 CoUninitializeEE+0x9fee CreateAssemblyNameObject-0x3c67 clr+0x29832 @ 0x73f59832 DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x73f4bcd5 DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x73f32ae9 system+0x1ca9e1 @ 0x711ea9e1 system+0x75b20d @ 0x7177b20d 0x2548690 0x23f13f4 system+0x1f9799 @ 0x71219799 system+0x1f92c8 @ 0x712192c8 system+0x1eca74 @ 0x7120ca74 system+0x1ec868 @ 0x7120c868 system+0x1f82b8 @ 0x712182b8 system+0x1ee54d @ 0x7120e54d system+0x1f70ea @ 0x712170ea system+0x1e56c0 @ 0x712056c0 system+0x1f8215 @ 0x71218215 system+0x1f6f75 @ 0x71216f75 system+0x1ee251 @ 0x7120e251 system+0x1ee229 @ 0x7120e229 system+0x1ee170 @ 0x7120e170 0x75a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755f62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755f6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755f6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755f6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x778b011a system+0x1ebc85 @ 0x7120bc85 system+0x1f683b @ 0x7121683b system+0x1a5e44 @ 0x711c5e44 system+0x1fd8a0 @ 0x7121d8a0 system+0x1fd792 @ 0x7121d792 system+0x1a14bd @ 0x711c14bd 0x23f028f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73ff74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73ff7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74081dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74081e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74081f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7408416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1828388 registers.edi: 4061200384 registers.eax: 0 registers.ebp: 1828440 registers.edx: 0 registers.ebx: 4061200385 registers.esi: 1954625110 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 CoUninitializeEE+0x9bdc CreateAssemblyNameObject-0x4079 clr+0x29420 @ 0x73f59420 GetPrivateContextsPerfCounters+0x10ed DllGetActivationFactoryImpl-0x13778 clr+0x8906f @ 0x73fb906f mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 RtlDeleteBoundaryDescriptor+0x1b RtlAnsiStringToUnicodeString-0x2d ntdll+0x2e688 @ 0x778ce688 RtlMultiByteToUnicodeN+0x11a RtlDeleteBoundaryDescriptor-0xe ntdll+0x2e65f @ 0x778ce65f EtwEventRegister+0x17f EtwRegisterTraceGuidsW-0xa ntdll+0x3f839 @ 0x778df839 LdrGetProcedureAddressEx+0x11f wcsstr-0x99d ntdll+0x302ea @ 0x778d02ea LdrGetProcedureAddress+0x18 LdrGetProcedureAddressEx-0x9 ntdll+0x301c2 @ 0x778d01c2 New_ntdll_LdrGetProcedureAddress@16+0xcd New_ntdll_LdrLoadDll@16-0x87 @ 0x7466d3cd GetProcAddress+0x44 GetVersion-0x38 kernelbase+0x111c4 @ 0x755a11c4 CreateAssemblyNameObject+0xe4d1 GetMetaDataInternalInterface-0x29f9e clr+0x3b96a @ 0x73f6b96a CoUninitializeEE+0xa200 CreateAssemblyNameObject-0x3a55 clr+0x29a44 @ 0x73f59a44 CoUninitializeEE+0xa149 CreateAssemblyNameObject-0x3b0c clr+0x2998d @ 0x73f5998d CoUninitializeEE+0xa055 CreateAssemblyNameObject-0x3c00 clr+0x29899 @ 0x73f59899 CoUninitializeEE+0x9fee CreateAssemblyNameObject-0x3c67 clr+0x29832 @ 0x73f59832 DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x73f4bcd5 DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x73f32ae9 system+0x1ca9e1 @ 0x711ea9e1 system+0x75b20d @ 0x7177b20d 0x2548690 0x23f13f4 system+0x1f9799 @ 0x71219799 system+0x1f92c8 @ 0x712192c8 exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1823240 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1823292 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 RtlFreeSid+0x1b RtlAllocateAndInitializeSid-0x15 ntdll+0x393cd @ 0x778d93cd GetComputerNameA+0xa84 GetFileInformationByHandleEx-0x62b kernel32+0x2c164 @ 0x7580c164 GetComputerNameA+0xaef GetFileInformationByHandleEx-0x5c0 kernel32+0x2c1cf @ 0x7580c1cf GetComputerNameA+0xab1 GetFileInformationByHandleEx-0x5fe kernel32+0x2c191 @ 0x7580c191 MapViewOfFileEx+0x21 InitializeCriticalSectionEx-0x84 kernel32+0x14ca4 @ 0x757f4ca4 RegOpenKeyExW+0xf6 LocalFree-0x935 kernel32+0x12407 @ 0x757f2407 RegOpenKeyExW+0x21 LocalFree-0xa0a kernel32+0x12332 @ 0x757f2332 New_advapi32_RegOpenKeyExW@20+0x4f New_advapi32_RegQueryInfoKeyA@48-0x173 @ 0x74663ca1 CreateAssemblyNameObject+0xc283 GetMetaDataInternalInterface-0x2c1ec clr+0x3971c @ 0x73f6971c StrongNameSignatureVerification+0x9a32 GetMetaDataPublicInterfaceFromInternal-0x1e1e clr+0x1934e8 @ 0x740c34e8 StrongNameSignatureVerification+0x9bcc GetMetaDataPublicInterfaceFromInternal-0x1c84 clr+0x193682 @ 0x740c3682 GetMetaDataPublicInterfaceFromInternal+0x641 CopyPDBs-0x2fb clr+0x195947 @ 0x740c5947 GetMetaDataPublicInterfaceFromInternal+0x850 CopyPDBs-0xec clr+0x195b56 @ 0x740c5b56 GetMetaDataPublicInterfaceFromInternal+0x23d CopyPDBs-0x6ff clr+0x195543 @ 0x740c5543 StrongNameSignatureVerification+0x839b GetMetaDataPublicInterfaceFromInternal-0x34b5 clr+0x191e51 @ 0x740c1e51 StrongNameSignatureVerification+0x854e GetMetaDataPublicInterfaceFromInternal-0x3302 clr+0x192004 @ 0x740c2004 mscorlib+0x355147 @ 0x72915147 mscorlib+0x985c14 @ 0x72f45c14 mscorlib+0x9b45cf @ 0x72f745cf mscorlib+0xd224c1 @ 0x732e24c1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 CoUninitializeEE+0x9bdc CreateAssemblyNameObject-0x4079 clr+0x29420 @ 0x73f59420 GetPrivateContextsPerfCounters+0x10ed DllGetActivationFactoryImpl-0x13778 clr+0x8906f @ 0x73fb906f mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1815080 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1815132 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 RtlFreeSid+0x1b RtlAllocateAndInitializeSid-0x15 ntdll+0x393cd @ 0x778d93cd GetComputerNameA+0xa84 GetFileInformationByHandleEx-0x62b kernel32+0x2c164 @ 0x7580c164 GetComputerNameA+0xaef GetFileInformationByHandleEx-0x5c0 kernel32+0x2c1cf @ 0x7580c1cf GetComputerNameA+0xab1 GetFileInformationByHandleEx-0x5fe kernel32+0x2c191 @ 0x7580c191 MapViewOfFileEx+0x21 InitializeCriticalSectionEx-0x84 kernel32+0x14ca4 @ 0x757f4ca4 RegOpenKeyExW+0xf6 LocalFree-0x935 kernel32+0x12407 @ 0x757f2407 RegOpenKeyExW+0x21 LocalFree-0xa0a kernel32+0x12332 @ 0x757f2332 New_advapi32_RegOpenKeyExW@20+0x4f New_advapi32_RegQueryInfoKeyA@48-0x173 @ 0x74663ca1 CreateAssemblyNameObject+0xc283 GetMetaDataInternalInterface-0x2c1ec clr+0x3971c @ 0x73f6971c StrongNameSignatureVerification+0x9a32 GetMetaDataPublicInterfaceFromInternal-0x1e1e clr+0x1934e8 @ 0x740c34e8 StrongNameSignatureVerification+0x9bcc GetMetaDataPublicInterfaceFromInternal-0x1c84 clr+0x193682 @ 0x740c3682 GetMetaDataPublicInterfaceFromInternal+0x641 CopyPDBs-0x2fb clr+0x195947 @ 0x740c5947 GetMetaDataPublicInterfaceFromInternal+0x850 CopyPDBs-0xec clr+0x195b56 @ 0x740c5b56 GetMetaDataPublicInterfaceFromInternal+0x23d CopyPDBs-0x6ff clr+0x195543 @ 0x740c5543 StrongNameSignatureVerification+0x839b GetMetaDataPublicInterfaceFromInternal-0x34b5 clr+0x191e51 @ 0x740c1e51 StrongNameSignatureVerification+0x854e GetMetaDataPublicInterfaceFromInternal-0x3302 clr+0x192004 @ 0x740c2004 mscorlib+0x355147 @ 0x72915147 mscorlib+0x985c14 @ 0x72f45c14 mscorlib+0x9b45cf @ 0x72f745cf mscorlib+0xd224c1 @ 0x732e24c1 exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1809720 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1809772 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1804360 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1804412 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1799000 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1799052 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1793640 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1793692 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1788280 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1788332 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1782920 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1782972 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1777560 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1777612 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1772200 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1772252 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1766840 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1766892 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1761480 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1761532 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1756120 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1756172 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1750760 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1750812 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1745400 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1745452 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1740040 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1740092 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1734680 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1734732 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1729320 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1729372 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1723960 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1724012 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1718600 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1718652 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1713240 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1713292 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1707880 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1707932 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1702520 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1702572 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1697160 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1697212 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e mscorlib+0x2fcd8c @ 0x728bcd8c mscorlib+0x2fcd0b @ 0x728bcd0b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x6069a CorDllMainForThunk-0x2be61 clr+0x125713 @ 0x74055713 DllGetClassObjectInternal+0x6075c CorDllMainForThunk-0x2bd9f clr+0x1257d5 @ 0x740557d5 mscorlib+0x9bc1c8 @ 0x72f7c1c8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f DllGetClassObjectInternal+0xc874 CorDllMainForThunk-0x7fc87 clr+0xd18ed @ 0x740018ed DllGetClassObjectInternal+0xcb84 CorDllMainForThunk-0x7f977 clr+0xd1bfd @ 0x74001bfd CreateHistoryReader+0x13d0e PostErrorVA-0x155251 clr+0x223553 @ 0x74153553 LookupHistoryAssembly+0x1550 CoEEShutDownCOM-0x2c2c clr+0x1d8a42 @ 0x74108a42 DllGetClassObjectInternal+0x5fe1c CorDllMainForThunk-0x2c6df clr+0x124e95 @ 0x74054e95 DllGetClassObjectInternal+0x5fd5f CorDllMainForThunk-0x2c79c clr+0x124dd8 @ 0x74054dd8 RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x778e6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x778e6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7467482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x778ce003 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd DllUnregisterServerInternal-0x7f84 clr+0x2170 @ 0x73f32170 DllUnregisterServerInternal-0x7f5f clr+0x2195 @ 0x73f32195 DllUnregisterServerInternal-0x7f4e clr+0x21a6 @ 0x73f321a6 GetPrivateContextsPerfCounters+0xf4 DllGetActivationFactoryImpl-0x14771 clr+0x88076 @ 0x73fb8076 GetPrivateContextsPerfCounters+0x10c5 DllGetActivationFactoryImpl-0x137a0 clr+0x89047 @ 0x73fb9047 mscorlib+0x2d866e @ 0x7289866e mscorlib+0x2d85ca @ 0x728985ca mscorlib+0x2d7e2a @ 0x72897e2a mscorlib+0x2d79ea @ 0x728979ea mscorlib+0x2d74ff @ 0x728974ff mscorlib+0x2d71c3 @ 0x728971c3 mscorlib+0x2d6c3c @ 0x72896c3c mscorlib+0x2fcfb1 @ 0x728bcfb1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73f49dd2 DllGetClassObjectInternal+0x38b0b CorDllMainForThunk-0x539f0 clr+0xfdb84 @ 0x7402db84 DllGetClassObjectInternal+0x38c16 CorDllMainForThunk-0x538e5 clr+0xfdc8f @ 0x7402dc8f mscorlib+0x2fce7e @ 0x728bce7e exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb exception.instruction: mov dword ptr [eax], esi exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 189435 exception.address: 0x778ce3fb registers.esp: 1691800 registers.edi: 4049862656 registers.eax: 0 registers.ebp: 1691852 registers.edx: 0 registers.ebx: 4049862657 registers.esi: 1884717027 registers.ecx: 155	1
__exception__ Dec. 22, 2023, 8:14 a.m.	stacktrace: regsvcs+0x4991e @ 0x44991e regsvcs+0x1b835 @ 0x41b835 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 08 01 c8 83 c0 04 ff 25 78 4e 46 00 8b 4d e8 exception.symbol: regsvcs+0x4a802 exception.instruction: mov ecx, dword ptr [eax] exception.module: RegSvcs.exe exception.exception_code: 0xc0000005 exception.offset: 305154 exception.address: 0x44a802 registers.esp: 2554688 registers.edi: 272 registers.eax: 8613 registers.ebp: 2554868 registers.edx: 1 registers.ebx: 0 registers.esi: 2005631619 registers.ecx: 4499458	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 66 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02490000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02600000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00742000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00775000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0077b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00777000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0075c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0075d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0075e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0075f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02390000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02391000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0074a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0076a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00767000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0075a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00766000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023f8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023fd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023fe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023ff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0074c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02540000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02392000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00411000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02541000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\Protect544cd51a.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\Protect544cd51a.dll

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0051a000', u'virtual_address': u'0x00002000', u'entropy': 7.381740668498315, u'name': u'.text', u'virtual_size': u'0x00519ec4'}

entropy

7.3817406685

description

A section with a high entropy has been found

entropy

0.977727868239

description

Overall entropy of this PE file is high

Yara rule detected in process memory (9 events)

description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: d3303c08f78fb96b19cfb8a9956f4a527545618f
buffer	Buffer with sha1: 2441a44b06509975255deafbaa7fd57a83a0bd41

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 2364 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002ac	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Dec. 22, 2023, 8:14 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL£eàÐ ¸@@PHü<.text.ÎÐ `.rdata$=à>Ô@@.dataìi V@À.relocHüþh@B base_address: 0x00400000 process_identifier: 2364 process_handle: 0x000002ac	1	1	0
WriteProcessMemory Dec. 22, 2023, 8:14 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2364 process_handle: 0x000002ac	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Dec. 22, 2023, 8:14 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL£eàÐ ¸@@PHü<.text.ÎÐ `.rdata$=à>Ô@@.dataìi V@À.relocHüþh@B base_address: 0x00400000 process_identifier: 2364 process_handle: 0x000002ac	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1960 called NtSetContextThread to modify thread in remote process 2364
NtSetContextThread Dec. 22, 2023, 8:14 a.m.	registers.eip: 2005598660 registers.esp: 2555644 registers.edi: 0 registers.eax: 4306976 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002a8 process_identifier: 2364	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1960 resumed a thread in remote process 2364
NtResumeThread Dec. 22, 2023, 8:14 a.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 2364	1	0	0

Executed a process and injected code into it, probably while unpacking (16 events)

Time & API	Arguments	Status	Return
NtResumeThread Dec. 22, 2023, 8:14 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1960	1	0
NtResumeThread Dec. 22, 2023, 8:14 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1960	1	0
NtResumeThread Dec. 22, 2023, 8:14 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 1960	1	0
NtResumeThread Dec. 22, 2023, 8:14 a.m.	thread_handle: 0x00000228 suspend_count: 1 process_identifier: 1960	1	0
CreateProcessInternalW Dec. 22, 2023, 8:14 a.m.	thread_identifier: 2368 thread_handle: 0x000002a8 process_identifier: 2364 current_directory: filepath: track: 1 command_line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe filepath_r: stack_pivoted: 0 creation_flags: 564 (CREATE_NEW_CONSOLE\|CREATE_NEW_PROCESS_GROUP\|CREATE_SUSPENDED\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x000002ac	1	1
NtUnmapViewOfSection Dec. 22, 2023, 8:14 a.m.	base_address: 0x00400000 region_size: 13697024 process_identifier: 2364 process_handle: 0x000002ac		3221225497
NtAllocateVirtualMemory Dec. 22, 2023, 8:14 a.m.	process_identifier: 2364 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002ac	1	0
WriteProcessMemory Dec. 22, 2023, 8:14 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL£eàÐ ¸@@PHü<.text.ÎÐ `.rdata$=à>Ô@@.dataìi V@À.relocHüþh@B base_address: 0x00400000 process_identifier: 2364 process_handle: 0x000002ac	1	1
WriteProcessMemory Dec. 22, 2023, 8:14 a.m.	buffer: base_address: 0x00401000 process_identifier: 2364 process_handle: 0x000002ac	1	1
WriteProcessMemory Dec. 22, 2023, 8:14 a.m.	buffer: base_address: 0x0044e000 process_identifier: 2364 process_handle: 0x000002ac	1	1
WriteProcessMemory Dec. 22, 2023, 8:14 a.m.	buffer: base_address: 0x00452000 process_identifier: 2364 process_handle: 0x000002ac	1	1
WriteProcessMemory Dec. 22, 2023, 8:14 a.m.	buffer: base_address: 0x00469000 process_identifier: 2364 process_handle: 0x000002ac	1	1
NtGetContextThread Dec. 22, 2023, 8:14 a.m.	thread_handle: 0x000002a8	1	0
WriteProcessMemory Dec. 22, 2023, 8:14 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2364 process_handle: 0x000002ac	1	1
NtSetContextThread Dec. 22, 2023, 8:14 a.m.	registers.eip: 2005598660 registers.esp: 2555644 registers.edi: 0 registers.eax: 4306976 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002a8 process_identifier: 2364	1	0
NtResumeThread Dec. 22, 2023, 8:14 a.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 2364	1	0

v1220-55000.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All