This indeed does sound weird. Let me fire off a bunch of questions and see
if any of them lead down a productive path:
Can you give more details about the failure case? What kind of app is it
(console, WinForms, service, other)? When it comes up, what comes up? If
you put a call to System.Diagnostics.Debugger.Break() on the first line of
main, will that get hit?
And going down the path all developers love--the "there's nothing wrong
with my app, it must be the machine" path... How many machines have you
found that won't run it? How many will? Is there anything else weird about
the machines that don't run it? Will other managed apps run on the system?
Does fuslogvw show assemblies getting loaded for those? Will ngen work
without hanging on those?
Jonathan
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
(including service packs) so no joy there ...
| I should describe the behavior when it is run on a non-working machine...
|
| App comes up and does nothing, it will not reach a breakpoint on the first line in my main (no errors). At this point I figured that it may be
an issue with loading of assemblies. I ran fuslogvw with ForceLog set ...
no assemblies logged as being loaded.
| At this point I was unsure of what else to try so I figured I would go with some FM ... I attempted to ngen the assembly to attempt running the
native version, ngen locks up when run, no error messages or returns.
| I have searched the knowledge base for this without luck ...
|
[quoted text clipped - 3 lines]
|
| Greg
> This indeed does sound weird. Let me fire off a bunch of questions and
> see
> if any of them lead down a productive path:
> Can you give more details about the failure case? What kind of app is
> it
> (console, WinForms, service, other)? When it comes up, what comes up? If
> you put a call to System.Diagnostics.Debugger.Break() on the first line of
> main, will that get hit?
Reasonably large POS/management app ... no it will not hit the break point I
am including a depends analysis which shows it calling a wait for single
object and hanging before relinquishing control to my app.
> And going down the path all developers love--the "there's nothing
> wrong
> with my app, it must be the machine" path... How many machines have you
> found that won't run it? How many will? Is there anything else weird about
> the machines that don't run it? Will other managed apps run on the system?
> Does fuslogvw show assemblies getting loaded for those? Will ngen work
> without hanging on those?
2 ... there are 20+ tested machines running without issue (more added
everyday) Yes other managed apps will run on those systems. Ngen works with
other apps. NGen works with this app on other machines. I can not find a
commonality between the two machines, 1 is a clean XP build the other is a
machine one of the tech support people uses.
Depends log:
here is a profile from when it locks up ... note the wait for single object
at the end (thats where it is hanging before it hits my entry point)
Starting profile on 6/17/2004 at 8:40:02 AM
Operating System: Microsoft Windows XP Professional (32-bit), version
5.01.2600 Service Pack 1
Program Executable: c:\program files\planet
beach\solarware.net\2004.6.16.1\SOLARWARE.NET.EXE
Program Arguments:
Starting Directory: C:\Program Files\Planet Beach\Solarware.net\2004.6.16.1\
Search Path:
C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\ATI
Technologies\ATI Control Panel
Options Selected:
Simulate ShellExecute by inserting any App Paths directories into the PATH
environment variable.
Log DllMain calls for process attach and process detach messages.
Hook the process to gather more detailed dependency information.
Log LoadLibrary function calls.
Log GetProcAddress function calls.
Log debug output messages.
Automatically open and profile child processes.
----------------------------------------------------------------------------
----
Started "SOLARWARE.NET.EXE" (process 0x718) at address 0x00400000.
Successfully hooked module.
Loaded "NTDLL.DLL" at address 0x77F50000. Successfully hooked module.
Loaded "MSCOREE.DLL" at address 0x79170000. Successfully hooked module.
Loaded "KERNEL32.DLL" at address 0x77E60000. Successfully hooked module.
Loaded "ADVAPI32.DLL" at address 0x77DD0000. Successfully hooked module.
Loaded "RPCRT4.DLL" at address 0x78000000. Successfully hooked module.
DllMain(0x77E60000, DLL_PROCESS_ATTACH, 0x00000000) in "KERNEL32.DLL"
called.
DllMain(0x77E60000, DLL_PROCESS_ATTACH, 0x00000000) in "KERNEL32.DLL"
returned 1 (0x1).
Injected "DEPENDS.DLL" at address 0x08370000.
DllMain(0x78000000, DLL_PROCESS_ATTACH, 0x00000000) in "RPCRT4.DLL" called.
DllMain(0x78000000, DLL_PROCESS_ATTACH, 0x00000000) in "RPCRT4.DLL" returned
1 (0x1).
DllMain(0x77DD0000, DLL_PROCESS_ATTACH, 0x00000000) in "ADVAPI32.DLL"
called.
DllMain(0x77DD0000, DLL_PROCESS_ATTACH, 0x00000000) in "ADVAPI32.DLL"
returned 1 (0x1).
DllMain(0x79170000, DLL_PROCESS_ATTACH, 0x00000000) in "MSCOREE.DLL" called.
DllMain(0x79170000, DLL_PROCESS_ATTACH, 0x00000000) in "MSCOREE.DLL"
returned 1 (0x1).
DllMain(0x08370000, DLL_PROCESS_ATTACH, 0x00000000) in "DEPENDS.DLL" called.
DllMain(0x08370000, DLL_PROCESS_ATTACH, 0x00000000) in "DEPENDS.DLL"
returned 1 (0x1).
LoadLibraryExW("kernel32.dll", 0x00000000, 0x00000000) called from
"MSCOREE.DLL" at address 0x79178D7A.
LoadLibraryExW("kernel32.dll", 0x00000000, 0x00000000) returned 0x77E60000.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "QueryActCtxW") called from
"MSCOREE.DLL" at address 0x7917C2E2 and returned 0x77E92913.
LoadLibraryExW("kernel32.dll", 0x00000000, 0x00000000) called from
"MSCOREE.DLL" at address 0x79178D7A.
LoadLibraryExW("kernel32.dll", 0x00000000, 0x00000000) returned 0x77E60000.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "QueryActCtxW") called from
"MSCOREE.DLL" at address 0x7917C2E2 and returned 0x77E92913.
LoadLibraryA("SHLWAPI.dll") called from "MSCOREE.DLL" at address 0x7917B65A.
Loaded "SHLWAPI.DLL" at address 0x70A70000. Successfully hooked module.
Loaded "MSVCRT.DLL" at address 0x77C10000. Successfully hooked module.
Loaded "GDI32.DLL" at address 0x7E090000. Successfully hooked module.
Loaded "USER32.DLL" at address 0x77D40000. Successfully hooked module.
DllMain(0x77C10000, DLL_PROCESS_ATTACH, 0x00000000) in "MSVCRT.DLL" called.
DllMain(0x77C10000, DLL_PROCESS_ATTACH, 0x00000000) in "MSVCRT.DLL" returned
1 (0x1).
DllMain(0x77D40000, DLL_PROCESS_ATTACH, 0x00000000) in "USER32.DLL" called.
DllMain(0x77D40000, DLL_PROCESS_ATTACH, 0x00000000) in "USER32.DLL" returned
1 (0x1).
DllMain(0x70A70000, DLL_PROCESS_ATTACH, 0x00000000) in "SHLWAPI.DLL" called.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "CreateTimerQueue") called from
"SHLWAPI.DLL" at address 0x70AB9C19 and returned 0x77E91F8C.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "DeleteTimerQueue") called from
"SHLWAPI.DLL" at address 0x70AB9C29 and returned 0x77EB57A5.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "CreateTimerQueueTimer") called
from "SHLWAPI.DLL" at address 0x70AB9C39 and returned 0x77E74393.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "ChangeTimerQueueTimer") called
from "SHLWAPI.DLL" at address 0x70AB9C47 and returned 0x77E753F6.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "DeleteTimerQueueTimer") called
from "SHLWAPI.DLL" at address 0x70AB9C55 and returned 0x77E74B20.
DllMain(0x70A70000, DLL_PROCESS_ATTACH, 0x00000000) in "SHLWAPI.DLL"
returned 1 (0x1).
LoadLibraryA("SHLWAPI.dll") returned 0x70A70000.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "UrlIsW") called from "MSCOREE.DLL"
at address 0x7917B6A4 and returned 0x70AB5EE6.
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll",
0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCOREE.DLL" at
address 0x79178D7A.
Loaded "MSCORWKS.DLL" at address 0x791B0000. Successfully hooked module.
Loaded "MSVCR71.DLL" at address 0x7C340000. Successfully hooked module.
Loaded "FUSION.DLL" at address 0x79040000. Successfully hooked module.
Loaded "SHELL32.DLL" at address 0x773D0000. Successfully hooked module.
DllMain(0x7C340000, DLL_PROCESS_ATTACH, 0x00000000) in "MSVCR71.DLL" called.
GetProcAddress(0x77E60000 [KERNEL32.DLL],
"InitializeCriticalSectionAndSpinCount") called from "MSVCR71.DLL" at
address 0x7C3418AB and returned 0x77E7DE5E.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "FlsAlloc") called from
"MSVCR71.DLL" at address 0x7C341950 and returned NULL. Error: The specified
procedure could not be found (127).
GetProcAddress(0x77E60000 [KERNEL32.DLL], "FlsGetValue") called from
"MSVCR71.DLL" at address 0x7C34195D and returned NULL. Error: The specified
procedure could not be found (127).
GetProcAddress(0x77E60000 [KERNEL32.DLL], "FlsSetValue") called from
"MSVCR71.DLL" at address 0x7C34196A and returned NULL. Error: The specified
procedure could not be found (127).
GetProcAddress(0x77E60000 [KERNEL32.DLL], "FlsFree") called from
"MSVCR71.DLL" at address 0x7C341977 and returned NULL. Error: The specified
procedure could not be found (127).
GetProcAddress(0x77E60000 [KERNEL32.DLL], "IsProcessorFeaturePresent")
called from "MSVCR71.DLL" at address 0x7C341FDA and returned 0x77E813C8.
DllMain(0x7C340000, DLL_PROCESS_ATTACH, 0x00000000) in "MSVCR71.DLL"
returned 1 (0x1).
DllMain(0x79040000, DLL_PROCESS_ATTACH, 0x00000000) in "FUSION.DLL" called.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "GetSystemWindowsDirectoryW")
called from "FUSION.DLL" at address 0x7904EEA0 and returned 0x77E76462.
LoadLibraryA("SHLWAPI.dll") called from "FUSION.DLL" at address 0x7904ECC9.
LoadLibraryA("SHLWAPI.dll") returned 0x70A70000.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "StrCpyW") called from "FUSION.DLL"
at address 0x7904DE8A and returned 0x70A93F65.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "PathFindFileNameW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70AA3A05.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "wnsprintfW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70A97685.
DllMain(0x79040000, DLL_PROCESS_ATTACH, 0x00000000) in "FUSION.DLL" returned
1 (0x1).
DllMain(0x773D0000, DLL_PROCESS_ATTACH, 0x00000000) in "SHELL32.DLL" called.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "CreateActCtxW") called from
"SHELL32.DLL" at address 0x77580D87 and returned 0x77E6E573.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "ActivateActCtx") called from
"SHELL32.DLL" at address 0x77580E01 and returned 0x77E737E8.
LoadLibraryW("comctl32.dll") called from "SHELL32.DLL" at address
0x77580FE7.
Loaded "COMCTL32.DLL" at address 0x71950000. Successfully hooked module.
DllMain(0x71950000, DLL_PROCESS_ATTACH, 0x00000000) in "COMCTL32.DLL"
called.
DllMain(0x71950000, DLL_PROCESS_ATTACH, 0x00000000) in "COMCTL32.DLL"
returned 1 (0x1).
LoadLibraryW("comctl32.dll") returned 0x71950000.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "DeactivateActCtx") called from
"SHELL32.DLL" at address 0x77580E4E and returned 0x77E737BC.
LoadLibraryW("comctl32.dll") called from "SHELL32.DLL" at address
0x77417B31.
Loaded "COMCTL32.DLL" at address 0x77340000. Successfully hooked module.
DllMain(0x77340000, DLL_PROCESS_ATTACH, 0x00000000) in "COMCTL32.DLL"
called.
DllMain(0x77340000, DLL_PROCESS_ATTACH, 0x00000000) in "COMCTL32.DLL"
returned 1 (0x1).
LoadLibraryW("comctl32.dll") returned 0x77340000.
GetProcAddress(0x77340000 [COMCTL32.DLL], "InitCommonControlsEx") called
from "SHELL32.DLL" at address 0x77417B41 and returned 0x773416C9.
DllMain(0x773D0000, DLL_PROCESS_ATTACH, 0x00000000) in "SHELL32.DLL"
returned 1 (0x1).
DllMain(0x791B0000, DLL_PROCESS_ATTACH, 0x00000000) in "MSCORWKS.DLL"
called.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "TryEnterCriticalSection") called
from "MSCORWKS.DLL" at address 0x791C7A87 and returned 0x77F5B3B8.
DllMain(0x791B0000, DLL_PROCESS_ATTACH, 0x00000000) in "MSCORWKS.DLL"
returned 1 (0x1).
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll",
0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x791B0000.
GetProcAddress(0x791B0000 [MSCORWKS.DLL], "SetLoadedByMscoree") called from
"MSCOREE.DLL" at address 0x791793E0 and returned 0x791C7866.
GetProcAddress(0x791B0000 [MSCORWKS.DLL], "_CorExeMain") called from
"MSCOREE.DLL" at address 0x7917D0B2 and returned 0x791C6EAC.
GetProcAddress(0x79170000 [MSCOREE.DLL], "GetStartupFlags") called from
"MSCORWKS.DLL" at address 0x791C7E15 and returned 0x7917D014.
GetProcAddress(0x79170000 [MSCOREE.DLL], "GetHostConfigurationFile") called
from "MSCORWKS.DLL" at address 0x791C7E39 and returned 0x7917D01A.
GetProcAddress(0x79170000 [MSCOREE.DLL], "GetCORSystemDirectory") called
from "MSCORWKS.DLL" at address 0x791C098D and returned 0x79171E4F.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "AllocateAndInitializeSid") called
from "MSCORWKS.DLL" at address 0x791D13E3 and returned 0x77DD301A.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "OpenProcessToken") called from
"MSCORWKS.DLL" at address 0x791D12D4 and returned 0x77DD2FCD.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "GetTokenInformation") called from
"MSCORWKS.DLL" at address 0x791D12F1 and returned 0x77DD2FED.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "InitializeAcl") called from
"MSCORWKS.DLL" at address 0x791D1455 and returned 0x77DD30CD.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "AddAccessAllowedAce") called from
"MSCORWKS.DLL" at address 0x791D14B7 and returned 0x77DD30ED.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "FreeSid") called from
"MSCORWKS.DLL" at address 0x791D1502 and returned 0x77DD3014.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "IsProcessorFeaturePresent")
called from "MSCORWKS.DLL" at address 0x791C811D and returned 0x77E813C8.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "SwitchToThread") called from
"MSCORWKS.DLL" at address 0x791C8179 and returned 0x77E66B42.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "GetWriteWatch") called from
"MSCORWKS.DLL" at address 0x791C89EA and returned 0x77EB216A.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "ResetWriteWatch") called from
"MSCORWKS.DLL" at address 0x791C89F4 and returned 0x77EB219C.
GetProcAddress(0x77E60000 [KERNEL32.DLL],
"CreateMemoryResourceNotification") called from "MSCORWKS.DLL" at address
0x791D22C6 and returned 0x77EB4717.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "QueryMemoryResourceNotification")
called from "MSCORWKS.DLL" at address 0x791D22D0 and returned 0x77EB478C.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "StrCmpW") called from "FUSION.DLL"
at address 0x7904DE8A and returned 0x70A9572C.
LoadLibraryExW("c:\windows\microsoft.net\framework\v1.1.4322\mscorlib.dll",
0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCORWKS.DLL" at
address 0x791B7B63.
Loaded "MSCORLIB.DLL" at address 0x79780000. Successfully hooked module.
GetProcAddress(0x791B0000 [MSCORWKS.DLL], "_CorDllMain") called from
"MSCOREE.DLL" at address 0x7917CFF3 and returned 0x791C6C83.
LoadLibraryExW("c:\windows\microsoft.net\framework\v1.1.4322\mscorlib.dll",
0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x79780000.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "PathAddBackslashW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70AA39BC.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "StrCpyNW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70A9400E.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "PathRemoveBackslashW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70AA4DFF.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "StrNCatW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70A940F9.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "StrCpyNW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70A9400E.
LoadLibraryExW("mscoree.dll", 0x00000000, 0x00000000) called from
"FUSION.DLL" at address 0x7905371E.
LoadLibraryExW("mscoree.dll", 0x00000000, 0x00000000) returned 0x79170000.
GetProcAddress(0x79170000 [MSCOREE.DLL], "GetCORSystemDirectory") called
from "FUSION.DLL" at address 0x79053C41 and returned 0x79171E4F.
GetProcAddress(0x79170000 [MSCOREE.DLL], "GetCORVersion") called from
"FUSION.DLL" at address 0x79053C4E and returned 0x79178EDA.
GetProcAddress(0x79170000 [MSCOREE.DLL], "StrongNameTokenFromPublicKey")
called from "FUSION.DLL" at address 0x79053C5B and returned 0x79171FBF.
GetProcAddress(0x79170000 [MSCOREE.DLL], "StrongNameErrorInfo") called from
"FUSION.DLL" at address 0x79053C68 and returned 0x79179A3C.
GetProcAddress(0x79170000 [MSCOREE.DLL], "StrongNameFreeBuffer") called from
"FUSION.DLL" at address 0x79053C75 and returned 0x79172025.
GetProcAddress(0x79170000 [MSCOREE.DLL], "StrongNameSignatureVerification")
called from "FUSION.DLL" at address 0x79053C82 and returned 0x791799D8.
GetProcAddress(0x79170000 [MSCOREE.DLL], "GetAssemblyMDImport") called from
"FUSION.DLL" at address 0x79053C8F and returned 0x79171DC4.
GetProcAddress(0x79170000 [MSCOREE.DLL], "CoInitializeCor") called from
"FUSION.DLL" at address 0x79053C9C and returned 0x7917CF3A.
GetProcAddress(0x79170000 [MSCOREE.DLL], "GetXMLObject") called from
"FUSION.DLL" at address 0x79053CA9 and returned 0x79176C24.
GetProcAddress(0x791B0000 [MSCORWKS.DLL], "CoInitializeCor") called from
"MSCOREE.DLL" at address 0x7917CF62 and returned 0x791CE8A0.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "StrCatW") called from "FUSION.DLL"
at address 0x7904DE8A and returned 0x70A94026.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "StrCatW") called from "FUSION.DLL"
at address 0x7904DE8A and returned 0x70A94026.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "StrChrW") called from "FUSION.DLL"
at address 0x7904DE8A and returned 0x70A941B6.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "StrToIntW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70A943F6.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "StrChrW") called from "FUSION.DLL"
at address 0x7904DE8A and returned 0x70A941B6.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "StrChrW") called from "FUSION.DLL"
at address 0x7904DE8A and returned 0x70A941B6.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "StrCatBuffW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70A94056.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "UrlGetPartW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70AB619C.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "StrCmpNIW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70A94A5D.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "wvnsprintfW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70A970A4.
GetProcAddress(0x791B0000 [MSCORWKS.DLL], "GetAssemblyMDImport") called from
"MSCOREE.DLL" at address 0x7917CFAB and returned 0x791C4F43.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "UrlIsW") called from "FUSION.DLL"
at address 0x7904DE8A and returned 0x70AB5EE6.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "PathIsURLW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70AA4543.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "UrlCanonicalizeW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70AB7A65.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "UrlUnescapeW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70AB411A.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "UrlEscapeW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70AB60C6.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "PathCreateFromUrlW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70AB6131.
LoadLibraryExW("c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.500
0.0__b77a5c561934e089_a0c6a09b\mscorlib.dll", 0x00000000,
LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCORWKS.DLL" at address
0x791B7B63.
Loaded "MSCORLIB.DLL" at address 0x79980000. Successfully hooked module.
LoadLibraryExW("c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.500
0.0__b77a5c561934e089_a0c6a09b\mscorlib.dll", 0x00000000,
LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x79980000.
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll",
0x00000000, 0x00000000) called from "MSCOREE.DLL" at address 0x79178D7A.
Loaded "MSCORSN.DLL" at address 0x79510000. Successfully hooked module.
DllMain(0x79510000, DLL_PROCESS_ATTACH, 0x00000000) in "MSCORSN.DLL" called.
LoadLibraryExW("AdvApi32.dll", 0x00000000, 0x00000000) called from
"MSCORSN.DLL" at address 0x79517307.
LoadLibraryExW("AdvApi32.dll", 0x00000000, 0x00000000) returned 0x77DD0000.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptAcquireContextA") called
from "MSCORSN.DLL" at address 0x795123E9 and returned 0x77DD7DA0.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptCreateHash") called from
"MSCORSN.DLL" at address 0x7951240F and returned 0x77DDA5DE.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptDestroyHash") called from
"MSCORSN.DLL" at address 0x79512425 and returned 0x77DDA54F.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptDestroyKey") called from
"MSCORSN.DLL" at address 0x7951243B and returned 0x77DDA9AA.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptEnumProvidersA") called from
"MSCORSN.DLL" at address 0x79512451 and returned 0x77DDF999.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptExportKey") called from
"MSCORSN.DLL" at address 0x79512463 and returned 0x77DDD501.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptGenKey") called from
"MSCORSN.DLL" at address 0x79512479 and returned 0x77DDF2E7.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptGetHashParam") called from
"MSCORSN.DLL" at address 0x79512493 and returned 0x77DDA801.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptGetKeyParam") called from
"MSCORSN.DLL" at address 0x795124AD and returned 0x77DDEA6E.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptGetProvParam") called from
"MSCORSN.DLL" at address 0x795124C7 and returned 0x77DDEB7C.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptGetUserKey") called from
"MSCORSN.DLL" at address 0x795124E1 and returned 0x77DDD5B1.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptHashData") called from
"MSCORSN.DLL" at address 0x795124FB and returned 0x77DDA706.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptImportKey") called from
"MSCORSN.DLL" at address 0x79512515 and returned 0x77DDAACF.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptReleaseContext") called from
"MSCORSN.DLL" at address 0x7951252F and returned 0x77DD826B.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptSignHashA") called from
"MSCORSN.DLL" at address 0x79512549 and returned 0x77E09043.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptVerifySignatureA") called
from "MSCORSN.DLL" at address 0x79512563 and returned 0x77DDAC90.
DllMain(0x79510000, DLL_PROCESS_ATTACH, 0x00000000) in "MSCORSN.DLL"
returned 1 (0x1).
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll",
0x00000000, 0x00000000) returned 0x79510000.
GetProcAddress(0x79510000 [MSCORSN.DLL], "StrongNameSignatureVerification")
called from "MSCOREE.DLL" at address 0x79179A00 and returned 0x79514AA6.
GetProcAddress(0x79510000 [MSCORSN.DLL], "StrongNameErrorInfo") called from
"MSCOREE.DLL" at address 0x79179A68 and returned 0x79512CE5.
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ole32.dll",
0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCORWKS.DLL" at
address 0x791B7B63.
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ole32.dll",
0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) returned NULL. Error: The
specified module could not be found (126).
LoadLibraryA("ole32.dll") called from "MSCORWKS.DLL" at address 0x791E5D32.
Loaded "OLE32.DLL" at address 0x771B0000. Successfully hooked module.
DllMain(0x771B0000, DLL_PROCESS_ATTACH, 0x00000000) in "OLE32.DLL" called.
DllMain(0x771B0000, DLL_PROCESS_ATTACH, 0x00000000) in "OLE32.DLL" returned
1 (0x1).
LoadLibraryA("ole32.dll") returned 0x771B0000.
GetProcAddress(0x771B0000 [OLE32.DLL], "CoInitializeEx") called from
"MSCORWKS.DLL" at address 0x791E5C93 and returned 0x771C0D86.
LoadLibraryExW("kernel32.dll", 0x00000000, 0x00000000) called from
"MSCORWKS.DLL" at address 0x791B7B63.
LoadLibraryExW("kernel32.dll", 0x00000000, 0x00000000) returned 0x77E60000.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "QueryActCtxW") called from
"MSCORWKS.DLL" at address 0x792405E1 and returned 0x77E92913.
LoadLibraryExW("kernel32.dll", 0x00000000, 0x00000000) called from
"MSCORWKS.DLL" at address 0x791B7B63.
LoadLibraryExW("kernel32.dll", 0x00000000, 0x00000000) returned 0x77E60000.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "QueryActCtxW") called from
"MSCORWKS.DLL" at address 0x792405E1 and returned 0x77E92913.
LoadLibraryExW("kernel32.dll", 0x00000000, 0x00000000) called from
"MSCORWKS.DLL" at address 0x791B7B63.
LoadLibraryExW("kernel32.dll", 0x00000000, 0x00000000) returned 0x77E60000.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "QueryActCtxW") called from
"MSCORWKS.DLL" at address 0x792405E1 and returned 0x77E92913.
GetProcAddress(0x79170000 [MSCOREE.DLL], "GetCORSystemDirectory") called
from "MSCORWKS.DLL" at address 0x7923E868 and returned 0x79171E4F.
GetProcAddress(0x79170000 [MSCOREE.DLL], "GetCORSystemDirectory") called
from "MSCORWKS.DLL" at address 0x7923E868 and returned 0x79171E4F.
LoadLibraryExW("shell32.dll", 0x00000000, 0x00000000) called from
"MSCORWKS.DLL" at address 0x791B7B63.
LoadLibraryExW("shell32.dll", 0x00000000, 0x00000000) returned 0x773D0000.
GetProcAddress(0x773D0000 [SHELL32.DLL], "SHGetFolderPathW") called from
"MSCORWKS.DLL" at address 0x7923F247 and returned 0x7746912E.
LoadLibraryExW("kernel32.dll", 0x00000000, 0x00000000) called from
"MSCORWKS.DLL" at address 0x791B7B63.
LoadLibraryExW("kernel32.dll", 0x00000000, 0x00000000) returned 0x77E60000.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "GetLongPathNameW") called from
"MSCORWKS.DLL" at address 0x7923F196 and returned 0x77E81787.
GetProcAddress(0x79170000 [MSCOREE.DLL], "GetCORSystemDirectory") called
from "MSCORWKS.DLL" at address 0x7923E868 and returned 0x79171E4F.
LoadLibraryExW("Kernel32.dll", 0x00000000, 0x00000000) called from
"MSCORWKS.DLL" at address 0x791B7B63.
LoadLibraryExW("Kernel32.dll", 0x00000000, 0x00000000) returned 0x77E60000.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "GetUserDefaultUILanguage") called
from "MSCORWKS.DLL" at address 0x7921650A and returned 0x77E7EF30.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "PathIsRelativeW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70AA3B3F.
LoadLibraryExW("shell32.dll", 0x00000000, 0x00000000) called from
"FUSION.DLL" at address 0x7905371E.
LoadLibraryExW("shell32.dll", 0x00000000, 0x00000000) returned 0x773D0000.
GetProcAddress(0x773D0000 [SHELL32.DLL], "SHGetFolderPathW") called from
"FUSION.DLL" at address 0x79054B13 and returned 0x7746912E.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "StrCmpNW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70A94915.
LoadLibraryExW("c:\windows\assembly\gac\system.windows.forms\1.0.5000.0__b77
a5c561934e089\system.windows.forms.dll", 0x00000000,
DONT_RESOLVE_DLL_REFERENCES | LOAD_WITH_ALTERED_SEARCH_PATH) called from
"MSCORWKS.DLL" at address 0x791B7B63.
Loaded "SYSTEM.WINDOWS.FORMS.DLL" at address 0x7B610000. Successfully hooked
module.
LoadLibraryExW("c:\windows\assembly\gac\system.windows.forms\1.0.5000.0__b77
a5c561934e089\system.windows.forms.dll", 0x00000000,
DONT_RESOLVE_DLL_REFERENCES | LOAD_WITH_ALTERED_SEARCH_PATH) returned
0x7B610000.
LoadLibraryExW("c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.f
orms\1.0.5000.0__b77a5c561934e089_b93ce197\system.windows.forms.dll",
0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCORWKS.DLL" at
address 0x791B7B63.
Loaded "SYSTEM.WINDOWS.FORMS.DLL" at address 0x7B810000. Successfully hooked
module.
LoadLibraryExW("c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.f
orms\1.0.5000.0__b77a5c561934e089_b93ce197\system.windows.forms.dll",
0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x7B810000.
LoadLibraryExW("c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\
system.dll", 0x00000000, DONT_RESOLVE_DLL_REFERENCES |
LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCORWKS.DLL" at address
0x791B7B63.
Loaded "SYSTEM.DLL" at address 0x7B0A0000. Successfully hooked module.
LoadLibraryExW("c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\
system.dll", 0x00000000, DONT_RESOLVE_DLL_REFERENCES |
LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x7B0A0000.
LoadLibraryExW("c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.
0__b77a5c561934e089_7225b91c\system.dll", 0x00000000,
LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCORWKS.DLL" at address
0x791B7B63.
Loaded "SYSTEM.DLL" at address 0x7B1D0000. Successfully hooked module.
LoadLibraryExW("c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.
0__b77a5c561934e089_7225b91c\system.dll", 0x00000000,
LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x7B1D0000.
GetProcAddress(0x70A70000 [SHLWAPI.DLL], "PathFindExtensionW") called from
"FUSION.DLL" at address 0x7904DE8A and returned 0x70AA3595.
GetProcAddress(0x771B0000 [OLE32.DLL], "CoWaitForMultipleHandles") called
from "MSCORWKS.DLL" at address 0x7920C94A and returned 0x77226361.
LoadLibraryW("rpcrt4.dll") called from "RPCRT4.DLL" at address 0x7801901C.
LoadLibraryW("rpcrt4.dll") returned 0x78000000.
LoadLibraryW("OLE32") called from "RPCRT4.DLL" at address 0x78019985.
LoadLibraryW("OLE32") returned 0x771B0000.
GetProcAddress(0x771B0000 [OLE32.DLL], "CoGetClassObject") called from
"RPCRT4.DLL" at address 0x780199A0 and returned 0x771C4916.
GetProcAddress(0x771B0000 [OLE32.DLL], "CoGetMarshalSizeMax") called from
"RPCRT4.DLL" at address 0x780199BA and returned 0x771E6042.
GetProcAddress(0x771B0000 [OLE32.DLL], "CoMarshalInterface") called from
"RPCRT4.DLL" at address 0x780199D4 and returned 0x771C6DA0.
GetProcAddress(0x771B0000 [OLE32.DLL], "CoUnmarshalInterface") called from
"RPCRT4.DLL" at address 0x780199EE and returned 0x771E6168.
GetProcAddress(0x771B0000 [OLE32.DLL], "StringFromIID") called from
"RPCRT4.DLL" at address 0x78019A08 and returned 0x77219C95.
GetProcAddress(0x771B0000 [OLE32.DLL], "CoGetPSClsid") called from
"RPCRT4.DLL" at address 0x78019A22 and returned 0x771D3BFB.
GetProcAddress(0x771B0000 [OLE32.DLL], "CoTaskMemAlloc") called from
"RPCRT4.DLL" at address 0x78019A38 and returned 0x771C05A3.
GetProcAddress(0x771B0000 [OLE32.DLL], "CoTaskMemFree") called from
"RPCRT4.DLL" at address 0x78019A4E and returned 0x771C0591.
GetProcAddress(0x771B0000 [OLE32.DLL], "CoCreateInstance") called from
"RPCRT4.DLL" at address 0x78019A64 and returned 0x771C1FF5.
GetProcAddress(0x771B0000 [OLE32.DLL], "CoReleaseMarshalData") called from
"RPCRT4.DLL" at address 0x78019A7A and returned 0x771C6CA1.
GetProcAddress(0x771B0000 [OLE32.DLL], "DcomChannelSetHResult") called from
"RPCRT4.DLL" at address 0x78019A90 and returned 0x771E003B.
LoadLibraryW("OLE32.DLL") called from "OLE32.DLL" at address 0x771E7EFC.
LoadLibraryW("OLE32.DLL") returned 0x771B0000.
LoadLibraryExW("c:\program files\planet
beach\solarware.net\2004.6.16.1\browser.dll", 0x00000000,
DONT_RESOLVE_DLL_REFERENCES | LOAD_WITH_ALTERED_SEARCH_PATH) called from
"MSCORWKS.DLL" at address 0x791B7B63.
Loaded "BROWSER.DLL" at address 0x11000000. Successfully hooked module.
LoadLibraryExW("c:\program files\planet
beach\solarware.net\2004.6.16.1\browser.dll", 0x00000000,
DONT_RESOLVE_DLL_REFERENCES | LOAD_WITH_ALTERED_SEARCH_PATH) returned
0x11000000.
LoadLibraryExW("c:\program files\planet
beach\solarware.net\2004.6.16.1\authenticationlibrary.dll", 0x00000000,
DONT_RESOLVE_DLL_REFERENCES | LOAD_WITH_ALTERED_SEARCH_PATH) called from
"MSCORWKS.DLL" at address 0x791B7B63.
LoadLibraryExW("c:\program files\planet
beach\solarware.net\2004.6.16.1\authenticationlibrary.dll", 0x00000000,
DONT_RESOLVE_DLL_REFERENCES | LOAD_WITH_ALTERED_SEARCH_PATH) returned
0x06C60000.
LoadLibraryExW("c:\program files\planet
beach\solarware.net\2004.6.16.1\solarwareobjects.dll", 0x00000000,
DONT_RESOLVE_DLL_REFERENCES | LOAD_WITH_ALTERED_SEARCH_PATH) called from
"MSCORWKS.DLL" at address 0x791B7B63.
LoadLibraryExW("c:\program files\planet
beach\solarware.net\2004.6.16.1\solarwareobjects.dll", 0x00000000,
DONT_RESOLVE_DLL_REFERENCES | LOAD_WITH_ALTERED_SEARCH_PATH) returned
0x07060000.
LoadLibraryExW("c:\program files\planet
beach\solarware.net\2004.6.16.1\enterpriseobjects.dll", 0x00000000,
DONT_RESOLVE_DLL_REFERENCES | LOAD_WITH_ALTERED_SEARCH_PATH) called from
"MSCORWKS.DLL" at address 0x791B7B63.
LoadLibraryExW("c:\program files\planet
beach\solarware.net\2004.6.16.1\enterpriseobjects.dll", 0x00000000,
DONT_RESOLVE_DLL_REFERENCES | LOAD_WITH_ALTERED_SEARCH_PATH) returned
0x06C90000.
LoadLibraryExW("c:\windows\assembly\nativeimages1_v1.1.4322\solarwareobjects
\1.0.1.0___4ae82bc2\solarwareobjects.dll", 0x00000000,
LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCORWKS.DLL" at address
0x791B7B63.
Loaded "SOLARWAREOBJECTS.DLL" at address 0x110A0000. Successfully hooked
module.
LoadLibraryExW("c:\windows\assembly\nativeimages1_v1.1.4322\solarwareobjects
\1.0.1.0___4ae82bc2\solarwareobjects.dll", 0x00000000,
LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x110A0000.
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MSCORJIT.DLL",
0x00000000, 0x00000000) called from "MSCORWKS.DLL" at address 0x791B7B63.
Loaded "MSCORJIT.DLL" at address 0x79430000. Successfully hooked module.
DllMain(0x79430000, DLL_PROCESS_ATTACH, 0x00000000) in "MSCORJIT.DLL"
called.
DllMain(0x79430000, DLL_PROCESS_ATTACH, 0x00000000) in "MSCORJIT.DLL"
returned 1 (0x1).
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MSCORJIT.DLL",
0x00000000, 0x00000000) returned 0x79430000.
GetProcAddress(0x79430000 [MSCORJIT.DLL], "getJit") called from
"MSCORWKS.DLL" at address 0x791EFDB7 and returned 0x7943B8B0.
GetProcAddress(0x79040000 [FUSION.DLL], "CopyPDBs") called from
"MSCORWKS.DLL" at address 0x792B217B and returned 0x79057A62.
LoadLibraryExW("mscoree.dll", 0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH)
called from "MSCORWKS.DLL" at address 0x791B7B63.
LoadLibraryExW("mscoree.dll", 0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH)
returned 0x79170000.
GetProcAddress(0x79170000 [MSCOREE.DLL], "DllGetClassObject") called from
"MSCORWKS.DLL" at address 0x7928C7C4 and returned 0x7917960C.
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\diasymreader.dl
l", 0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCOREE.DLL" at
address 0x79178D7A.
Loaded "DIASYMREADER.DLL" at address 0x51A70000. Successfully hooked module.
DllMain(0x51A70000, DLL_PROCESS_ATTACH, 0x00000000) in "DIASYMREADER.DLL"
called.
DllMain(0x51A70000, DLL_PROCESS_ATTACH, 0x00000000) in "DIASYMREADER.DLL"
returned 1 (0x1).
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\diasymreader.dl
l", 0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x51A70000.
GetProcAddress(0x51A70000 [DIASYMREADER.DLL], "DllGetClassObjectInternal")
called from "MSCOREE.DLL" at address 0x79179695 and returned 0x51A89D7D.
GetProcAddress(0x79510000 [MSCORSN.DLL], "StrongNameTokenFromPublicKey")
called from "MSCOREE.DLL" at address 0x7917D14F and returned 0x79513EAF.
LoadLibraryA("C:\WINDOWS\System32\rsaenh.dll") called from "ADVAPI32.DLL" at
address 0x77DDA272.
Loaded "RSAENH.DLL" at address 0x0FFD0000. Successfully hooked module.
DllMain(0x0FFD0000, DLL_PROCESS_ATTACH, 0x00000000) in "RSAENH.DLL" called.
LoadLibraryExA("crypt32.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "RSAENH.DLL" at address 0x0FFEB9E4.
Mapped "CRYPT32.DLL" as a data file into memory at address 0x071E0001.
LoadLibraryExA("crypt32.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) returned
0x071E0001.
DllMain(0x0FFD0000, DLL_PROCESS_ATTACH, 0x00000000) in "RSAENH.DLL" returned
1 (0x1).
LoadLibraryA("C:\WINDOWS\System32\rsaenh.dll") returned 0x0FFD0000.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPAcquireContext") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFDE5FF.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPReleaseContext") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFDDB18.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPGenKey") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFDA93A.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPDeriveKey") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFDABB0.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPDestroyKey") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD8907.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPSetKeyParam") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD8AD1.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPGetKeyParam") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD8EB6.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPExportKey") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFDB681.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPImportKey") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFDBBE4.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPEncrypt") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD671D.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPDecrypt") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD6B7A.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPCreateHash") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD6D21.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPHashData") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD74C0.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPHashSessionKey") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD75FC.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPDestroyHash") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD78C4.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPSignHash") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFDC74A.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPVerifySignature") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFDCB85.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPGenRandom") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFDC598.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPGetUserKey") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD8A02.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPSetProvParam") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD92EC.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPGetProvParam") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD9414.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPSetHashParam") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD99D5.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPGetHashParam") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD9E08.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPDuplicateKey") called from
"ADVAPI32.DLL" at address 0x77DD81B7 and returned 0x0FFDA46C.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPDuplicateHash") called from
"ADVAPI32.DLL" at address 0x77DD81B7 and returned 0x0FFD7A99.
GetProcAddress(0x79510000 [MSCORSN.DLL], "StrongNameFreeBuffer") called from
"MSCOREE.DLL" at address 0x7917D1EA and returned 0x79512274.
LoadLibraryExW("mscoree.dll", 0x00000000, 0x00000000) called from
"MSCORSN.DLL" at address 0x79517307.
LoadLibraryExW("mscoree.dll", 0x00000000, 0x00000000) returned 0x79170000.
GetProcAddress(0x79170000 [MSCOREE.DLL], "GetMetaDataInternalInterface")
called from "MSCORSN.DLL" at address 0x79513377 and returned 0x791834C7.
GetProcAddress(0x791B0000 [MSCORWKS.DLL], "GetMetaDataInternalInterface")
called from "MSCOREE.DLL" at address 0x791834EF and returned 0x791C2164.
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsec.dll",
0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCORWKS.DLL" at
address 0x791B7B63.
Loaded "MSCORSEC.DLL" at address 0x794F0000. Successfully hooked module.
Loaded "WINTRUST.DLL" at address 0x76C30000. Successfully hooked module.
Loaded "CRYPT32.DLL" at address 0x762C0000. Successfully hooked module.
Loaded "MSASN1.DLL" at address 0x762A0000. Successfully hooked module.
Loaded "IMAGEHLP.DLL" at address 0x76C90000. Successfully hooked module.
DllMain(0x762A0000, DLL_PROCESS_ATTACH, 0x00000000) in "MSASN1.DLL" called.
DllMain(0x762A0000, DLL_PROCESS_ATTACH, 0x00000000) in "MSASN1.DLL" returned
1 (0x1).
DllMain(0x762C0000, DLL_PROCESS_ATTACH, 0x00000000) in "CRYPT32.DLL" called.
LoadLibraryA("advapi32.dll") called from "CRYPT32.DLL" at address
0x762C92A2.
LoadLibraryA("advapi32.dll") returned 0x77DD0000.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptAcquireContextW") called
from "CRYPT32.DLL" at address 0x762C92B5 and returned 0x77DD835C.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptSignHashW") called from
"CRYPT32.DLL" at address 0x762C92C7 and returned 0x77DDF3F8.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptVerifySignatureW") called
from "CRYPT32.DLL" at address 0x762C92D9 and returned 0x77DDA957.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptSetProviderW") called from
"CRYPT32.DLL" at address 0x762C92EB and returned 0x77E099BF.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "CryptEnumProvidersW") called from
"CRYPT32.DLL" at address 0x762C92FD and returned 0x77DDFB2E.
LoadLibraryA("kernel32.dll") called from "CRYPT32.DLL" at address
0x762DC6FA.
LoadLibraryA("kernel32.dll") returned 0x77E60000.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "RegisterWaitForSingleObject")
called from "CRYPT32.DLL" at address 0x762DC711 and returned 0x77E6BC5C.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "UnregisterWaitEx") called from
"CRYPT32.DLL" at address 0x762DC727 and returned 0x77E6BCCB.
LoadLibraryA("advapi32.dll") called from "MSASN1.DLL" at address 0x762A77B0.
LoadLibraryA("advapi32.dll") returned 0x77DD0000.
GetProcAddress(0x77DD0000 [ADVAPI32.DLL], "RegOpenKeyExA") called from
"MSASN1.DLL" at address 0x762A77C6 and returned 0x77DD229A.
DllMain(0x762C0000, DLL_PROCESS_ATTACH, 0x00000000) in "CRYPT32.DLL"
returned 1 (0x1).
DllMain(0x76C90000, DLL_PROCESS_ATTACH, 0x00000000) in "IMAGEHLP.DLL"
called.
DllMain(0x76C90000, DLL_PROCESS_ATTACH, 0x00000000) in "IMAGEHLP.DLL"
returned 1 (0x1).
DllMain(0x76C30000, DLL_PROCESS_ATTACH, 0x00000000) in "WINTRUST.DLL"
called.
DllMain(0x76C30000, DLL_PROCESS_ATTACH, 0x00000000) in "WINTRUST.DLL"
returned 1 (0x1).
DllMain(0x794F0000, DLL_PROCESS_ATTACH, 0x00000000) in "MSCORSEC.DLL"
called.
LoadLibraryA("RichEd20.dll") called from "MSCORSEC.DLL" at address
0x794F267C.
Loaded "RICHED20.DLL" at address 0x74E30000. Successfully hooked module.
DllMain(0x74E30000, DLL_PROCESS_ATTACH, 0x00000000) in "RICHED20.DLL"
called.
DllMain(0x74E30000, DLL_PROCESS_ATTACH, 0x00000000) in "RICHED20.DLL"
returned 1 (0x1).
LoadLibraryA("RichEd20.dll") returned 0x74E30000.
DllMain(0x74E30000, DLL_PROCESS_DETACH, 0x00000000) in "RICHED20.DLL"
called.
DllMain(0x74E30000, DLL_PROCESS_DETACH, 0x00000000) in "RICHED20.DLL"
returned 1 (0x1).
Unloaded "RICHED20.DLL" at address 0x74E30000.
DllMain(0x794F0000, DLL_PROCESS_ATTACH, 0x00000000) in "MSCORSEC.DLL"
returned 1 (0x1).
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsec.dll",
0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x794F0000.
GetProcAddress(0x794F0000 [MSCORSEC.DLL], "GetPublisher") called from
"MSCORWKS.DLL" at address 0x791E5C93 and returned 0x794FD5E3.
LoadLibraryA("mscoree.dll") called from "MSCORSEC.DLL" at address
0x794FE84A.
LoadLibraryA("mscoree.dll") returned 0x79170000.
GetProcAddress(0x79170000 [MSCOREE.DLL], "CoInitializeEE") called from
"MSCORSEC.DLL" at address 0x794FE933 and returned 0x791832FD.
GetProcAddress(0x791B0000 [MSCORWKS.DLL], "CoInitializeEE") called from
"MSCOREE.DLL" at address 0x79183325 and returned 0x791C7E88.
LoadLibraryExW("OLE32.DLL", 0x00000000, 0x00000000) called from
"MSCORSEC.DLL" at address 0x794F68C9.
LoadLibraryExW("OLE32.DLL", 0x00000000, 0x00000000) returned 0x771B0000.
LoadLibraryW("mscorsec.dll") called from "WINTRUST.DLL" at address
0x76C32E40.
LoadLibraryW("mscorsec.dll") returned 0x794F0000.
LoadLibraryW("SOFTPUB.DLL") called from "WINTRUST.DLL" at address
0x76C32E40.
Loaded "SOFTPUB.DLL" at address 0x732D0000. Successfully hooked module.
DllMain(0x732D0000, DLL_PROCESS_ATTACH, 0x00000000) in "SOFTPUB.DLL" called.
DllMain(0x732D0000, DLL_PROCESS_ATTACH, 0x00000000) in "SOFTPUB.DLL"
returned 1 (0x1).
LoadLibraryW("SOFTPUB.DLL") returned 0x732D0000.
LoadLibraryW("SOFTPUB.DLL") called from "WINTRUST.DLL" at address
0x76C32E40.
LoadLibraryW("SOFTPUB.DLL") returned 0x732D0000.
LoadLibraryW("SOFTPUB.DLL") called from "WINTRUST.DLL" at address
0x76C32E40.
LoadLibraryW("SOFTPUB.DLL") returned 0x732D0000.
LoadLibraryW("SOFTPUB.DLL") called from "WINTRUST.DLL" at address
0x76C32E40.
LoadLibraryW("SOFTPUB.DLL") returned 0x732D0000.
GetProcAddress(0x76C30000 [WINTRUST.DLL], "WintrustCertificateTrust") called
from "WINTRUST.DLL" at address 0x76C32DEB and returned 0x76C31F86.
GetProcAddress(0x794F0000 [MSCORSEC.DLL], "CORPolicyEE") called from
"WINTRUST.DLL" at address 0x76C32DEB and returned 0x794FD85E.
GetProcAddress(0x732D0000 [SOFTPUB.DLL], "SoftpubInitialize") called from
"WINTRUST.DLL" at address 0x76C32DEB and returned 0x732D10DC.
GetProcAddress(0x732D0000 [SOFTPUB.DLL], "SoftpubLoadMessage") called from
"WINTRUST.DLL" at address 0x76C32DEB and returned 0x732D10E1.
GetProcAddress(0x732D0000 [SOFTPUB.DLL], "SoftpubLoadSignature") called from
"WINTRUST.DLL" at address 0x76C32DEB and returned 0x732D10E6.
GetProcAddress(0x732D0000 [SOFTPUB.DLL], "SoftpubCheckCert") called from
"WINTRUST.DLL" at address 0x76C32DEB and returned 0x732D10EB.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPAcquireContext") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFDE5FF.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPReleaseContext") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFDDB18.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPGenKey") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFDA93A.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPDeriveKey") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFDABB0.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPDestroyKey") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD8907.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPSetKeyParam") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD8AD1.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPGetKeyParam") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD8EB6.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPExportKey") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFDB681.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPImportKey") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFDBBE4.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPEncrypt") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD671D.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPDecrypt") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD6B7A.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPCreateHash") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD6D21.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPHashData") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD74C0.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPHashSessionKey") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD75FC.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPDestroyHash") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD78C4.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPSignHash") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFDC74A.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPVerifySignature") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFDCB85.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPGenRandom") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFDC598.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPGetUserKey") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD8A02.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPSetProvParam") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD92EC.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPGetProvParam") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD9414.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPSetHashParam") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD99D5.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPGetHashParam") called from
"ADVAPI32.DLL" at address 0x77DD8182 and returned 0x0FFD9E08.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPDuplicateKey") called from
"ADVAPI32.DLL" at address 0x77DD81B7 and returned 0x0FFDA46C.
GetProcAddress(0x0FFD0000 [RSAENH.DLL], "CPDuplicateHash") called from
"ADVAPI32.DLL" at address 0x77DD81B7 and returned 0x0FFD7A99.
GetProcAddress(0x76C30000 [WINTRUST.DLL], "WintrustCertificateTrust") called
from "WINTRUST.DLL" at address 0x76C32DEB and returned 0x76C31F86.
GetProcAddress(0x76C30000 [WINTRUST.DLL], "SoftpubAuthenticode") called from
"WINTRUST.DLL" at address 0x76C32DEB and returned 0x76C320A3.
GetProcAddress(0x76C30000 [WINTRUST.DLL], "SoftpubInitialize") called from
"WINTRUST.DLL" at address 0x76C32DEB and returned 0x76C3274B.
GetProcAddress(0x76C30000 [WINTRUST.DLL], "SoftpubLoadMessage") called from
"WINTRUST.DLL" at address 0x76C32DEB and returned 0x76C32258.
GetProcAddress(0x76C30000 [WINTRUST.DLL], "SoftpubLoadSignature") called
from "WINTRUST.DLL" at address 0x76C32DEB and returned 0x76C3244D.
GetProcAddress(0x76C30000 [WINTRUST.DLL], "SoftpubCheckCert") called from
"WINTRUST.DLL" at address 0x76C32DEB and returned 0x76C3628A.
GetProcAddress(0x76C30000 [WINTRUST.DLL], "SoftpubCleanup") called from
"WINTRUST.DLL" at address 0x76C32DEB and returned 0x76C31FC8.
GetProcAddress(0x79170000 [MSCOREE.DLL], "CoUninitializeEE") called from
"MSCORSEC.DLL" at address 0x794FE933 and returned 0x7918334F.
GetProcAddress(0x791B0000 [MSCORWKS.DLL], "CoUninitializeEE") called from
"MSCOREE.DLL" at address 0x79183377 and returned 0x791C6C48.
LoadLibraryExW("c:\program files\planet
beach\solarware.net\2004.6.16.1\pegasusimaging.winforms.capturepro3.dll",
0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCORWKS.DLL" at
address 0x791B7B63.
Loaded "PEGASUSIMAGING.WINFORMS.CAPTUREPRO3.DLL" at address 0x10000000.
Successfully hooked module.
Loaded "OLEAUT32.DLL" at address 0x77120000. Successfully hooked module.
DllMain(0x77120000, DLL_PROCESS_ATTACH, 0x00000000) in "OLEAUT32.DLL"
called.
DllMain(0x77120000, DLL_PROCESS_ATTACH, 0x00000000) in "OLEAUT32.DLL"
returned 1 (0x1).
DllMain(0x10000000, DLL_PROCESS_ATTACH, 0x00000000) in
"PEGASUSIMAGING.WINFORMS.CAPTUREPRO3.DLL" called.
LoadLibraryExW("c:\program files\planet
beach\solarware.net\2004.6.16.1\pegasusimaging.winforms.capturepro3.dll",
0x00000000, 0x00000000) called from "MSCORWKS.DLL" at address 0x791B7B63.
LoadLibraryExW("c:\program files\planet
beach\solarware.net\2004.6.16.1\pegasusimaging.winforms.capturepro3.dll",
0x00000000, 0x00000000) returned 0x10000000.
LoadLibraryExW("OLE32.DLL", 0x00000000, 0x00000000) called from
"MSCORSEC.DLL" at address 0x794F68C9.
LoadLibraryExW("OLE32.DLL", 0x00000000, 0x00000000) returned 0x771B0000.
LoadLibraryExW("WINTRUST.DLL", 0x00000000, 0x00000000) called from
"CRYPT32.DLL" at address 0x762ED23F.
LoadLibraryExW("WINTRUST.DLL", 0x00000000, 0x00000000) returned 0x76C30000.
GetProcAddress(0x76C30000 [WINTRUST.DLL], "DllCanUnloadNow") called from
"CRYPT32.DLL" at address 0x762ED251 and returned NULL. Error: The specified
procedure could not be found (127).
GetProcAddress(0x76C30000 [WINTRUST.DLL], "CryptSIPPutSignedDataMsg") called
from "CRYPT32.DLL" at address 0x762ED2F6 and returned 0x76C48A14.
LoadLibraryExW("C:\WINDOWS\system32\CRYPT32.dll", 0x00000000, 0x00000000)
called from "CRYPT32.DLL" at address 0x762EBA95.
LoadLibraryExW("C:\WINDOWS\system32\CRYPT32.dll", 0x00000000, 0x00000000)
returned 0x762C0000.
GetProcAddress(0x76C30000 [WINTRUST.DLL], "CryptSIPGetSignedDataMsg") called
from "CRYPT32.DLL" at address 0x762ED2F6 and returned 0x76C367B6.
GetProcAddress(0x76C30000 [WINTRUST.DLL],
"WVTAsn1SpcIndirectDataContentDecode") called from "CRYPT32.DLL" at address
0x762ED2F6 and returned 0x76C3692B.
GetProcAddress(0x76C30000 [WINTRUST.DLL], "CryptSIPVerifyIndirectData")
called from "CRYPT32.DLL" at address 0x762ED2F6 and returned 0x76C3BD4E.
GetProcAddress(0x76C30000 [WINTRUST.DLL], "WVTAsn1SpcPeImageDataDecode")
called from "CRYPT32.DLL" at address 0x762ED2F6 and returned 0x76C41E43.
LoadLibraryA("kernel32.dll") called from "CRYPT32.DLL" at address
0x76321658.
LoadLibraryA("kernel32.dll") returned 0x77E60000.
GetProcAddress(0x77E60000 [KERNEL32.DLL], "RegisterWaitForSingleObject")
called from "CRYPT32.DLL" at address 0x7632166A and returned 0x77E6BC5C.
"Jonathan Keljo [MS]" - 08 Jul 2004 18:21 GMT
Greg & I followed up on this one offline. It looks likely that his problem
is caused by a library that is running managed code within DllMain, which
can commonly cause deadlocks. For more information on that issue, check out
the following articles:
http://www.codeproject.com/scrapbook/semicolon_2.asp
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dv_vstechar
t/html/vcconMixedDLLLoadingProblem.asp
http://support.microsoft.com/?id=814472
Jonathan
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| From: "Greg Young" <greg.young@planetbeach.com>
| References: <15A216DA-0442-4D36-AFAA-A204535775E8@microsoft.com>
<i5KDCPiWEHA.3440@cpmsftngxa10.phx.gbl>
| Subject: Re: Rather weird issue
| Date: Fri, 25 Jun 2004 10:27:18 -0500
[quoted text clipped - 7 lines]
| NNTP-Posting-Host: 204.252.228.185
| Path:
cpmsftngxa10.phx.gbl!TK2MSFTFEED01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP10
.phx.gbl
| Xref: cpmsftngxa10.phx.gbl microsoft.public.dotnet.framework.clr:11039
| X-Tomcat-NG: microsoft.public.dotnet.framework.clr
[quoted text clipped - 76 lines]
|
| Automatically open and profile child processes.
----------------------------------------------------------------------------
| ----
|
[quoted text clipped - 22 lines]
|
| DllMain(0x78000000, DLL_PROCESS_ATTACH, 0x00000000) in "RPCRT4.DLL"
returned
| 1 (0x1).
|
[quoted text clipped - 43 lines]
|
| DllMain(0x77C10000, DLL_PROCESS_ATTACH, 0x00000000) in "MSVCRT.DLL"
returned
| 1 (0x1).
|
| DllMain(0x77D40000, DLL_PROCESS_ATTACH, 0x00000000) in "USER32.DLL" called.
|
| DllMain(0x77D40000, DLL_PROCESS_ATTACH, 0x00000000) in "USER32.DLL"
returned
| 1 (0x1).
|
[quoted text clipped - 22 lines]
| GetProcAddress(0x70A70000 [SHLWAPI.DLL], "UrlIsW") called from "MSCOREE.DLL"
| at address 0x7917B6A4 and returned 0x70AB5EE6.
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll",
| 0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCOREE.DLL" at
| address 0x79178D7A.
[quoted text clipped - 54 lines]
|
| DllMain(0x79040000, DLL_PROCESS_ATTACH, 0x00000000) in "FUSION.DLL"
returned
| 1 (0x1).
|
[quoted text clipped - 49 lines]
| DllMain(0x791B0000, DLL_PROCESS_ATTACH, 0x00000000) in "MSCORWKS.DLL"
| returned 1 (0x1).
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll",
| 0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x791B0000.
|
[quoted text clipped - 48 lines]
|
| GetProcAddress(0x77E60000 [KERNEL32.DLL],
"QueryMemoryResourceNotification")
| called from "MSCORWKS.DLL" at address 0x791D22D0 and returned 0x77EB478C.
|
| GetProcAddress(0x70A70000 [SHLWAPI.DLL], "StrCmpW") called from "FUSION.DLL"
| at address 0x7904DE8A and returned 0x70A9572C.
LoadLibraryExW("c:\windows\microsoft.net\framework\v1.1.4322\mscorlib.dll",
| 0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCORWKS.DLL" at
| address 0x791B7B63.
[quoted text clipped - 3 lines]
| GetProcAddress(0x791B0000 [MSCORWKS.DLL], "_CorDllMain") called from
| "MSCOREE.DLL" at address 0x7917CFF3 and returned 0x791C6C83.
LoadLibraryExW("c:\windows\microsoft.net\framework\v1.1.4322\mscorlib.dll",
| 0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x79780000.
|
[quoted text clipped - 34 lines]
|
| GetProcAddress(0x79170000 [MSCOREE.DLL],
"StrongNameSignatureVerification")
| called from "FUSION.DLL" at address 0x79053C82 and returned 0x791799D8.
|
[quoted text clipped - 44 lines]
|
| GetProcAddress(0x70A70000 [SHLWAPI.DLL], "UrlIsW") called from
"FUSION.DLL"
| at address 0x7904DE8A and returned 0x70AB5EE6.
|
[quoted text clipped - 12 lines]
| GetProcAddress(0x70A70000 [SHLWAPI.DLL], "PathCreateFromUrlW") called from
| "FUSION.DLL" at address 0x7904DE8A and returned 0x70AB6131.
LoadLibraryExW("c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.500
| 0.0__b77a5c561934e089_a0c6a09b\mscorlib.dll", 0x00000000,
| LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCORWKS.DLL" at address
| 0x791B7B63.
|
| Loaded "MSCORLIB.DLL" at address 0x79980000. Successfully hooked module.
LoadLibraryExW("c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.500
| 0.0__b77a5c561934e089_a0c6a09b\mscorlib.dll", 0x00000000,
| LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x79980000.
[quoted text clipped - 86 lines]
|
| DllMain(0x771B0000, DLL_PROCESS_ATTACH, 0x00000000) in "OLE32.DLL"
returned
| 1 (0x1).
|
[quoted text clipped - 73 lines]
| GetProcAddress(0x70A70000 [SHLWAPI.DLL], "StrCmpNW") called from
| "FUSION.DLL" at address 0x7904DE8A and returned 0x70A94915.
LoadLibraryExW("c:\windows\assembly\gac\system.windows.forms\1.0.5000.0__b77
| a5c561934e089\system.windows.forms.dll", 0x00000000,
| DONT_RESOLVE_DLL_REFERENCES | LOAD_WITH_ALTERED_SEARCH_PATH) called from
| "MSCORWKS.DLL" at address 0x791B7B63.
|
| Loaded "SYSTEM.WINDOWS.FORMS.DLL" at address 0x7B610000. Successfully hooked
| module.
LoadLibraryExW("c:\windows\assembly\gac\system.windows.forms\1.0.5000.0__b77
| a5c561934e089\system.windows.forms.dll", 0x00000000,
| DONT_RESOLVE_DLL_REFERENCES | LOAD_WITH_ALTERED_SEARCH_PATH) returned
| 0x7B610000.
LoadLibraryExW("c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.f
| orms\1.0.5000.0__b77a5c561934e089_b93ce197\system.windows.forms.dll",
| 0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCORWKS.DLL" at
| address 0x791B7B63.
|
| Loaded "SYSTEM.WINDOWS.FORMS.DLL" at address 0x7B810000. Successfully hooked
| module.
LoadLibraryExW("c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.f
| orms\1.0.5000.0__b77a5c561934e089_b93ce197\system.windows.forms.dll",
| 0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x7B810000.
LoadLibraryExW("c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\
| system.dll", 0x00000000, DONT_RESOLVE_DLL_REFERENCES |
| LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCORWKS.DLL" at address
| 0x791B7B63.
|
| Loaded "SYSTEM.DLL" at address 0x7B0A0000. Successfully hooked module.
LoadLibraryExW("c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\
| system.dll", 0x00000000, DONT_RESOLVE_DLL_REFERENCES |
| LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x7B0A0000.
LoadLibraryExW("c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.
| 0__b77a5c561934e089_7225b91c\system.dll", 0x00000000,
| LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCORWKS.DLL" at address
| 0x791B7B63.
|
| Loaded "SYSTEM.DLL" at address 0x7B1D0000. Successfully hooked module.
LoadLibraryExW("c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.
| 0__b77a5c561934e089_7225b91c\system.dll", 0x00000000,
| LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x7B1D0000.
[quoted text clipped - 91 lines]
| DONT_RESOLVE_DLL_REFERENCES | LOAD_WITH_ALTERED_SEARCH_PATH) returned
| 0x06C90000.
LoadLibraryExW("c:\windows\assembly\nativeimages1_v1.1.4322\solarwareobjects
| \1.0.1.0___4ae82bc2\solarwareobjects.dll", 0x00000000,
| LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCORWKS.DLL" at address
| 0x791B7B63.
|
| Loaded "SOLARWAREOBJECTS.DLL" at address 0x110A0000. Successfully hooked
| module.
LoadLibraryExW("c:\windows\assembly\nativeimages1_v1.1.4322\solarwareobjects
| \1.0.1.0___4ae82bc2\solarwareobjects.dll", 0x00000000,
| LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x110A0000.
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MSCORJIT.DLL",
| 0x00000000, 0x00000000) called from "MSCORWKS.DLL" at address 0x791B7B63.
|
[quoted text clipped - 5 lines]
| DllMain(0x79430000, DLL_PROCESS_ATTACH, 0x00000000) in "MSCORJIT.DLL"
| returned 1 (0x1).
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MSCORJIT.DLL",
| 0x00000000, 0x00000000) returned 0x79430000.
|
[quoted text clipped - 12 lines]
| GetProcAddress(0x79170000 [MSCOREE.DLL], "DllGetClassObject") called from
| "MSCORWKS.DLL" at address 0x7928C7C4 and returned 0x7917960C.
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\diasymreader.dl
| l", 0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCOREE.DLL" at
| address 0x79178D7A.
[quoted text clipped - 6 lines]
| DllMain(0x51A70000, DLL_PROCESS_ATTACH, 0x00000000) in "DIASYMREADER.DLL"
| returned 1 (0x1).
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\diasymreader.dl
| l", 0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x51A70000.
|
[quoted text clipped - 17 lines]
|
| LoadLibraryExA("crypt32.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned
| 0x071E0001.
|
| DllMain(0x0FFD0000, DLL_PROCESS_ATTACH, 0x00000000) in "RSAENH.DLL"
returned
| 1 (0x1).
|
[quoted text clipped - 88 lines]
| GetProcAddress(0x791B0000 [MSCORWKS.DLL], "GetMetaDataInternalInterface")
| called from "MSCOREE.DLL" at address 0x791834EF and returned 0x791C2164.
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsec.dll",
| 0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) called from "MSCORWKS.DLL" at
| address 0x791B7B63.
[quoted text clipped - 12 lines]
|
| DllMain(0x762A0000, DLL_PROCESS_ATTACH, 0x00000000) in "MSASN1.DLL"
returned
| 1 (0x1).
|
[quoted text clipped - 79 lines]
| DllMain(0x794F0000, DLL_PROCESS_ATTACH, 0x00000000) in "MSCORSEC.DLL"
| returned 1 (0x1).
LoadLibraryExW("C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsec.dll",
| 0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x794F0000.
|
[quoted text clipped - 239 lines]
| GetProcAddress(0x77E60000 [KERNEL32.DLL], "RegisterWaitForSingleObject")
| called from "CRYPT32.DLL" at address 0x7632166A and returned 0x77E6BC5C.