BEX windows Error

Recently one of our hosted citrix applications crashes with a BEX error on windows 2012 R2 . Recent steps include removing DEP on the hosted app SomeAppRES.exe , and disabling the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel,  'DisableExceptionChainValidation ' .

Any further ideas on how to correct this . This is a vmware env running guest vm windows 2012 R2


Version=1
EventType=BEX
EventTime=131910025442330121
ReportType=2
Consent=1
ReportIdentifier=5e3c137a-0f6b-11e9-8106-005056a96fb6
IntegratorReportIdentifier=5e3c1379-0f6b-11e9-8106-005056a96fb6
WOW64=1
NsAppName=SomeAppRES.exe
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=SomeAppRES.exe
Sig[1].Name=Application Version
Sig[1].Value=18.9.0.3
Sig[2].Name=Application Timestamp
Sig[2].Value=5bd0c37b
Sig[3].Name=Fault Module Name
Sig[3].Value=StackHash_e909
Sig[4].Name=Fault Module Version
Sig[4].Value=0.0.0.0
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=00000000
Sig[6].Name=Exception Offset
Sig[6].Value=PCH_E1_FROM_ntdll+0x0003C8AC
Sig[7].Name=Exception Code
Sig[7].Value=c0000005
Sig[8].Name=Exception Data
Sig[8].Value=00000008
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=6.3.9600.2.0.0.16.7
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=1033
DynamicSig[22].Name=Additional Information 1
DynamicSig[22].Value=e909
DynamicSig[23].Name=Additional Information 2
DynamicSig[23].Value=e9093dd2e946cc03dadc0f0b7d968e3d
DynamicSig[24].Name=Additional Information 3
DynamicSig[24].Value=5233
DynamicSig[25].Name=Additional Information 4
DynamicSig[25].Value=5233c2f0a2e01bc157faae623d71c7fc
UI[2]=C:\Company\SomeAppRES\Pasco\SomeAppRES.exe
UI[3]=SomeAppRES has stopped working
UI[4]=Windows can check online for a solution to the problem.
UI[5]=Check online for a solution and close the program
UI[6]=Check online for a solution later and close the program
UI[7]=Close the program
LoadedModule[0]=C:\Company\SomeAppRES\Pasco\SomeAppRES.exe
LoadedModule[1]=C:\Windows\SYSTEM32\ntdll.dll
LoadedModule[2]=C:\Windows\SYSTEM32\KERNEL32.DLL
LoadedModule[3]=C:\Windows\SYSTEM32\KERNELBASE.dll
LoadedModule[4]=C:\Windows\SYSTEM32\tsappcmp.dll
LoadedModule[5]=C:\Windows\SYSTEM32\msvcrt.dll
LoadedModule[6]=C:\Windows\SYSTEM32\combase.dll
LoadedModule[7]=C:\Windows\SYSTEM32\RPCRT4.dll
LoadedModule[8]=C:\Windows\SYSTEM32\USER32.dll
LoadedModule[9]=C:\Windows\SYSTEM32\ADVAPI32.dll
LoadedModule[10]=C:\Windows\SYSTEM32\SspiCli.dll
LoadedModule[11]=C:\Windows\SYSTEM32\GDI32.dll
LoadedModule[12]=C:\Windows\SYSTEM32\sechost.dll
LoadedModule[13]=C:\Windows\SYSTEM32\CRYPTBASE.dll
LoadedModule[14]=C:\Windows\SYSTEM32\bcryptPrimitives.dll
LoadedModule[15]=C:\Windows\system32\IMM32.DLL
LoadedModule[16]=C:\Windows\SYSTEM32\MSCTF.dll
LoadedModule[17]=C:\Windows\SYSTEM32\MSVBVM60.DLL
LoadedModule[18]=C:\Windows\SYSTEM32\ole32.dll
LoadedModule[19]=C:\Windows\SYSTEM32\OLEAUT32.dll
LoadedModule[20]=C:\Program Files (x86)\Citrix\system32\MfApHook.dll
LoadedModule[21]=C:\Windows\system32\RTWORKQ.DLL
LoadedModule[22]=C:\Windows\SYSTEM32\AVRT.dll
LoadedModule[23]=C:\Program Files (x86)\Citrix\system32\CtxMFPlugin.dll
LoadedModule[24]=C:\Windows\SYSTEM32\MF.dll
LoadedModule[25]=C:\Windows\SYSTEM32\MFPlat.DLL
LoadedModule[26]=C:\Windows\SYSTEM32\cfgmgr32.dll
LoadedModule[27]=C:\Windows\SYSTEM32\MFCORE.DLL
LoadedModule[28]=C:\Windows\SYSTEM32\ksuser.dll
LoadedModule[29]=C:\Windows\SYSTEM32\kernel.appcore.dll
LoadedModule[30]=C:\Program Files (x86)\Citrix\system32\CtxGraphicsHelper.dll
LoadedModule[31]=C:\Windows\SYSTEM32\SETUPAPI.dll
LoadedModule[32]=C:\Program Files (x86)\Citrix\system32\mmhook.dll
LoadedModule[33]=C:\Program Files (x86)\Citrix\system32\Sfrhook.dll
LoadedModule[34]=C:\Windows\SYSTEM32\WTSAPI32.dll
LoadedModule[35]=C:\Program Files (x86)\Citrix\system32\ShellHook.dll
LoadedModule[36]=C:\Windows\SYSTEM32\SHELL32.dll
LoadedModule[37]=C:\Windows\SYSTEM32\SHLWAPI.dll
LoadedModule[38]=C:\Program Files (x86)\Citrix\system32\scardhook.dll
LoadedModule[39]=C:\Program Files (x86)\Citrix\system32\twnhook.dll
LoadedModule[40]=C:\Program Files (x86)\Citrix\system32\cxinjime.dll
LoadedModule[41]=C:\Windows\system32\uxtheme.dll
LoadedModule[42]=C:\Program Files (x86)\Citrix\System32\sehook20.dll
LoadedModule[43]=C:\Windows\SYSTEM32\MSVCR120.dll
LoadedModule[44]=C:\Program Files (x86)\Citrix\System32\CUtilDll.dll
LoadedModule[45]=C:\Program Files (x86)\Citrix\System32\CtxWsApi.dll
LoadedModule[46]=C:\Windows\SYSTEM32\ACTIVEDS.dll
LoadedModule[47]=C:\Windows\SYSTEM32\NETAPI32.dll
LoadedModule[48]=C:\Windows\SYSTEM32\Secur32.dll
LoadedModule[49]=C:\Windows\SYSTEM32\IPHLPAPI.DLL
LoadedModule[50]=C:\Windows\SYSTEM32\adsldpc.dll
LoadedModule[51]=C:\Windows\SYSTEM32\netutils.dll
LoadedModule[52]=C:\Windows\SYSTEM32\srvcli.dll
LoadedModule[53]=C:\Windows\SYSTEM32\wkscli.dll
LoadedModule[54]=C:\Windows\SYSTEM32\NSI.dll
LoadedModule[55]=C:\Windows\SYSTEM32\WINNSI.DLL
LoadedModule[56]=C:\Windows\SYSTEM32\WLDAP32.dll
LoadedModule[57]=C:\Windows\SYSTEM32\LOGONCLI.DLL
LoadedModule[58]=C:\Windows\SYSTEM32\SAMCLI.DLL
LoadedModule[59]=C:\Windows\SYSTEM32\SXS.DLL
LoadedModule[60]=C:\Windows\system32\dwmapi.dll
LoadedModule[61]=C:\Windows\SYSTEM32\clbcatq.dll
LoadedModule[62]=C:\Windows\SYSTEM32\mscomctl.OCX
LoadedModule[63]=C:\Windows\SYSTEM32\comdlg32.dll
LoadedModule[64]=C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.9600.17810_none_7c5b6194aa0716f1\COMCTL32.dll
LoadedModule[65]=C:\Windows\SYSTEM32\SHCORE.DLL
LoadedModule[66]=C:\Program Files\Company\Common\MDIExtender.ocx
LoadedModule[67]=C:\Windows\SYSTEM32\VERSION.DLL
LoadedModule[68]=C:\Program Files (x86)\Common Files\System\ado\msado15.dll
LoadedModule[69]=C:\Windows\SYSTEM32\MSDART.DLL
LoadedModule[70]=C:\Windows\system32\asycfilt.dll
LoadedModule[71]=C:\Windows\SYSTEM32\CRYPTSP.dll
LoadedModule[72]=C:\Windows\system32\rsaenh.dll
LoadedModule[73]=C:\Windows\SYSTEM32\bcrypt.dll
LoadedModule[74]=C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee\comctl32.DLL
LoadedModule[75]=C:\Program Files\Company\Common\amgenutl.dll
LoadedModule[76]=C:\Windows\SYSTEM32\scrrun.dll
LoadedModule[77]=C:\Windows\SYSTEM32\msxml4.dll
LoadedModule[78]=C:\Windows\SYSTEM32\comsvcs.dll
LoadedModule[79]=C:\Windows\SYSTEM32\AUTHZ.dll
LoadedModule[80]=C:\Windows\SYSTEM32\WS2_32.dll
LoadedModule[81]=C:\Windows\system32\mswsock.dll
LoadedModule[82]=C:\Windows\SYSTEM32\DNSAPI.dll
LoadedModule[83]=C:\Windows\System32\rasadhlp.dll
LoadedModule[84]=C:\Windows\System32\fwpuclnt.dll
LoadedModule[85]=C:\Windows\SYSTEM32\Kerberos.DLL
LoadedModule[86]=C:\Windows\SYSTEM32\MSASN1.dll
LoadedModule[87]=C:\Windows\SYSTEM32\cryptdll.dll
LoadedModule[88]=C:\Program Files (x86)\Common Files\System\Ole DB\oledb32.dll
LoadedModule[89]=C:\Windows\SYSTEM32\sqlncli10.dll
LoadedModule[90]=C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.8428_none_d08a11e2442dc25d\MSVCR80.dll
LoadedModule[91]=C:\Windows\SYSTEM32\CRYPT32.dll
LoadedModule[92]=C:\Windows\SYSTEM32\1033\SQLNCLIR10.RLL
LoadedModule[93]=C:\Windows\SYSTEM32\DPAPI.DLL
LoadedModule[94]=C:\Windows\SYSTEM32\netbios.dll
LoadedModule[95]=C:\Windows\SYSTEM32\msv1_0.DLL
LoadedModule[96]=C:\Windows\system32\ntdsapi.dll
LoadedModule[97]=C:\Windows\SYSTEM32\DSPARSE.DLL
LoadedModule[98]=C:\Windows\system32\security.dll
LoadedModule[99]=C:\Windows\SYSTEM32\schannel.dll
LoadedModule[100]=C:\Windows\SYSTEM32\ncrypt.dll
LoadedModule[101]=C:\Windows\SYSTEM32\NTASN1.dll
LoadedModule[102]=C:\Windows\system32\ncryptsslp.dll
LoadedModule[103]=C:\Program Files (x86)\Common Files\System\msadc\msadce.dll
LoadedModule[104]=C:\Program Files (x86)\Common Files\System\msadc\msadcer.dll
LoadedModule[105]=C:\Windows\SYSTEM32\mscoree.dll
LoadedModule[106]=C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
LoadedModule[107]=C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
LoadedModule[108]=C:\Windows\SYSTEM32\MSVCR120_CLR0400.dll
LoadedModule[109]=C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll
LoadedModule[110]=C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
LoadedModule[111]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System\60bb98fc0925ec2bdd609951e5c20dec\System.ni.dll
LoadedModule[112]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\ebaeb5bdc370618c8955257023cc15e0\System.Core.ni.dll
LoadedModule[113]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8f60dd698047ca9b5c73acbd13b160ba\System.Configuration.ni.dll
LoadedModule[114]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\290bf464763caee761422717fa91ad07\System.Xml.ni.dll
LoadedModule[115]=C:\Windows\SYSTEM32\profapi.dll
LoadedModule[116]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\81c74ec9cc65d4b2abac2f9613c4db13\System.ServiceModel.ni.dll
LoadedModule[117]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\215ab049ebbb8f45e1815a1515e40ddf\System.Data.ni.dll
LoadedModule[118]=C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll
LoadedModule[119]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\c22d300d596ce7549b818413c137fb34\System.Runtime.Serialization.ni.dll
LoadedModule[120]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Numerics\ee81fa2e7f333ee787a423c2e39ee3a3\System.Numerics.ni.dll
LoadedModule[121]=C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\ceee9d260702131765b5dc11c1bab9ba\SMDiagnostics.ni.dll
LoadedModule[122]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626#\9f260193b8fc10fcaf77bb839757095d\System.ServiceModel.Internals.ni.dll
LoadedModule[123]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\f27daedbe2f0131a4a3b943ae5c4d80d\System.IdentityModel.ni.dll
LoadedModule[124]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web\a564d382226dff2ee688ce04215cc0ae\System.Web.ni.dll
LoadedModule[125]=C:\Windows\Microsoft.NET\Framework\v4.0.30319\webengine4.dll
LoadedModule[126]=C:\Windows\SYSTEM32\USERENV.dll
LoadedModule[127]=C:\Windows\SYSTEM32\PSAPI.DLL
LoadedModule[128]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data7706cdc8#\35004cca95674cbc841db6e6d5db136d\System.Data.DataSetExtensions.ni.dll
LoadedModule[129]=C:\Windows\SYSTEM32\WINSTA.dll
LoadedModule[130]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Security\df4bf4ce7eea9f51ed81ca36694ea21e\System.Security.ni.dll
LoadedModule[131]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data.SqlXml\a3c0663e986ac64ef6a0248bfd3fc127\System.Data.SqlXml.ni.dll
LoadedModule[132]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Transactions\7980913823dee8722be18ac64ae00f0e\System.Transactions.ni.dll
LoadedModule[133]=C:\Windows\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll
LoadedModule[134]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Ente96d83b35#\ab5ddef019e12fa6db6ef48993bf7f9e\System.EnterpriseServices.ni.dll
LoadedModule[135]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\c03989c64aad9e4a1d8e728ad525a9a6\System.Xaml.ni.dll
LoadedModule[136]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\019a4b5f0c9c45271a48f55a3c5906e4\System.Net.Http.ni.dll
LoadedModule[137]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runt93d54979#\3665acdd67acdf28ab024ddba3068f4c\System.Runtime.DurableInstancing.ni.dll
LoadedModule[138]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Services\860a6fb9e37f2b12d136583d13471281\System.Web.Services.ni.dll
LoadedModule[139]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\1bb733a41f850f06a94b8f3550b135f5\System.Drawing.ni.dll
LoadedModule[140]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Comp46f2b404#\0aeaeef4947879fc52e5b53ae6bf1a84\System.ComponentModel.DataAnnotations.ni.dll
LoadedModule[141]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.8dc504e4#\ec4c990673a61d631d80f3664a777d99\System.Web.ApplicationServices.ni.dll
LoadedModule[142]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runt19c51595#\b6b16352366edee2efe6f8cc73957b34\System.Runtime.Caching.ni.dll
LoadedModule[143]=C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B3325a29b#\11a73667baeaa944d54ee71ff7783d73\Microsoft.Build.Framework.ni.dll
LoadedModule[144]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Ente96d83b35#\ab5ddef019e12fa6db6ef48993bf7f9e\System.EnterpriseServices.Wrapper.dll
LoadedModule[145]=C:\Windows\Microsoft.Net\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
LoadedModule[146]=C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\4eb9560e7a36228f6a9979d6aae62f69\System.Xml.Linq.ni.dll
LoadedModule[147]=C:\Windows\SYSTEM32\gpapi.dll
LoadedModule[148]=C:\Windows\SYSTEM32\cryptnet.dll
LoadedModule[149]=C:\Windows\SYSTEM32\msstdfmt.dll
LoadedModule[150]=C:\Program Files\Company\Common\IntAdvGrd.ocx
LoadedModule[151]=C:\Program Files\Company\Common\IntSbcls.dll
LoadedModule[152]=C:\Windows\SYSTEM32\OLEPRO32.DLL
LoadedModule[153]=C:\Windows\SYSTEM32\mscomct2.ocx
LoadedModule[154]=C:\Windows\SYSTEM32\ComDlg32.OCX
LoadedModule[155]=C:\Program Files\Company\Common\IntAdvIL.ocx
LoadedModule[156]=C:\Program Files\Company\Common\SomeAppText.dll
LoadedModule[157]=C:\Program Files\Company\Common\Int_FSFWJL.dll
LoadedModule[158]=C:\Windows\SYSTEM32\TabCtl32.Ocx
LoadedModule[159]=C:\Program Files\Company\Common\intpax.dll
FriendlyEventName=Stopped working
ConsentKey=BEX
AppName=SomeAppRES
AppPath=C:\Company\SomeAppRES\Pasco\SomeAppRES.exe
NsPartner=windows
NsGroup=windows8
ApplicationIdentity=0555BC59540DD73E4646C80815240DAD
davesnbAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Brian MurphySenior Information Technology ConsultantCommented:
Does the application use .NET?

I don't see anything listed for "Fault Module" but I've seen this with legacy type applications where it was actually related to Terminal Services in that having Citrix or not was not relevant.  This "could" be a function of RDS compatibility and where for this application it is calling a DLL function prior to establishing a link.

It looks like it is making calls to .NET v4.0.30319.  From 3.5 SP1 on the TSAWARE flag is set to On by default and I believe this would only apply if the application was built with C#/VB.Net.  Worth checking.  

On 2008 R2 having this flag set the application may work fine but moving to 2012 R2 (one example) might require setting this flag back to No.

Given the steps you have already completed, I would suggest this as next step:

Your going to need editbin.exe
https://www.experts-exchange.com/questions/26812582/From-where-I-can-download-EditBin.html

And a "Test" environment as I cannot recommend doing this directly in production environment.

Once editbin.exe is available, run this command:
editbin.exe /TSAWARE:NO  C:\Company\SomeAppRES\Pasco\SomeAppRES.exe

Once you have your test environment configured and were to install Visual Studio Express you could verify the flag setting using dumpbin.exe.

The true test however would be having users access the application once changing the flag.  This will either resolve or not but has worked for me where applicationA worked in one OS but not the other type scenario.

Hope this helps.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
davesnbAuthor Commented:
OK thank you
Brian MurphySenior Information Technology ConsultantCommented:
My pleasure.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Citrix

From novice to tech pro — start learning today.