Application exception occurred: App: C:\WINDOWS\Explorer.EXE (pid=1848) When: 1/19/2008 @ 09:38:41.015 Exception number: c0000005 (access violation) *----> System Information <----* Computer Name: YOUR-4DACD0EA75 User Name: HP_Administrator Terminal Session Id: 0 Number of Processors: 2 Processor Type: x86 Family 15 Model 75 Stepping 2 Windows Version: 5.1 Current Build: 2600 Service Pack: 2 Current Type: Multiprocessor Free Registered Organization: Registered Owner: *----> Task List <----* 0 System Process 4 System 660 smss.exe 896 csrss.exe 920 winlogon.exe 964 services.exe 976 lsass.exe 1144 svchost.exe 1228 svchost.exe 1372 svchost.exe 1428 svchost.exe 1576 svchost.exe 1828 aawservice.exe 1900 spoolsv.exe 1996 arservice.exe 196 ehRecvr.exe 220 ehSched.exe 320 LSSrvc.exe 432 lxcjcoms.exe 444 MBackMonitor.exe 1664 mcmscsvc.exe 1696 mcnasvc.exe 1784 mcproxy.exe 1820 mcshield.exe 236 MPFSrv.exe 644 MskSrver.exe 740 nvsvc32.exe 892 SAService.exe 1176 svchost.exe 1324 svchost.exe 1480 ViewpointService.exe 2156 mcrdsvc.exe 2836 dllhost.exe 3376 alg.exe 3672 mcsysmon.exe 764 mcagent.exe 1848 Explorer.EXE 544 ehtray.exe 3364 ARPWRMSG.EXE 2640 DMAScheduler.exe 2336 ehmsas.exe 2004 HPwuSchd2.exe 528 SiteAdv.exe 2500 lxcjmon.exe 3920 ezprint.exe 3900 WrtMon.exe 604 realsched.exe 2756 RTHDCPL.EXE 1980 WrtProc.exe 776 McAfeeDataBackup.exe 2384 Weather.exe 2676 SetPoint.exe 2780 Updates from HP.exe 4016 KHALMNPR.EXE 2364 msimn.exe 1836 KBD.EXE 3940 iexplore.exe 3484 WLLoginProxy.exe 3432 hpsysdrv.exe 3888 jusched.exe 3300 mcshell.exe 496 drwtsn32.exe *----> Module List <----* (0000000000400000 - 0000000000409000: C:\WINDOWS\system32\Normaliz.dll (0000000000c20000 - 0000000000c26000: C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll (0000000000cd0000 - 0000000000ce2000: C:\WINDOWS\system32\browselc.dll (0000000000f50000 - 0000000000fab000: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll (0000000001000000 - 00000000010ff000: C:\WINDOWS\Explorer.EXE (000000000ffd0000 - 000000000fff8000: C:\WINDOWS\system32\rsaenh.dll (0000000010000000 - 0000000010006000: C:\Program Files\SiteAdvisor\6253\saHook.dll (0000000010100000 - 0000000010111000: C:\Program Files\Logitech\SetPoint\lgscroll.dll (0000000010930000 - 0000000010979000: C:\WINDOWS\system32\PortableDeviceApi.dll (00000000109c0000 - 00000000109ec000: C:\WINDOWS\system32\PortableDeviceTypes.dll (0000000014490000 - 00000000144a2000: C:\Program Files\McAfee\VirusScan\scriptsn.dll (00000000164a0000 - 00000000164c3000: C:\WINDOWS\system32\WPDShServiceObj.dll (0000000020000000 - 00000000202c5000: C:\WINDOWS\system32\xpsp2res.dll (0000000042990000 - 00000000429d5000: C:\WINDOWS\system32\iertutil.dll (0000000042c10000 - 0000000042cdf000: C:\WINDOWS\system32\WININET.dll (0000000042cf0000 - 0000000042e17000: C:\WINDOWS\system32\urlmon.dll (0000000042e40000 - 0000000042e7c000: C:\WINDOWS\system32\webcheck.dll (0000000042ef0000 - 00000000434bd000: C:\WINDOWS\system32\ieframe.dll (000000004d4f0000 - 000000004d548000: C:\WINDOWS\system32\WINHTTP.dll (000000005a980000 - 000000005a9f2000: C:\WINDOWS\system32\FXSAPI.dll (000000005ad70000 - 000000005ada8000: C:\WINDOWS\system32\UxTheme.dll (000000005b860000 - 000000005b8b4000: C:\WINDOWS\system32\NETAPI32.dll (000000005ba60000 - 000000005bad1000: C:\WINDOWS\system32\themeui.dll (000000005cb70000 - 000000005cb96000: C:\WINDOWS\system32\ShimEng.dll (000000005d090000 - 000000005d12a000: C:\WINDOWS\system32\comctl32.dll (0000000063380000 - 00000000633f8000: C:\WINDOWS\system32\JScript.dll (0000000068df0000 - 0000000068e7d000: C:\WINDOWS\system32\fxsst.dll (000000006c1b0000 - 000000006c1fd000: C:\WINDOWS\system32\DUSER.dll (000000006f880000 - 000000006fa4a000: C:\WINDOWS\AppPatch\AcGenral.DLL (0000000071aa0000 - 0000000071aa8000: C:\WINDOWS\system32\WS2HELP.dll (0000000071ab0000 - 0000000071ac7000: C:\WINDOWS\system32\WS2_32.dll (0000000071b20000 - 0000000071b32000: C:\WINDOWS\system32\MPR.dll (0000000071bf0000 - 0000000071c03000: C:\WINDOWS\system32\SAMLIB.dll (0000000071c10000 - 0000000071c1e000: C:\WINDOWS\System32\ntlanman.dll (0000000071c80000 - 0000000071c87000: C:\WINDOWS\System32\NETRAP.dll (0000000071c90000 - 0000000071cd0000: C:\WINDOWS\System32\NETUI1.dll (0000000071cd0000 - 0000000071ce7000: C:\WINDOWS\System32\NETUI0.dll (0000000071d40000 - 0000000071d5c000: C:\WINDOWS\system32\actxprxy.dll (0000000072410000 - 000000007242a000: C:\WINDOWS\system32\mydocs.dll (0000000073000000 - 0000000073026000: C:\WINDOWS\system32\WINSPOOL.DRV (0000000073030000 - 0000000073040000: C:\WINDOWS\system32\WZCSAPI.DLL (0000000073300000 - 0000000073365000: C:\WINDOWS\system32\VBScript.dll (0000000074ad0000 - 0000000074ad8000: C:\WINDOWS\system32\POWRPROF.dll (0000000074af0000 - 0000000074afa000: C:\WINDOWS\system32\BatMeter.dll (00000000754d0000 - 0000000075550000: C:\WINDOWS\system32\CRYPTUI.dll (00000000755c0000 - 00000000755ee000: C:\WINDOWS\system32\msctfime.ime (0000000075cf0000 - 0000000075d81000: C:\WINDOWS\system32\MLANG.dll (0000000075e90000 - 0000000075f40000: C:\WINDOWS\system32\SXS.DLL (0000000075f60000 - 0000000075f67000: C:\WINDOWS\System32\drprov.dll (0000000075f70000 - 0000000075f79000: C:\WINDOWS\System32\davclnt.dll (0000000075f80000 - 000000007607d000: C:\WINDOWS\system32\BROWSEUI.dll (0000000076280000 - 00000000762a1000: C:\WINDOWS\system32\stobject.dll (0000000076360000 - 0000000076370000: C:\WINDOWS\system32\WINSTA.dll (0000000076380000 - 0000000076385000: C:\WINDOWS\system32\MSIMG32.dll (0000000076390000 - 00000000763ad000: C:\WINDOWS\system32\IMM32.DLL (0000000076400000 - 00000000765a5000: C:\WINDOWS\system32\NETSHELL.dll (0000000076600000 - 000000007661d000: C:\WINDOWS\System32\CSCDLL.dll (0000000076980000 - 0000000076988000: C:\WINDOWS\system32\LINKINFO.dll (0000000076990000 - 00000000769b5000: C:\WINDOWS\system32\ntshrui.dll (00000000769c0000 - 0000000076a73000: C:\WINDOWS\system32\USERENV.dll (0000000076b20000 - 0000000076b31000: C:\WINDOWS\system32\ATL.DLL (0000000076b40000 - 0000000076b6d000: C:\WINDOWS\system32\WINMM.dll (0000000076bf0000 - 0000000076bfb000: C:\WINDOWS\system32\PSAPI.DLL (0000000076c00000 - 0000000076c2e000: C:\WINDOWS\system32\credui.dll (0000000076c30000 - 0000000076c5e000: C:\WINDOWS\system32\WINTRUST.dll (0000000076c90000 - 0000000076cb8000: C:\WINDOWS\system32\IMAGEHLP.dll (0000000076d60000 - 0000000076d79000: C:\WINDOWS\system32\iphlpapi.dll (0000000076e80000 - 0000000076e8e000: C:\WINDOWS\system32\rtutils.dll (0000000076f50000 - 0000000076f58000: C:\WINDOWS\system32\WTSAPI32.dll (0000000076f60000 - 0000000076f8c000: C:\WINDOWS\system32\WLDAP32.dll (0000000076fd0000 - 000000007704f000: C:\WINDOWS\system32\CLBCATQ.DLL (0000000077050000 - 0000000077115000: C:\WINDOWS\system32\COMRes.dll (0000000077120000 - 00000000771ab000: C:\WINDOWS\system32\OLEAUT32.dll (00000000773d0000 - 00000000774d3000: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (00000000774e0000 - 000000007761d000: C:\WINDOWS\system32\ole32.dll (0000000077690000 - 00000000776b1000: C:\WINDOWS\system32\NTMARTA.DLL (0000000077920000 - 0000000077a13000: C:\WINDOWS\system32\SETUPAPI.dll (0000000077a20000 - 0000000077a74000: C:\WINDOWS\System32\cscui.dll (0000000077a80000 - 0000000077b14000: C:\WINDOWS\system32\CRYPT32.dll (0000000077b20000 - 0000000077b32000: C:\WINDOWS\system32\MSASN1.dll (0000000077b40000 - 0000000077b62000: C:\WINDOWS\system32\appHelp.dll (0000000077be0000 - 0000000077bf5000: C:\WINDOWS\system32\MSACM32.dll (0000000077c00000 - 0000000077c08000: C:\WINDOWS\system32\VERSION.dll (0000000077c10000 - 0000000077c68000: C:\WINDOWS\system32\msvcrt.dll (0000000077dd0000 - 0000000077e6b000: C:\WINDOWS\system32\ADVAPI32.dll (0000000077e70000 - 0000000077f01000: C:\WINDOWS\system32\RPCRT4.dll (0000000077f10000 - 0000000077f57000: C:\WINDOWS\system32\GDI32.dll (0000000077f60000 - 0000000077fd6000: C:\WINDOWS\system32\SHLWAPI.dll (0000000077fe0000 - 0000000077ff1000: C:\WINDOWS\system32\Secur32.dll (0000000078130000 - 00000000781cb000: C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\MSVCR80.dll (000000007c420000 - 000000007c4a7000: C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\MSVCP80.dll (000000007c800000 - 000000007c8f5000: C:\WINDOWS\system32\kernel32.dll (000000007c900000 - 000000007c9b0000: C:\WINDOWS\system32\ntdll.dll (000000007c9c0000 - 000000007d1d7000: C:\WINDOWS\system32\SHELL32.dll (000000007d1e0000 - 000000007d49e000: C:\WINDOWS\system32\msi.dll (000000007e290000 - 000000007e401000: C:\WINDOWS\system32\SHDOCVW.dll (000000007e410000 - 000000007e4a0000: C:\WINDOWS\system32\USER32.dll *----> State Dump for Thread Id 0x6ac <----* eax=0007fe14 ebx=00000003 ecx=00000001 edx=00000113 esi=000ecc00 edi=00000000 eip=7c90eb94 esp=0007fef0 ebp=0007ff08 iopl=0 nv up ei pl nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\ntdll.dll - function: ntdll!KiFastSystemCallRet 7c90eb89 90 nop 7c90eb8a 90 nop ntdll!KiFastSystemCall: 7c90eb8b 8bd4 mov edx,esp 7c90eb8d 0f34 sysenter 7c90eb8f 90 nop 7c90eb90 90 nop 7c90eb91 90 nop 7c90eb92 90 nop 7c90eb93 90 nop ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret 7c90eb95 8da42400000000 lea esp,[esp] 7c90eb9c 8d642400 lea esp,[esp] 7c90eba0 90 nop 7c90eba1 90 nop 7c90eba2 90 nop 7c90eba3 90 nop 7c90eba4 90 nop ntdll!KiIntSystemCall: 7c90eba5 8d542408 lea edx,[esp+0x8] 7c90eba9 cd2e int 2e *----> Stack Back Trace <----* *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\SHELL32.dll - WARNING: Stack unwind information not available. Following frames may be wrong. *** ERROR: Module load completed but symbols could not be loaded for C:\WINDOWS\Explorer.EXE *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\kernel32.dll - ChildEBP RetAddr Args to Child 0007ff08 7ca0c674 00000000 0007ff5c 010132a4 ntdll!KiFastSystemCallRet 0007ff14 010132a4 000ecc00 7ffde000 0007ffc0 SHELL32!Ordinal201+0x28 0007ff5c 0101a936 00000000 00000000 00020746 Explorer+0x132a4 0007ffc0 7c816fd7 00000010 000810a0 7ffde000 Explorer+0x1a936 0007fff0 00000000 0101a8ce 00000000 78746341 kernel32!RegisterWaitForInputIdle+0x49 *----> Raw Stack Dump <----* 000000000007fef0 18 94 41 7e c5 4a a2 7c - 9c 92 80 7c 00 cc 0e 00 ..A~.J.|...|.... 000000000007ff00 00 cc 0e 00 14 ff 07 00 - 14 ff 07 00 74 c6 a0 7c ............t..| 000000000007ff10 00 00 00 00 5c ff 07 00 - a4 32 01 01 00 cc 0e 00 ....\....2...... 000000000007ff20 00 e0 fd 7f c0 ff 07 00 - 00 00 00 00 24 fd 07 00 ............$... 000000000007ff30 50 ff 07 00 e0 ff 07 00 - 27 e0 90 7c 65 ac 80 7c P.......'..|e..| 000000000007ff40 ff ff ff ff 0c 00 00 00 - 00 00 00 00 5b ea 18 00 ............[... 000000000007ff50 d0 00 00 00 01 00 00 00 - 00 cc 0e 00 c0 ff 07 00 ................ 000000000007ff60 36 a9 01 01 00 00 00 00 - 00 00 00 00 46 07 02 00 6...........F... 000000000007ff70 01 00 00 00 10 00 00 00 - a0 10 08 00 44 00 00 00 ............D... 000000000007ff80 98 07 02 00 78 07 02 00 - 48 07 02 00 00 00 00 00 ....x...H....... 000000000007ff90 00 00 00 00 00 00 00 00 - 00 00 00 00 4e 09 91 7c ............N..| 000000000007ffa0 e8 f2 07 00 24 00 02 00 - 01 00 00 00 01 00 00 00 ....$........... 000000000007ffb0 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000007ffc0 f0 ff 07 00 d7 6f 81 7c - 10 00 00 00 a0 10 08 00 .....o.|........ 000000000007ffd0 00 e0 fd 7f ed a6 54 80 - c8 ff 07 00 f0 2a e5 85 ......T......*.. 000000000007ffe0 ff ff ff ff a8 9a 83 7c - e0 6f 81 7c 00 00 00 00 .......|.o.|.... 000000000007fff0 00 00 00 00 00 00 00 00 - ce a8 01 01 00 00 00 00 ................ 0000000000080000 41 63 74 78 20 00 00 00 - 01 00 00 00 98 24 00 00 Actx ........$.. 0000000000080010 c4 00 00 00 00 00 00 00 - 20 00 00 00 00 00 00 00 ........ ....... 0000000000080020 14 00 00 00 01 00 00 00 - 06 00 00 00 34 00 00 00 ............4... *----> State Dump for Thread Id 0xd88 <----* eax=00000001 ebx=00000000 ecx=7ffdb000 edx=000b1c54 esi=000b1c18 edi=000b1cbc eip=7c90eb94 esp=0118fe18 ebp=0118ff80 iopl=0 nv up ei pl zr na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 function: ntdll!KiFastSystemCallRet 7c90eb89 90 nop 7c90eb8a 90 nop ntdll!KiFastSystemCall: 7c90eb8b 8bd4 mov edx,esp 7c90eb8d 0f34 sysenter 7c90eb8f 90 nop 7c90eb90 90 nop 7c90eb91 90 nop 7c90eb92 90 nop 7c90eb93 90 nop ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret 7c90eb95 8da42400000000 lea esp,[esp] 7c90eb9c 8d642400 lea esp,[esp] 7c90eba0 90 nop 7c90eba1 90 nop 7c90eba2 90 nop 7c90eba3 90 nop 7c90eba4 90 nop ntdll!KiIntSystemCall: 7c90eba5 8d542408 lea edx,[esp+0x8] 7c90eba9 cd2e int 2e *----> Stack Back Trace <----* *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\RPCRT4.dll - WARNING: Stack unwind information not available. Following frames may be wrong. ChildEBP RetAddr Args to Child 0118ff80 77e76c9f 0118ffa8 77e76ac1 000b1c18 ntdll!KiFastSystemCallRet 0118ff88 77e76ac1 000b1c18 00000000 0007f88c RPCRT4!I_RpcBCacheFree+0x61c 0118ffa8 77e76c87 000b1ad0 0118ffec 7c80b683 RPCRT4!I_RpcBCacheFree+0x43e 0118ffb4 7c80b683 000c4458 00000000 0007f88c RPCRT4!I_RpcBCacheFree+0x604 0118ffec 00000000 77e76c6d 000c4458 00000000 kernel32!GetModuleFileNameA+0x1b4 *----> Raw Stack Dump <----* 000000000118fe18 99 e3 90 7c d3 65 e7 77 - b0 01 00 00 74 ff 18 01 ...|.e.w....t... 000000000118fe28 00 00 00 00 c0 f8 17 02 - 50 ff 18 01 00 00 00 00 ........P....... 000000000118fe38 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000118fe48 00 00 00 00 00 00 00 00 - 02 00 00 00 00 00 00 00 ................ 000000000118fe58 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000118fe68 00 00 00 00 1f 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000118fe78 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000118fe88 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000118fe98 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000118fea8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000118feb8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000118fec8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000118fed8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000118fee8 00 00 00 00 1f 00 00 00 - 98 e3 a8 84 40 05 84 f7 ............@... 000000000118fef8 d3 4d 54 80 ff ff ff ff - 46 02 00 00 eb 4b 54 80 .MT.....F....KT. 000000000118ff08 28 ec 66 b9 98 e3 a8 84 - 20 01 84 f7 34 e5 a8 84 (.f..... ...4... 000000000118ff18 48 2d 50 80 08 e4 a8 84 - 98 e3 a8 84 20 af 4f 80 H-P......... .O. 000000000118ff28 04 e5 a8 84 80 ff 18 01 - 86 df e7 77 48 ff 18 01 ...........wH... 000000000118ff38 96 df e7 77 ed 10 90 7c - f0 40 0c 00 58 44 0c 00 ...w...|.@..XD.. 000000000118ff48 00 a2 2f 4d ff ff ff ff - 00 5d 1e ee ff ff ff ff ../M.....]...... *----> State Dump for Thread Id 0x1e8 <----* eax=00000004 ebx=7e41b8ba ecx=002c1710 edx=7c90eb01 esi=010460f8 edi=00000000 eip=7c90eb94 esp=0120ff14 ebp=0120ff44 iopl=0 nv up ei pl zr na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 function: ntdll!KiFastSystemCallRet 7c90eb89 90 nop 7c90eb8a 90 nop ntdll!KiFastSystemCall: 7c90eb8b 8bd4 mov edx,esp 7c90eb8d 0f34 sysenter 7c90eb8f 90 nop 7c90eb90 90 nop 7c90eb91 90 nop 7c90eb92 90 nop 7c90eb93 90 nop ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret 7c90eb95 8da42400000000 lea esp,[esp] 7c90eb9c 8d642400 lea esp,[esp] 7c90eba0 90 nop 7c90eba1 90 nop 7c90eba2 90 nop 7c90eba3 90 nop 7c90eba4 90 nop ntdll!KiIntSystemCall: 7c90eba5 8d542408 lea edx,[esp+0x8] 7c90eba9 cd2e int 2e *----> Stack Back Trace <----* WARNING: Stack unwind information not available. Following frames may be wrong. *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\SHLWAPI.dll - ChildEBP RetAddr Args to Child 0120ff44 0100ff89 00000000 0120ffb4 77f76f42 ntdll!KiFastSystemCallRet 0120ff50 77f76f42 010460f8 0000005c 0007fc04 Explorer+0xff89 0120ffb4 7c80b683 00000000 0000005c 0007fc04 SHLWAPI!Ordinal505+0x3e9 0120ffec 00000000 77f76ed3 0007fdbc 00000000 kernel32!GetModuleFileNameA+0x1b4 *----> Raw Stack Dump <----* 000000000120ff14 18 94 41 7e 40 1a 00 01 - 00 00 00 00 f8 60 04 01 ..A~@........`.. 000000000120ff24 00 00 00 00 f2 00 01 00 - 13 01 00 00 07 00 00 00 ................ 000000000120ff34 00 00 00 00 87 19 20 00 - 2c 03 00 00 51 02 00 00 ...... .,...Q... 000000000120ff44 50 ff 20 01 89 ff 00 01 - 00 00 00 00 b4 ff 20 01 P. ........... . 000000000120ff54 42 6f f7 77 f8 60 04 01 - 5c 00 00 00 04 fc 07 00 Bo.w.`..\....... 000000000120ff64 bc fd 07 00 60 ff 00 01 - 3d 3d 01 01 d0 01 00 00 ....`...==...... 000000000120ff74 f8 60 04 01 08 00 00 00 - 00 00 00 00 00 00 00 00 .`.............. 000000000120ff84 00 00 00 00 00 00 00 00 - 00 00 00 00 30 98 a8 84 ............0... 000000000120ff94 42 24 50 80 00 00 00 00 - 00 00 00 00 00 00 00 00 B$P............. 000000000120ffa4 4a 24 50 80 00 00 00 00 - f2 4e 6e 80 dc e2 90 7c J$P......Nn....| 000000000120ffb4 ec ff 20 01 83 b6 80 7c - 00 00 00 00 5c 00 00 00 .. ....|....\... 000000000120ffc4 04 fc 07 00 bc fd 07 00 - 00 90 fd 7f 00 c6 fb 85 ................ 000000000120ffd4 c0 ff 20 01 10 d6 ad 84 - ff ff ff ff a8 9a 83 7c .. ............| 000000000120ffe4 90 b6 80 7c 00 00 00 00 - 00 00 00 00 00 00 00 00 ...|............ 000000000120fff4 d3 6e f7 77 bc fd 07 00 - 00 00 00 00 00 00 00 00 .n.w............ 0000000001210004 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001210014 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001210024 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001210034 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001210044 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ *----> State Dump for Thread Id 0xd40 <----* eax=7c92798d ebx=00000000 ecx=77dd6a51 edx=77dd6a18 esi=ffffffff edi=7c90fb78 eip=7c90eb94 esp=0124ff9c ebp=0124ffb4 iopl=0 nv up ei pl zr na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 function: ntdll!KiFastSystemCallRet 7c90eb89 90 nop 7c90eb8a 90 nop ntdll!KiFastSystemCall: 7c90eb8b 8bd4 mov edx,esp 7c90eb8d 0f34 sysenter 7c90eb8f 90 nop 7c90eb90 90 nop 7c90eb91 90 nop 7c90eb92 90 nop 7c90eb93 90 nop ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret 7c90eb95 8da42400000000 lea esp,[esp] 7c90eb9c 8d642400 lea esp,[esp] 7c90eba0 90 nop 7c90eba1 90 nop 7c90eba2 90 nop 7c90eba3 90 nop 7c90eba4 90 nop ntdll!KiIntSystemCall: 7c90eba5 8d542408 lea edx,[esp+0x8] 7c90eba9 cd2e int 2e *----> Stack Back Trace <----* WARNING: Stack unwind information not available. Following frames may be wrong. ChildEBP RetAddr Args to Child 0124ffb4 7c80b683 00000000 7c90fb78 ffffffff ntdll!KiFastSystemCallRet 0124ffec 00000000 7c92798d 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4 *----> Raw Stack Dump <----* 000000000124ff9c 5c d8 90 7c d4 79 92 7c - 01 00 00 00 ac ff 24 01 \..|.y.|......$. 000000000124ffac 00 00 00 00 00 00 00 80 - ec ff 24 01 83 b6 80 7c ..........$....| 000000000124ffbc 00 00 00 00 78 fb 90 7c - ff ff ff ff 00 00 00 00 ....x..|........ 000000000124ffcc 00 80 fd 7f 00 e6 fb 85 - c0 ff 24 01 48 c5 d2 84 ..........$.H... 000000000124ffdc ff ff ff ff a8 9a 83 7c - 90 b6 80 7c 00 00 00 00 .......|...|.... 000000000124ffec 00 00 00 00 00 00 00 00 - 8d 79 92 7c 00 00 00 00 .........y.|.... 000000000124fffc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000125000c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000125001c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000125002c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000125003c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000125004c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000125005c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000125006c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000125007c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000125008c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000125009c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000012500ac 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000012500bc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000012500cc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ *----> State Dump for Thread Id 0xe0c <----* eax=00000000 ebx=00000000 ecx=00106ef0 edx=021d8894 esi=7c97c380 edi=7c97c3a0 eip=7c90eb94 esp=0128ff70 ebp=0128ffb4 iopl=0 nv up ei ng nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000286 function: ntdll!KiFastSystemCallRet 7c90eb89 90 nop 7c90eb8a 90 nop ntdll!KiFastSystemCall: 7c90eb8b 8bd4 mov edx,esp 7c90eb8d 0f34 sysenter 7c90eb8f 90 nop 7c90eb90 90 nop 7c90eb91 90 nop 7c90eb92 90 nop 7c90eb93 90 nop ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret 7c90eb95 8da42400000000 lea esp,[esp] 7c90eb9c 8d642400 lea esp,[esp] 7c90eba0 90 nop 7c90eba1 90 nop 7c90eba2 90 nop 7c90eba3 90 nop 7c90eba4 90 nop ntdll!KiIntSystemCall: 7c90eba5 8d542408 lea edx,[esp+0x8] 7c90eba9 cd2e int 2e *----> Stack Back Trace <----* WARNING: Stack unwind information not available. Following frames may be wrong. ChildEBP RetAddr Args to Child 0128ffb4 7c80b683 00000000 0120fce4 0120fce8 ntdll!KiFastSystemCallRet 0128ffec 00000000 7c910760 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4 *----> Raw Stack Dump <----* 000000000128ff70 1b e3 90 7c 9d 07 91 7c - f8 01 00 00 ac ff 28 01 ...|...|......(. 000000000128ff80 b0 ff 28 01 98 ff 28 01 - a0 ff 28 01 e4 fc 20 01 ..(...(...(... . 000000000128ff90 e8 fc 20 01 00 00 00 00 - 00 00 00 00 80 a8 0f 00 .. ............. 000000000128ffa0 00 7c 28 e8 ff ff ff ff - a0 7c 2f ba 69 75 92 7c .|(......|/.iu.| 000000000128ffb0 f0 5f 10 00 ec ff 28 01 - 83 b6 80 7c 00 00 00 00 ._....(....|.... 000000000128ffc0 e4 fc 20 01 e8 fc 20 01 - 00 00 00 00 00 70 fd 7f .. ... ......p.. 000000000128ffd0 00 e6 fb 85 c0 ff 28 01 - 90 72 a9 84 ff ff ff ff ......(..r...... 000000000128ffe0 a8 9a 83 7c 90 b6 80 7c - 00 00 00 00 00 00 00 00 ...|...|........ 000000000128fff0 00 00 00 00 60 07 91 7c - 00 00 00 00 00 00 00 00 ....`..|........ 0000000001290000 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001290010 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001290020 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001290030 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001290040 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001290050 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001290060 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001290070 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001290080 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001290090 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000012900a0 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ *----> State Dump for Thread Id 0xe18 <----* eax=000000c0 ebx=00000000 ecx=0120fb00 edx=00000000 esi=00000000 edi=00000001 eip=7c90eb94 esp=012cfcec ebp=012cffb4 iopl=0 nv up ei pl zr na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 function: ntdll!KiFastSystemCallRet 7c90eb89 90 nop 7c90eb8a 90 nop ntdll!KiFastSystemCall: 7c90eb8b 8bd4 mov edx,esp 7c90eb8d 0f34 sysenter 7c90eb8f 90 nop 7c90eb90 90 nop 7c90eb91 90 nop 7c90eb92 90 nop 7c90eb93 90 nop ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret 7c90eb95 8da42400000000 lea esp,[esp] 7c90eb9c 8d642400 lea esp,[esp] 7c90eba0 90 nop 7c90eba1 90 nop 7c90eba2 90 nop 7c90eba3 90 nop 7c90eba4 90 nop ntdll!KiIntSystemCall: 7c90eba5 8d542408 lea edx,[esp+0x8] 7c90eba9 cd2e int 2e *----> Stack Back Trace <----* WARNING: Stack unwind information not available. Following frames may be wrong. ChildEBP RetAddr Args to Child 012cffb4 7c80b683 00000000 00000020 0120fce4 ntdll!KiFastSystemCallRet 012cffec 00000000 7c929fae 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4 *----> Raw Stack Dump <----* 00000000012cfcec ab e9 90 7c d5 a0 92 7c - 03 00 00 00 30 fd 2c 01 ...|...|....0.,. 00000000012cfcfc 01 00 00 00 01 00 00 00 - 00 00 00 00 20 00 00 00 ............ ... 00000000012cfd0c e4 fc 20 01 00 00 00 00 - 08 e5 97 7c 08 e5 97 7c .. ........|...| 00000000012cfd1c 00 02 00 00 18 0e 00 00 - 03 00 00 00 03 00 00 00 ................ 00000000012cfd2c 02 00 00 00 fc 01 00 00 - 3c 05 00 00 e4 01 00 00 ........<....... 00000000012cfd3c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000012cfd4c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000012cfd5c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000012cfd6c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000012cfd7c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000012cfd8c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000012cfd9c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000012cfdac 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000012cfdbc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000012cfdcc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000012cfddc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000012cfdec 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000012cfdfc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000012cfe0c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000012cfe1c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ *----> State Dump for Thread Id 0x1f8 <----* eax=0015c9f0 ebx=021b1868 ecx=049e0001 edx=049e0002 esi=00000000 edi=7ffde000 eip=7c90eb94 esp=0132fd30 ebp=0132fdcc iopl=0 nv up ei pl zr na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 function: ntdll!KiFastSystemCallRet 7c90eb89 90 nop 7c90eb8a 90 nop ntdll!KiFastSystemCall: 7c90eb8b 8bd4 mov edx,esp 7c90eb8d 0f34 sysenter 7c90eb8f 90 nop 7c90eb90 90 nop 7c90eb91 90 nop 7c90eb92 90 nop 7c90eb93 90 nop ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret 7c90eb95 8da42400000000 lea esp,[esp] 7c90eb9c 8d642400 lea esp,[esp] 7c90eba0 90 nop 7c90eba1 90 nop 7c90eba2 90 nop 7c90eba3 90 nop 7c90eba4 90 nop ntdll!KiIntSystemCall: 7c90eba5 8d542408 lea edx,[esp+0x8] 7c90eba9 cd2e int 2e *----> Stack Back Trace <----* *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\USER32.dll - WARNING: Stack unwind information not available. Following frames may be wrong. ChildEBP RetAddr Args to Child 0132fdcc 7e4195f9 0000000a 021b1b58 00000000 ntdll!KiFastSystemCallRet 0132fe28 7c9f51b4 00000009 0132fe50 ffffffff USER32!GetLastInputInfo+0x105 0132ff4c 7ca0ab7c 77f76f42 00000000 7c80995a SHELL32!Ordinal646+0x2327 0132ffb4 7c80b683 00000000 7c80995a 00090000 SHELL32!Ordinal753+0x133 0132ffec 00000000 77f76ed3 0120f4d4 00000000 kernel32!GetModuleFileNameA+0x1b4 *----> Raw Stack Dump <----* 000000000132fd30 ab e9 90 7c e2 94 80 7c - 0a 00 00 00 68 18 1b 02 ...|...|....h... 000000000132fd40 01 00 00 00 01 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000000132fd50 0a 00 00 00 02 00 00 00 - 00 00 00 00 58 1b 1b 02 ............X... 000000000132fd60 b0 62 59 00 01 04 00 00 - 30 00 00 00 1c b5 00 7e .bY.....0......~ 000000000132fd70 00 00 09 00 6c fb 32 01 - 14 00 00 00 01 00 00 00 ....l.2......... 000000000132fd80 80 3c 0d 00 00 00 00 00 - 00 00 00 00 eb 06 91 7c .<.............| 000000000132fd90 df 99 80 7c 00 00 09 00 - 00 e0 fd 7f 00 50 fd 7f ...|.........P.. 000000000132fda0 00 50 fd 7f 00 00 00 00 - 68 18 1b 02 a8 93 41 7e .P......h.....A~ 000000000132fdb0 0a 00 00 00 4c fd 32 01 - 00 00 00 00 dc ff 32 01 ....L.2.......2. 000000000132fdc0 a8 9a 83 7c d8 95 80 7c - 00 00 00 00 28 fe 32 01 ...|...|....(.2. 000000000132fdd0 f9 95 41 7e 0a 00 00 00 - 58 1b 1b 02 00 00 00 00 ..A~....X....... 000000000132fde0 ff ff ff ff 01 00 00 00 - 90 e3 0c 00 09 00 00 00 ................ 000000000132fdf0 00 00 00 00 9b 92 41 7e - 00 00 00 00 3c fe 32 01 ......A~....<.2. 000000000132fe00 bd 52 9f 7c 20 fe 32 01 - 00 00 00 00 00 00 00 00 .R.| .2......... 000000000132fe10 00 00 00 00 e9 56 00 00 - 00 00 00 00 01 00 00 00 .....V.......... 000000000132fe20 00 50 fd 7f 24 02 00 00 - 4c ff 32 01 b4 51 9f 7c .P..$...L.2..Q.| 000000000132fe30 09 00 00 00 50 fe 32 01 - ff ff ff ff ff 04 00 00 ....P.2......... 000000000132fe40 58 1b 1b 02 00 00 00 00 - 00 00 00 00 00 00 00 00 X............... 000000000132fe50 d8 06 00 00 38 03 00 00 - ec 06 00 00 cc 01 00 00 ....8........... 000000000132fe60 44 05 00 00 98 04 00 00 - 44 02 00 00 50 02 00 00 D.......D...P... *----> State Dump for Thread Id 0x64c <----* eax=00000230 ebx=00000000 ecx=00000000 edx=7c97c080 esi=000b1c18 edi=000b1cbc eip=7c90eb94 esp=0160fe18 ebp=0160ff80 iopl=0 nv up ei pl zr na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 function: ntdll!KiFastSystemCallRet 7c90eb89 90 nop 7c90eb8a 90 nop ntdll!KiFastSystemCall: 7c90eb8b 8bd4 mov edx,esp 7c90eb8d 0f34 sysenter 7c90eb8f 90 nop 7c90eb90 90 nop 7c90eb91 90 nop 7c90eb92 90 nop 7c90eb93 90 nop ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret 7c90eb95 8da42400000000 lea esp,[esp] 7c90eb9c 8d642400 lea esp,[esp] 7c90eba0 90 nop 7c90eba1 90 nop 7c90eba2 90 nop 7c90eba3 90 nop 7c90eba4 90 nop ntdll!KiIntSystemCall: 7c90eba5 8d542408 lea edx,[esp+0x8] 7c90eba9 cd2e int 2e *----> Stack Back Trace <----* WARNING: Stack unwind information not available. Following frames may be wrong. ChildEBP RetAddr Args to Child 0160ff80 77e76c9f 0160ffa8 77e76ac1 000b1c18 ntdll!KiFastSystemCallRet 0160ff88 77e76ac1 000b1c18 00000000 00000000 RPCRT4!I_RpcBCacheFree+0x61c 0160ffa8 77e76c87 000b1ad0 0160ffec 7c80b683 RPCRT4!I_RpcBCacheFree+0x43e 0160ffb4 7c80b683 001784f8 00000000 00000000 RPCRT4!I_RpcBCacheFree+0x604 0160ffec 00000000 77e76c6d 001784f8 00000000 kernel32!GetModuleFileNameA+0x1b4 *----> Raw Stack Dump <----* 000000000160fe18 99 e3 90 7c d3 65 e7 77 - b0 01 00 00 74 ff 60 01 ...|.e.w....t.`. 000000000160fe28 00 00 00 00 80 c8 17 02 - 50 ff 60 01 00 9e 90 e2 ........P.`..... 000000000160fe38 58 a5 fb 85 38 3b d3 ba - 00 3b d3 ba 00 00 00 00 X...8;...;...... 000000000160fe48 4d 4a 53 80 8c 3b d3 ba - 02 3c 56 80 00 00 54 80 MJS..;... State Dump for Thread Id 0x34c <----* eax=00000000 ebx=00004e20 ecx=0000000a edx=00000000 esi=0174fd68 edi=7e4191c6 eip=7c90eb94 esp=0174fcf8 ebp=0174fd14 iopl=0 nv up ei pl zr na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 function: ntdll!KiFastSystemCallRet 7c90eb89 90 nop 7c90eb8a 90 nop ntdll!KiFastSystemCall: 7c90eb8b 8bd4 mov edx,esp 7c90eb8d 0f34 sysenter 7c90eb8f 90 nop 7c90eb90 90 nop 7c90eb91 90 nop 7c90eb92 90 nop 7c90eb93 90 nop ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret 7c90eb95 8da42400000000 lea esp,[esp] 7c90eb9c 8d642400 lea esp,[esp] 7c90eba0 90 nop 7c90eba1 90 nop 7c90eba2 90 nop 7c90eba3 90 nop 7c90eba4 90 nop ntdll!KiIntSystemCall: 7c90eba5 8d542408 lea edx,[esp+0x8] 7c90eba9 cd2e int 2e *----> Stack Back Trace <----* *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\stobject.dll - WARNING: Stack unwind information not available. Following frames may be wrong. ChildEBP RetAddr Args to Child 0174fd14 76281513 0174fd68 00000000 00000000 ntdll!KiFastSystemCallRet 0174fd8c 76283746 76280000 00000000 0001017c stobject+0x1513 0174ffb4 7c80b683 00000000 00000000 00000000 stobject!DllCanUnloadNow+0x1fa4 0174ffec 00000000 762836f7 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4 *----> Raw Stack Dump <----* 000000000174fcf8 be 91 41 7e f1 91 41 7e - 68 fd 74 01 00 00 00 00 ..A~..A~h.t..... 000000000174fd08 00 00 00 00 00 00 00 00 - 00 00 00 00 8c fd 74 01 ..............t. 000000000174fd18 13 15 28 76 68 fd 74 01 - 00 00 00 00 00 00 00 00 ..(vh.t......... 000000000174fd28 00 00 00 00 00 00 00 00 - 00 00 28 76 00 00 00 00 ..........(v.... 000000000174fd38 30 00 00 00 00 40 00 00 - 21 13 28 76 00 00 00 00 0....@..!.(v.... 000000000174fd48 1e 00 00 00 00 00 28 76 - d1 01 01 00 11 00 01 00 ......(v........ 000000000174fd58 10 00 00 00 00 00 00 00 - f4 31 28 76 00 00 00 00 .........1(v.... 000000000174fd68 92 01 01 00 05 04 00 00 - 00 00 00 00 eb 03 02 00 ................ 000000000174fd78 ed 15 20 00 2b 03 00 00 - 60 02 00 00 00 00 00 00 .. .+...`....... 000000000174fd88 00 00 00 00 b4 ff 74 01 - 46 37 28 76 00 00 28 76 ......t.F7(v..(v 000000000174fd98 00 00 00 00 7c 01 01 00 - 01 00 00 00 00 00 00 00 ....|........... 000000000174fda8 43 00 3a 00 5c 00 57 00 - 49 00 4e 00 44 00 4f 00 C.:.\.W.I.N.D.O. 000000000174fdb8 57 00 53 00 5c 00 73 00 - 79 00 73 00 74 00 65 00 W.S.\.s.y.s.t.e. 000000000174fdc8 6d 00 33 00 32 00 5c 00 - 73 00 74 00 6f 00 62 00 m.3.2.\.s.t.o.b. 000000000174fdd8 6a 00 65 00 63 00 74 00 - 2e 00 64 00 6c 00 6c 00 j.e.c.t...d.l.l. 000000000174fde8 00 00 81 7c 1b 00 00 00 - 00 02 00 00 fc ff 74 01 ...|..........t. 000000000174fdf8 23 00 00 00 f0 ba cf ba - 00 e0 69 01 00 f0 69 01 #.........i...i. 000000000174fe08 d8 09 00 00 88 bb cf ba - 14 bb cf ba 14 bb cf ba ................ 000000000174fe18 f8 a0 5b 80 c0 0e 00 e1 - 00 00 00 00 ff ff ff 03 ..[............. 000000000174fe28 70 25 7a 81 01 00 00 00 - 05 3f 01 00 c4 b4 00 00 p%z......?...... *----> State Dump for Thread Id 0x354 <----* eax=00000001 ebx=003ab3a0 ecx=023bfdd0 edx=7c90eb94 esi=023bfe14 edi=164be000 eip=7c90eb94 esp=023bfdd0 ebp=023bfdec iopl=0 nv up ei pl zr na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 function: ntdll!KiFastSystemCallRet 7c90eb89 90 nop 7c90eb8a 90 nop ntdll!KiFastSystemCall: 7c90eb8b 8bd4 mov edx,esp 7c90eb8d 0f34 sysenter 7c90eb8f 90 nop 7c90eb90 90 nop 7c90eb91 90 nop 7c90eb92 90 nop 7c90eb93 90 nop ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret 7c90eb95 8da42400000000 lea esp,[esp] 7c90eb9c 8d642400 lea esp,[esp] 7c90eba0 90 nop 7c90eba1 90 nop 7c90eba2 90 nop 7c90eba3 90 nop 7c90eba4 90 nop ntdll!KiIntSystemCall: 7c90eba5 8d542408 lea edx,[esp+0x8] 7c90eba9 cd2e int 2e *----> Stack Back Trace <----* *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\WPDShServiceObj.dll - WARNING: Stack unwind information not available. Following frames may be wrong. ChildEBP RetAddr Args to Child 023bfdec 164aa888 023bfe14 00000000 00000000 ntdll!KiFastSystemCallRet 023bff50 77f76f42 003ab3a0 0120f314 7c90ee18 WPDShServiceObj+0xa888 023bffb4 7c80b683 00000000 0120f314 7c90ee18 SHLWAPI!Ordinal505+0x3e9 023bffec 00000000 77f76ed3 0120f3f8 00000000 kernel32!GetModuleFileNameA+0x1b4 *----> Raw Stack Dump <----* 00000000023bfdd0 be 91 41 7e f1 91 41 7e - 14 fe 3b 02 00 00 00 00 ..A~..A~..;..... 00000000023bfde0 00 00 00 00 00 00 00 00 - d4 19 4a 16 50 ff 3b 02 ..........J.P.;. 00000000023bfdf0 88 a8 4a 16 14 fe 3b 02 - 00 00 00 00 00 00 00 00 ..J...;......... 00000000023bfe00 00 00 00 00 fe b5 3b 02 - 00 00 00 00 00 00 00 00 ......;......... 00000000023bfe10 00 00 00 00 96 01 01 00 - 13 01 00 00 0d 00 00 00 ................ 00000000023bfe20 00 00 00 00 97 19 20 00 - 2c 03 00 00 51 02 00 00 ...... .,...Q... 00000000023bfe30 01 00 00 00 a0 b3 3a 00 - a5 83 4a 16 b2 83 4a 16 ......:...J...J. 00000000023bfe40 e7 ff ff 85 c0 89 85 e0 - fe ff ff 7c 0b 47 3b bd ...........|.G;. 00000000023bfe50 dc fe ff ff 72 e3 eb 2a - a1 00 e0 4b 16 3d 00 e0 ....r..*...K.=.. 00000000023bfe60 4b 16 74 23 f6 40 1c 02 - 74 1d ff b5 3b 00 00 00 K.t#.@..t...;... 00000000023bfe70 68 d4 19 4a 16 6a 3e ff - 70 14 ff 70 10 e8 28 a3 h..J.j>.p..p..(. 00000000023bfe80 44 f3 4f 77 c0 68 60 77 - 17 00 00 00 16 00 00 00 D.Ow.h`w........ 00000000023bfe90 17 00 00 00 b4 fe 3b 02 - c3 f4 4f 77 c4 28 0a 00 ......;...Ow.(.. 00000000023bfea0 17 00 00 00 01 00 00 00 - bc d6 4f 77 b4 2b 0f 00 ..........Ow.+.. 00000000023bfeb0 c4 fe 3b 02 dc d7 4f 77 - e8 03 00 00 0a d2 4f 77 ..;...Ow......Ow 00000000023bfec0 60 68 60 77 d7 d1 4f 77 - 68 68 60 77 e1 f5 4f 77 `h`w..Owhh`w..Ow 00000000023bfed0 04 fa 17 00 50 ff 3b 02 - 18 fa 17 00 a5 d8 4f 77 ....P.;.......Ow 00000000023bfee0 9c 28 0a 00 04 fa 17 00 - 50 ff 3b 02 ad f1 4f 77 .(......P.;...Ow 00000000023bfef0 66 97 80 7c 50 ff 3b 02 - 3c 68 60 77 00 00 00 00 f..|P.;. State Dump for Thread Id 0x358 <----* eax=7ffa8000 ebx=023ffd0c ecx=00000358 edx=00001901 esi=00000000 edi=7ffde000 eip=7c90eb94 esp=023ffce4 ebp=023ffd80 iopl=0 nv up ei pl zr na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 function: ntdll!KiFastSystemCallRet 7c90eb89 90 nop 7c90eb8a 90 nop ntdll!KiFastSystemCall: 7c90eb8b 8bd4 mov edx,esp 7c90eb8d 0f34 sysenter 7c90eb8f 90 nop 7c90eb90 90 nop 7c90eb91 90 nop 7c90eb92 90 nop 7c90eb93 90 nop ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret 7c90eb95 8da42400000000 lea esp,[esp] 7c90eb9c 8d642400 lea esp,[esp] 7c90eba0 90 nop 7c90eba1 90 nop 7c90eba2 90 nop 7c90eba3 90 nop 7c90eba4 90 nop ntdll!KiIntSystemCall: 7c90eba5 8d542408 lea edx,[esp+0x8] 7c90eba9 cd2e int 2e *----> Stack Back Trace <----* WARNING: Stack unwind information not available. Following frames may be wrong. ChildEBP RetAddr Args to Child 023ffd80 7e4195f9 00000002 023ffda8 00000000 ntdll!KiFastSystemCallRet 023ffddc 164a9bea 00000001 023ffe2c ffffffff USER32!GetLastInputInfo+0x105 023fff50 77f76f42 003ab3a0 0120f314 7c90ee18 WPDShServiceObj+0x9bea 023fffb4 7c80b683 00000000 0120f314 7c90ee18 SHLWAPI!Ordinal505+0x3e9 023fffec 00000000 77f76ed3 0120f3f8 00000000 kernel32!GetModuleFileNameA+0x1b4 *----> Raw Stack Dump <----* 00000000023ffce4 ab e9 90 7c e2 94 80 7c - 02 00 00 00 0c fd 3f 02 ...|...|......?. 00000000023ffcf4 01 00 00 00 01 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000023ffd04 02 00 00 00 02 00 00 00 - 00 05 00 00 5c 03 00 00 ............\... 00000000023ffd14 18 6a dd 77 51 6a dd 77 - a8 31 4a 16 01 00 00 80 .j.wQj.w.1J..... 00000000023ffd24 84 00 00 00 18 00 00 00 - 14 00 00 00 01 00 00 00 ................ 00000000023ffd34 38 66 17 02 00 00 00 00 - 00 00 00 00 56 00 56 00 8f..........V.V. 00000000023ffd44 a8 31 4a 16 00 00 00 00 - 00 e0 fd 7f 00 80 fa 7f .1J............. 00000000023ffd54 2e 7e 00 00 00 00 00 00 - 0c fd 3f 02 98 fd 3f 02 .~........?...?. 00000000023ffd64 02 00 00 00 00 fd 3f 02 - 8c fd 3f 02 44 ff 3f 02 ......?...?.D.?. 00000000023ffd74 a8 9a 83 7c d8 95 80 7c - 00 00 00 00 dc fd 3f 02 ...|...|......?. 00000000023ffd84 f9 95 41 7e 02 00 00 00 - a8 fd 3f 02 00 00 00 00 ..A~......?..... 00000000023ffd94 ff ff ff ff 01 00 00 00 - 00 00 00 00 9b 92 41 7e ..............A~ 00000000023ffda4 01 00 00 00 00 05 00 00 - 5c 03 00 00 63 ae 4b 16 ........\...c.K. 00000000023ffdb4 00 00 00 00 00 00 00 00 - 00 00 00 00 20 b4 3a 00 ............ .:. 00000000023ffdc4 04 00 00 00 01 00 00 00 - 00 00 00 00 01 00 00 00 ................ 00000000023ffdd4 00 80 fa 7f 5c 03 00 00 - 50 ff 3f 02 ea 9b 4a 16 ....\...P.?...J. 00000000023ffde4 01 00 00 00 2c fe 3f 02 - ff ff ff ff 00 01 00 00 ....,.?......... 00000000023ffdf4 a8 fd 3f 02 fe b5 3f 02 - 00 00 00 00 00 00 00 00 ..?...?......... 00000000023ffe04 00 00 00 00 58 98 5c 00 - f0 46 17 02 18 bb cf ba ....X.\..F...... 00000000023ffe14 01 00 00 00 00 8d 53 80 - c0 01 09 00 40 00 00 00 ......S.....@... *----> State Dump for Thread Id 0xfd0 <----* eax=00000000 ebx=00d8fef8 ecx=0014caf8 edx=14950003 esi=00000000 edi=7ffde000 eip=7c90eb94 esp=00d8fed0 ebp=00d8ff6c iopl=0 nv up ei pl zr na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 function: ntdll!KiFastSystemCallRet 7c90eb89 90 nop 7c90eb8a 90 nop ntdll!KiFastSystemCall: 7c90eb8b 8bd4 mov edx,esp 7c90eb8d 0f34 sysenter 7c90eb8f 90 nop 7c90eb90 90 nop 7c90eb91 90 nop 7c90eb92 90 nop 7c90eb93 90 nop ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret 7c90eb95 8da42400000000 lea esp,[esp] 7c90eb9c 8d642400 lea esp,[esp] 7c90eba0 90 nop 7c90eba1 90 nop 7c90eba2 90 nop 7c90eba3 90 nop 7c90eba4 90 nop ntdll!KiIntSystemCall: 7c90eba5 8d542408 lea edx,[esp+0x8] 7c90eba9 cd2e int 2e *----> Stack Back Trace <----* WARNING: Stack unwind information not available. Following frames may be wrong. *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\fxsst.dll - ChildEBP RetAddr Args to Child 00d8ff6c 7c80a075 00000002 00d8ffac 00000000 ntdll!KiFastSystemCallRet 00d8ff88 68df1cc7 00000002 00d8ffac 00000000 kernel32!WaitForMultipleObjects+0x18 00d8ffb4 7c80b683 000301ee 00000018 00000000 fxsst!IsFaxMessage+0x352 00d8ffec 00000000 68df1c5d 000301ee 00000000 kernel32!GetModuleFileNameA+0x1b4 *----> Raw Stack Dump <----* 0000000000d8fed0 ab e9 90 7c e2 94 80 7c - 02 00 00 00 f8 fe d8 00 ...|...|........ 0000000000d8fee0 01 00 00 00 00 00 00 00 - 00 00 00 00 b4 ff d8 00 ................ 0000000000d8fef0 5d a0 80 7c 00 00 00 00 - cc 05 00 00 d4 05 00 00 ]..|............ 0000000000d8ff00 b4 5e 01 00 0c 00 00 00 - 64 fe d8 00 00 00 09 00 .^......d....... 0000000000d8ff10 58 ff d8 00 18 ee 90 7c - 14 00 00 00 01 00 00 00 X......|........ 0000000000d8ff20 a0 fb 19 02 00 00 00 00 - 00 00 00 00 88 fe d8 00 ................ 0000000000d8ff30 6d 99 80 7c dc ff d8 00 - 00 e0 fd 7f 00 d0 fa 7f m..|............ 0000000000d8ff40 ff ff ff ff 00 00 00 00 - f8 fe d8 00 00 00 09 00 ................ 0000000000d8ff50 02 00 00 00 ec fe d8 00 - 68 ff d8 00 dc ff d8 00 ........h....... 0000000000d8ff60 a8 9a 83 7c d8 95 80 7c - 00 00 00 00 88 ff d8 00 ...|...|........ 0000000000d8ff70 75 a0 80 7c 02 00 00 00 - ac ff d8 00 00 00 00 00 u..|............ 0000000000d8ff80 ff ff ff ff 00 00 00 00 - b4 ff d8 00 c7 1c df 68 ...............h 0000000000d8ff90 02 00 00 00 ac ff d8 00 - 00 00 00 00 ff ff ff ff ................ 0000000000d8ffa0 00 00 00 00 18 00 00 00 - ee 01 03 00 cc 05 00 00 ................ 0000000000d8ffb0 d4 05 00 00 ec ff d8 00 - 83 b6 80 7c ee 01 03 00 ...........|.... 0000000000d8ffc0 18 00 00 00 00 00 00 00 - ee 01 03 00 00 d0 fa 7f ................ 0000000000d8ffd0 00 e6 fb 85 c0 ff d8 00 - 40 f5 d3 84 ff ff ff ff ........@....... 0000000000d8ffe0 a8 9a 83 7c 90 b6 80 7c - 00 00 00 00 00 00 00 00 ...|...|........ 0000000000d8fff0 00 00 00 00 5d 1c df 68 - ee 01 03 00 00 00 00 00 ....]..h........ 0000000000d90000 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ *----> State Dump for Thread Id 0xf00 <----* eax=77c3a341 ebx=0142fec8 ecx=7c910f46 edx=0113dc00 esi=00000000 edi=7ffde000 eip=7c90eb94 esp=0142fea0 ebp=0142ff3c iopl=0 nv up ei pl zr na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 function: ntdll!KiFastSystemCallRet 7c90eb89 90 nop 7c90eb8a 90 nop ntdll!KiFastSystemCall: 7c90eb8b 8bd4 mov edx,esp 7c90eb8d 0f34 sysenter 7c90eb8f 90 nop 7c90eb90 90 nop 7c90eb91 90 nop 7c90eb92 90 nop 7c90eb93 90 nop ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret 7c90eb95 8da42400000000 lea esp,[esp] 7c90eb9c 8d642400 lea esp,[esp] 7c90eba0 90 nop 7c90eba1 90 nop 7c90eba2 90 nop 7c90eba3 90 nop 7c90eba4 90 nop ntdll!KiIntSystemCall: 7c90eba5 8d542408 lea edx,[esp+0x8] 7c90eba9 cd2e int 2e *----> Stack Back Trace <----* WARNING: Stack unwind information not available. Following frames may be wrong. *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\McAfee\VirusScan\scriptsn.dll - *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\msvcrt.dll - ChildEBP RetAddr Args to Child 0142ff3c 7c80a075 00000002 003aea00 00000000 ntdll!KiFastSystemCallRet 0142ff58 144925b8 00000002 003aea00 00000000 kernel32!WaitForMultipleObjects+0x18 0142ff80 77c3a3b0 003ae9f8 7c90ee18 7c90fb78 scriptsn+0x25b8 0142ffb4 7c80b683 003ad8a8 7c90ee18 7c90fb78 msvcrt!endthreadex+0xa9 0142ffec 00000000 77c3a341 003ad8a8 00000000 kernel32!GetModuleFileNameA+0x1b4 *----> Raw Stack Dump <----* 000000000142fea0 ab e9 90 7c e2 94 80 7c - 02 00 00 00 c8 fe 42 01 ...|...|......B. 000000000142feb0 01 00 00 00 00 00 00 00 - 00 00 00 00 f8 e9 3a 00 ..............:. 000000000142fec0 00 ea 3a 00 66 d9 dd 77 - 64 06 00 00 68 06 00 00 ..:.f..wd...h... 000000000142fed0 80 19 fc 85 b4 03 00 00 - 90 00 00 00 5a c4 5b 80 ............Z.[. 000000000142fee0 08 40 48 e3 ec 2b b4 b8 - 14 00 00 00 01 00 00 00 .@H..+.......... 000000000142fef0 00 00 00 00 00 00 00 00 - 10 00 00 00 ff ff ff ff ................ 000000000142ff00 00 00 3a 00 eb 4b 54 80 - 00 e0 fd 7f 00 e0 fa 7f ..:..KT......... 000000000142ff10 20 01 84 f7 00 00 00 00 - c8 fe 42 01 a0 dc 90 7c .........B....| 000000000142ff20 02 00 00 00 bc fe 42 01 - 64 06 00 00 a4 ff 42 01 ......B.d.....B. 000000000142ff30 a8 9a 83 7c d8 95 80 7c - 00 00 00 00 58 ff 42 01 ...|...|....X.B. 000000000142ff40 75 a0 80 7c 02 00 00 00 - 00 ea 3a 00 00 00 00 00 u..|......:..... 000000000142ff50 ff ff ff ff 00 00 00 00 - 80 ff 42 01 b8 25 49 14 ..........B..%I. 000000000142ff60 02 00 00 00 00 ea 3a 00 - 00 00 00 00 ff ff ff ff ......:......... 000000000142ff70 18 ee 90 7c 18 d8 3a 00 - a8 d8 3a 00 ee 25 49 14 ...|..:...:..%I. 000000000142ff80 b4 ff 42 01 b0 a3 c3 77 - f8 e9 3a 00 18 ee 90 7c ..B....w..:....| 000000000142ff90 78 fb 90 7c a8 d8 3a 00 - 00 00 00 00 8c ff 42 01 x..|..:.......B. 000000000142ffa0 00 00 00 00 dc ff 42 01 - 94 5c c3 77 d8 40 c1 77 ......B..\.w.@.w 000000000142ffb0 00 00 00 00 ec ff 42 01 - 83 b6 80 7c a8 d8 3a 00 ......B....|..:. 000000000142ffc0 18 ee 90 7c 78 fb 90 7c - a8 d8 3a 00 00 e0 fa 7f ...|x..|..:..... 000000000142ffd0 00 e6 fb 85 c0 ff 42 01 - 00 08 ab 84 ff ff ff ff ......B......... *----> State Dump for Thread Id 0x9dc <----* eax=00000102 ebx=00000000 ecx=7c809512 edx=7c90eb94 esi=0284ade0 edi=0113e650 eip=029c695b esp=02a6fedc ebp=02a6fefc iopl=0 nv up ei pl zr na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 function: No prior disassembly possible 029c695b ?? ??? 029c695d ?? ??? 029c695f ?? ??? 029c6961 ?? ??? 029c6963 ?? ??? 029c6965 ?? ??? 029c6967 ?? ??? 029c6969 ?? ??? 029c696b ?? ??? FAULT ->029c695b ?? ??? Error 0x00000001 029c695d ?? ??? 029c695f ?? ??? 029c6961 ?? ??? 029c6963 ?? ??? 029c6965 ?? ??? 029c6967 ?? ??? 029c6969 ?? ??? 029c696b ?? ??? 029c696d ?? ??? 029c696f ?? ??? *----> Stack Back Trace <----* ChildEBP RetAddr Args to Child 02a6fed8 00000804 029e1920 00156c50 000007fc 0x29c695b *----> Raw Stack Dump <----* 0000000002a6fedc 04 08 00 00 20 19 9e 02 - 50 6c 15 00 fc 07 00 00 .... ...Pl...... 0000000002a6feec 0f 69 9c 00 74 ff a6 02 - 5a 04 9d 02 00 00 00 00 .i..t...Z....... 0000000002a6fefc 80 ff a6 02 f8 0f 15 7c - 18 aa 84 02 00 00 00 00 .......|........ 0000000002a6ff0c c8 ae 84 02 30 ae 84 02 - 46 02 00 00 34 47 16 7c ....0...F...4G.| 0000000002a6ff1c 01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000002a6ff2c 01 00 00 00 00 00 00 00 - 08 c0 1d 02 00 00 00 00 ................ 0000000002a6ff3c 00 21 34 7c 00 00 00 00 - 00 00 00 00 9c 2b 17 7c .!4|.........+.| 0000000002a6ff4c 3c 2c 17 7c 00 00 00 00 - 00 00 00 00 00 00 00 00 <,.|............ 0000000002a6ff5c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000002a6ff6c e0 ad 84 02 08 ff a6 02 - a4 ff a6 02 6c b2 20 7c ............l. | 0000000002a6ff7c 00 00 00 00 b4 ff a6 02 - 65 95 34 7c 50 e6 13 01 ........e.4|P... 0000000002a6ff8c 00 00 00 00 07 00 00 00 - 30 ae 84 02 00 00 00 00 ........0....... 0000000002a6ff9c 8c ff a6 02 00 00 00 00 - dc ff a6 02 0d 24 34 7c .............$4| 0000000002a6ffac 08 f5 37 7c 00 00 00 00 - ec ff a6 02 83 b6 80 7c ..7|...........| 0000000002a6ffbc 30 ae 84 02 00 00 00 00 - 07 00 00 00 30 ae 84 02 0...........0... 0000000002a6ffcc 00 70 fa 7f 00 c6 fb 85 - c0 ff a6 02 e8 d2 b2 85 .p.............. 0000000002a6ffdc ff ff ff ff a8 9a 83 7c - 90 b6 80 7c 00 00 00 00 .......|...|.... 0000000002a6ffec 00 00 00 00 00 00 00 00 - f6 94 34 7c 30 ae 84 02 ..........4|0... 0000000002a6fffc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000002a7000c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ *----> State Dump for Thread Id 0xae8 <----* eax=0113feb0 ebx=00000000 ecx=7ffdc000 edx=7c97c0d8 esi=7c97c380 edi=7c97c3a0 eip=7c90eb94 esp=0113ff70 ebp=0113ffb4 iopl=0 nv up ei ng nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000286 function: ntdll!KiFastSystemCallRet 7c90eb89 90 nop 7c90eb8a 90 nop ntdll!KiFastSystemCall: 7c90eb8b 8bd4 mov edx,esp 7c90eb8d 0f34 sysenter 7c90eb8f 90 nop 7c90eb90 90 nop 7c90eb91 90 nop 7c90eb92 90 nop 7c90eb93 90 nop ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret 7c90eb95 8da42400000000 lea esp,[esp] 7c90eb9c 8d642400 lea esp,[esp] 7c90eba0 90 nop 7c90eba1 90 nop 7c90eba2 90 nop 7c90eba3 90 nop 7c90eba4 90 nop ntdll!KiIntSystemCall: 7c90eba5 8d542408 lea edx,[esp+0x8] 7c90eba9 cd2e int 2e *----> Stack Back Trace <----* WARNING: Stack unwind information not available. Following frames may be wrong. ChildEBP RetAddr Args to Child 0113ffb4 7c80b683 00000000 0120f62c 0120f62c ntdll!KiFastSystemCallRet 0113ffec 00000000 7c910760 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4 *----> Raw Stack Dump <----* 000000000113ff70 1b e3 90 7c 9d 07 91 7c - f8 01 00 00 ac ff 13 01 ...|...|........ 000000000113ff80 b0 ff 13 01 98 ff 13 01 - a0 ff 13 01 2c f6 20 01 ............,. . 000000000113ff90 2c f6 20 01 00 00 00 00 - 00 00 00 00 80 a8 0f 00 ,. ............. 000000000113ffa0 00 7c 28 e8 ff ff ff ff - a0 cc cd b9 69 75 92 7c .|(.........iu.| 000000000113ffb0 d0 4b 18 00 ec ff 13 01 - 83 b6 80 7c 00 00 00 00 .K.........|.... 000000000113ffc0 2c f6 20 01 2c f6 20 01 - 00 00 00 00 00 c0 fd 7f ,. .,. ......... 000000000113ffd0 00 e6 fb 85 c0 ff 13 01 - 10 b2 87 84 ff ff ff ff ................ 000000000113ffe0 a8 9a 83 7c 90 b6 80 7c - 00 00 00 00 00 00 00 00 ...|...|........ 000000000113fff0 00 00 00 00 60 07 91 7c - 00 00 00 00 00 00 00 00 ....`..|........ 0000000001140000 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001140010 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001140020 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001140030 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001140040 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001140050 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001140060 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001140070 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001140080 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 0000000001140090 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000011400a0 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ *----> State Dump for Thread Id 0xaec <----* eax=000016ce ebx=00000000 ecx=011cf45c edx=011cf9c8 esi=7c97c380 edi=7c97c3a0 eip=7c90eb94 esp=011cff70 ebp=011cffb4 iopl=0 nv up ei ng nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000286 function: ntdll!KiFastSystemCallRet 7c90eb89 90 nop 7c90eb8a 90 nop ntdll!KiFastSystemCall: 7c90eb8b 8bd4 mov edx,esp 7c90eb8d 0f34 sysenter 7c90eb8f 90 nop 7c90eb90 90 nop 7c90eb91 90 nop 7c90eb92 90 nop 7c90eb93 90 nop ntdll!KiFastSystemCallRet: 7c90eb94 c3 ret 7c90eb95 8da42400000000 lea esp,[esp] 7c90eb9c 8d642400 lea esp,[esp] 7c90eba0 90 nop 7c90eba1 90 nop 7c90eba2 90 nop 7c90eba3 90 nop 7c90eba4 90 nop ntdll!KiIntSystemCall: 7c90eba5 8d542408 lea edx,[esp+0x8] 7c90eba9 cd2e int 2e *----> Stack Back Trace <----* WARNING: Stack unwind information not available. Following frames may be wrong. ChildEBP RetAddr Args to Child 011cffb4 7c80b683 00000000 14491a2a 003a0043 ntdll!KiFastSystemCallRet 011cffec 00000000 7c910760 00000000 00000000 kernel32!GetModuleFileNameA+0x1b4 *----> Raw Stack Dump <----* 00000000011cff70 1b e3 90 7c 9d 07 91 7c - f8 01 00 00 ac ff 1c 01 ...|...|........ 00000000011cff80 b0 ff 1c 01 98 ff 1c 01 - a0 ff 1c 01 2a 1a 49 14 ............*.I. 00000000011cff90 43 00 3a 00 00 00 00 00 - 00 00 00 00 80 a8 0f 00 C.:............. 00000000011cffa0 00 7c 28 e8 ff ff ff ff - a0 cc cd b9 69 75 92 7c .|(.........iu.| 00000000011cffb0 78 23 16 00 ec ff 1c 01 - 83 b6 80 7c 00 00 00 00 x#.........|.... 00000000011cffc0 2a 1a 49 14 43 00 3a 00 - 00 00 00 00 00 a0 fd 7f *.I.C.:......... 00000000011cffd0 00 c6 fb 85 c0 ff 1c 01 - 10 b2 87 84 ff ff ff ff ................ 00000000011cffe0 a8 9a 83 7c 90 b6 80 7c - 00 00 00 00 00 00 00 00 ...|...|........ 00000000011cfff0 00 00 00 00 60 07 91 7c - 00 00 00 00 00 00 00 00 ....`..|........ 00000000011d0000 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000011d0010 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000011d0020 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000011d0030 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000011d0040 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000011d0050 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000011d0060 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000011d0070 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000011d0080 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000011d0090 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000000011d00a0 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................