====================================================================== Summary ====================================================================== Exception: 0xC0000005 - STATUS_ACCESS_VIOLATION Details: Memory at 00000020 NetBox.dll! (get the pdb) could not be executed errno: 0x00000000 - No error LastError: 0x00000002 - Не удается найти указанный файл. NTSTATUS: 0xC0000034 - Объект с указанным именем не найден. Address: 0x00000020 - NetBox.dll! (get the pdb) Location: GetFiles, plclass.cpp(1026) Module: C:\Program Files\Far Manager\Plugins\NetBox\NetBox.dll Plugin: NetBox 24.9.604.0 (SFTP/FTP(S)/SCP/WebDAV/S3 client for FAR 3.0 x86/x64/ARM64, Mikhail Lukashov) ====================================================================== System information ====================================================================== Far: 3.0.6370.0 x64 (62ae2d1) Compiler: Microsoft Visual C++, version 19.41.33923.0 PE time: 2024-09-17 00:16:46.000 File time: 2024-09-16 22:16:48.000 Time: 2024-09-25 10:48:39.725 Local: 2024-09-25 13:48:39.725 +0300, RTZ 2 (зима) Uptime: 00:51:05 OS: Windows NT Workstation 10.0.19045, 0x100/0x4 (Windows 10 Enterprise, version 22H2, OS build 19045.4894) Locale: ru-RU | LCID=00000419 (Lang=0419 (Primary=019 Sub=01) Sort=0 SortVersion=0) | ANSI=1251 OEM=866 Host: C:\Windows\System32\conhost.exe 10.0.19041.4522 (WinBuild.160101.0800) Parent: C:\Windows\explorer.exe 10.0.19041.4522 (WinBuild.160101.0800) Command: "C:\Program Files\Far Manager\Far.exe" Access: User Memory: 4.68 G out of 34.6 G free (13%); 39.7 M used by the process ====================================================================== Exception ====================================================================== ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- 00000020 NetBox.dll! (get the pdb) 0004253F NetBox.dll!::operator()(void)const __ptr64+0xDF (Terminal.cpp.obj) 0005C61A NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x3A (Terminal.cpp.obj) 0005C5A6 NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0xD6 (Terminal.cpp.obj) 0004233D NetBox.dll!TTerminal::ProcessFiles(class TStrings * __ptr64,enum TFileOperation,class fastdelegate::FastDelegate3 && __ptr64,void * __ptr64,enum TOperationSide,bool) __ptr64+0x14D (Terminal.cpp.obj) 00045973 NetBox.dll!TTerminal::CalculateFilesSize(class TStrings * __ptr64,__int64 & __ptr64,struct TCalculateSizeParams & __ptr64) __ptr64+0x73 (Terminal.cpp.obj) 0005BA1C NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x10C (Terminal.cpp.obj) 00053549 NetBox.dll!::operator()(void)const __ptr64+0x219 (Terminal.cpp.obj) 0005B807 NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x37 (Terminal.cpp.obj) 0005322A NetBox.dll!TTerminal::CopyToLocal(class TStrings * __ptr64,class UnicodeString const & __ptr64,class TCopyParamType const * __ptr64,int,class TParallelOperation * __ptr64) __ptr64+0xFA (Terminal.cpp.obj) 0017E4EB NetBox.dll!OpenW+0x1F75B 001866A5 NetBox.dll!OpenW+0x27915 0017DE0D NetBox.dll!OpenW+0x1F07D 001704A4 NetBox.dll!OpenW+0x11714 00168C81 NetBox.dll!OpenW+0x9EF1 0015EB46 NetBox.dll!GetFilesW+0x46 00282359 Far.exe!`function_ref::function_ref,struct GetFilesInfo * __ptr64 & __ptr64>(struct Plugin::ExecuteStruct<11,1> & __ptr64,struct GetFilesInfo * __ptr64 & __ptr64) __ptr64'::`2':: >(class `Plugin::ExecuteFunction,struct GetFilesInfo * __ptr64 & __ptr64>(struct Plugin::ExecuteStruct<11,1> & __ptr64,struct GetFilesInfo * __ptr64 & __ptr64) __ptr64'::`2':: && __ptr64) __ptr64'::`1'::::(__int64)+0x19 (plclass.obj) 00281F49 Far.exe!`function_ref::function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64>(class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64) __ptr64'::`1'::::(__int64)+0x19 (plclass.obj) 001227F6 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) 00280EC1 Far.exe!cpp_try,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2'::,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2'::,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: >(class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64,struct source_location const & __ptr64)+0x61 (plclass.obj) 002820A2 Far.exe!`function_ref::function_ref,struct source_location const & __ptr64) __ptr64'::`2':: const & __ptr64>(class `Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2':: const & __ptr64) __ptr64'::`1'::::(__int64)+0x82 (plclass.obj) 00122828 Far.exe!detail::seh_try(class function_ref,class function_ref,class function_ref)+0x18 (exception_handler.obj) 00280E4E Far.exe!Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64+0xAE (plclass.obj) 0027FC9E Far.exe!Plugin::GetFiles(struct GetFilesInfo * __ptr64) __ptr64+0xCE (plclass.obj) 002B4F49 Far.exe!PluginManager::GetFile(class plugin_panel const * __ptr64,struct PluginPanelItem * __ptr64,class std::basic_string,class std::allocator > const & __ptr64,class std::basic_string,class std::allocator > & __ptr64,int)+0x99 (plugins.obj) 0015589E Far.exe!FileList::ProcessKey(class Manager::Key const & __ptr64) __ptr64+0x281E (filelist.obj) 001892FE Far.exe!FilePanels::ProcessKey(class Manager::Key const & __ptr64) __ptr64+0x149E (filepanels.obj) 00226702 Far.exe!Manager::ProcessKey(class Manager::Key) __ptr64+0x1C2 (manager.obj) 00226014 Far.exe!Manager::ProcessMainLoop(void) __ptr64+0x1E4 (manager.obj) 00225E01 Far.exe!Manager::EnterMainLoop(void) __ptr64+0xC1 (manager.obj) 0021D365 Far.exe!MainProcess(class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,int,int)+0xF35 (main.obj) 00222563 Far.exe!`function_ref::function_ref)'::`2'::,class `mainImpl(class std::span)'::`2'::,class `mainImpl(class std::span)'::`2':: >(class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: >(class `cpp_try)'::`2'::,class `mainImpl(class std::span)'::`2'::,class `mainImpl(class std::span)'::`2':: >(class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: && __ptr64) __ptr64'::`1'::::(__int64)+0xE3 (main.obj) 001227F6 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) 00221304 Far.exe!mainImpl(class std::span)+0xE44 (main.obj) 00221CB9 Far.exe!`wmain_seh(void)'::`2'::::operator()(void)const __ptr64+0x19 (main.obj) 002225E2 Far.exe!`function_ref::function_ref,class `wmain_seh(void)'::`2'::,class `wmain_seh(void)'::`2':: >(class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: >(class `cpp_try,class `wmain_seh(void)'::`2'::,class `wmain_seh(void)'::`2':: >(class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: && __ptr64) __ptr64'::`1'::::(__int64)+0x12 (main.obj) 001227F6 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) 00221BE8 Far.exe!wmain_seh(void)+0x3A8 (main.obj) 0022266C Far.exe!`function_ref::function_ref,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64)'::`3':: >(class `seh_try,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64)'::`3':: && __ptr64) __ptr64'::`1'::::(__int64)+0x4C (main.obj) 00122828 Far.exe!detail::seh_try(class function_ref,class function_ref,class function_ref)+0x18 (exception_handler.obj) 00221E28 Far.exe!main+0xC8 (main.obj) 003421E0 Far.exe!__scrt_common_main_seh(void)+0x10C (LIBCMT:exe_main.obj) 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000028723DE9E00 RBX = 000002872500AF50 RCX = 000002872500AF50 RDX = 0000000000000033 RSI = 0000009C698FC450 RDI = 0000000000000000 R8 = 0000000000000018 R9 = 0000000000000040 R10 = 00007FFCBE1F0000 R11 = 00007FFCBE7A993D R12 = 0000000000000000 R13 = 0000028723DEBFA8 R14 = 0000000000000000 R15 = 0000009C698FC5D0 RIP = 0000000000000020 RSP = 0000009C698FC278 RBP = 0000009C698FC999 EFL = 00010206 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- 00000020 NetBox.dll! (get the pdb): No prior disassembly possible 00000000`00000020 ?? ??? 00000000`00000021 ?? ??? 00000000`00000022 ?? ??? 00000000`00000023 ?? ??? 00000000`00000024 ?? ??? 00000000`00000025 ?? ??? 00000000`00000026 ?? ??? 00000000`00000027 ?? ??? 00000000`00000028 ?? ??? 00000000`00000029 ?? ??? 0004253F NetBox.dll!::operator()(void)const __ptr64+0xDF (Terminal.cpp.obj): 00007ffc`be232524 ffd0 call rax 00007ffc`be232526 488bd8 mov rbx,rax 00007ffc`be232529 4885c0 test rax,rax 00007ffc`be23252c 7505 jne NetBox+0x42533 (00007ffc`be232533) 00007ffc`be23252e 498bdc mov rbx,r12 00007ffc`be232531 eb12 jmp NetBox+0x42545 (00007ffc`be232545) 00007ffc`be232533 488b00 mov rax,qword ptr [rax] 00007ffc`be232536 66ba3300 mov dx,33h 00007ffc`be23253a 488bcb mov rcx,rbx 00007ffc`be23253d ff10 call qword ptr [rax] 00007ffc`be23253f 84c0 test al,al 0005C61A NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x3A (Terminal.cpp.obj): 00007ffc`be24c5f0 0f1101 movups xmmword ptr [rcx],xmm0 00007ffc`be24c5f3 0f104a10 movups xmm1,xmmword ptr [rdx+10h] 00007ffc`be24c5f7 0f114910 movups xmmword ptr [rcx+10h],xmm1 00007ffc`be24c5fb 0f104220 movups xmm0,xmmword ptr [rdx+20h] 00007ffc`be24c5ff 0f114120 movups xmmword ptr [rcx+20h],xmm0 00007ffc`be24c603 f20f104a30 movsd xmm1,mmword ptr [rdx+30h] 00007ffc`be24c608 f20f114930 movsd mmword ptr [rcx+30h],xmm1 00007ffc`be24c60d 410f1000 movups xmm0,xmmword ptr [r8] 00007ffc`be24c611 0f114138 movups xmmword ptr [rcx+38h],xmm0 00007ffc`be24c615 e8465efeff call NetBox+0x42460 (00007ffc`be232460) 00007ffc`be24c61a 90 nop 0005C5A6 NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0xD6 (Terminal.cpp.obj): 00007ffc`be24c57b 54 push rsp 00007ffc`be24c57c 2440 and al,40h 00007ffc`be24c57e 4c89442448 mov qword ptr [rsp+48h],r8 00007ffc`be24c583 4c894c2450 mov qword ptr [rsp+50h],r9 00007ffc`be24c588 4c895c2458 mov qword ptr [rsp+58h],r11 00007ffc`be24c58d 4c89542460 mov qword ptr [rsp+60h],r10 00007ffc`be24c592 4c8d442420 lea r8,[rsp+20h] 00007ffc`be24c597 488d542430 lea rdx,[rsp+30h] 00007ffc`be24c59c 488d4c2470 lea rcx,[rsp+70h] 00007ffc`be24c5a1 e83a000000 call NetBox+0x5c5e0 (00007ffc`be24c5e0) 00007ffc`be24c5a6 488b4b18 mov rcx,qword ptr [rbx+18h] 0004233D NetBox.dll!TTerminal::ProcessFiles(class TStrings * __ptr64,enum TFileOperation,class fastdelegate::FastDelegate3 && __ptr64,void * __ptr64,enum TOperationSide,bool) __ptr64+0x14D (Terminal.cpp.obj): 00007ffc`be2322f9 488d8424a0040000 lea rax,[rsp+4A0h] 00007ffc`be232301 48898424a0000000 mov qword ptr [rsp+0A0h],rax 00007ffc`be232309 488d442438 lea rax,[rsp+38h] 00007ffc`be23230e 48898424a8000000 mov qword ptr [rsp+0A8h],rax 00007ffc`be232316 488d8424b0040000 lea rax,[rsp+4B0h] 00007ffc`be23231e 48898424b0000000 mov qword ptr [rsp+0B0h],rax 00007ffc`be232326 4c8d442440 lea r8,[rsp+40h] 00007ffc`be23232b 488d542470 lea rdx,[rsp+70h] 00007ffc`be232330 488d8c24c0000000 lea rcx,[rsp+0C0h] 00007ffc`be232338 e893a10100 call NetBox+0x5c4d0 (00007ffc`be24c4d0) 00007ffc`be23233d 90 nop 00045973 NetBox.dll!TTerminal::CalculateFilesSize(class TStrings * __ptr64,__int64 & __ptr64,struct TCalculateSizeParams & __ptr64) __ptr64+0x73 (Terminal.cpp.obj): 00007ffc`be235942 488d15d7f5ffff lea rdx,[NetBox+0x44f20 (00007ffc`be234f20)] 00007ffc`be235949 488d4de7 lea rcx,[rbp-19h] 00007ffc`be23594d e81ef9fdff call NetBox+0x25270 (00007ffc`be215270) 00007ffc`be235952 4c8bc8 mov r9,rax 00007ffc`be235955 c744242801000000 mov dword ptr [rsp+28h],1 00007ffc`be23595d 4c897c2420 mov qword ptr [rsp+20h],r15 00007ffc`be235962 41b807000000 mov r8d,7 00007ffc`be235968 488bd3 mov rdx,rbx 00007ffc`be23596b 488bce mov rcx,rsi 00007ffc`be23596e e87dc8ffff call NetBox+0x421f0 (00007ffc`be2321f0) 00007ffc`be235973 498b4740 mov rax,qword ptr [r15+40h] 0005BA1C NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x10C (Terminal.cpp.obj): 00007ffc`be24b9f2 7405 je NetBox+0x5b9f9 (00007ffc`be24b9f9) 00007ffc`be24b9f4 c644247801 mov byte ptr [rsp+78h],1 00007ffc`be24b9f9 488d442420 lea rax,[rsp+20h] 00007ffc`be24b9fe 4889442470 mov qword ptr [rsp+70h],rax 00007ffc`be24ba03 488b5320 mov rdx,qword ptr [rbx+20h] 00007ffc`be24ba07 4c8d4c2450 lea r9,[rsp+50h] 00007ffc`be24ba0c 4c8b4328 mov r8,qword ptr [rbx+28h] 00007ffc`be24ba10 488b12 mov rdx,qword ptr [rdx] 00007ffc`be24ba13 488b4b18 mov rcx,qword ptr [rbx+18h] 00007ffc`be24ba17 e8e49efeff call NetBox+0x45900 (00007ffc`be235900) 00007ffc`be24ba1c 84c0 test al,al 00053549 NetBox.dll!::operator()(void)const __ptr64+0x219 (Terminal.cpp.obj): 00007ffc`be24351b 48895598 mov qword ptr [rbp-68h],rdx 00007ffc`be24351f 48894da0 mov qword ptr [rbp-60h],rcx 00007ffc`be243523 488d442450 lea rax,[rsp+50h] 00007ffc`be243528 488945a8 mov qword ptr [rbp-58h],rax 00007ffc`be24352c 488d8568040000 lea rax,[rbp+468h] 00007ffc`be243533 488945b0 mov qword ptr [rbp-50h],rax 00007ffc`be243537 4c8d442470 lea r8,[rsp+70h] 00007ffc`be24353c 488d5580 lea rdx,[rbp-80h] 00007ffc`be243540 488d4dc0 lea rcx,[rbp-40h] 00007ffc`be243544 e8c7830000 call NetBox+0x5b910 (00007ffc`be24b910) 00007ffc`be243549 4c8b36 mov r14,qword ptr [rsi] 0005B807 NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x37 (Terminal.cpp.obj): 00007ffc`be24b7e0 0f1101 movups xmmword ptr [rcx],xmm0 00007ffc`be24b7e3 0f104a10 movups xmm1,xmmword ptr [rdx+10h] 00007ffc`be24b7e7 0f114910 movups xmmword ptr [rcx+10h],xmm1 00007ffc`be24b7eb 0f104220 movups xmm0,xmmword ptr [rdx+20h] 00007ffc`be24b7ef 0f114120 movups xmmword ptr [rcx+20h],xmm0 00007ffc`be24b7f3 0f104a30 movups xmm1,xmmword ptr [rdx+30h] 00007ffc`be24b7f7 0f114930 movups xmmword ptr [rcx+30h],xmm1 00007ffc`be24b7fb 498b00 mov rax,qword ptr [r8] 00007ffc`be24b7fe 48894140 mov qword ptr [rcx+40h],rax 00007ffc`be24b802 e8297bffff call NetBox+0x53330 (00007ffc`be243330) 00007ffc`be24b807 90 nop 0005322A NetBox.dll!TTerminal::CopyToLocal(class TStrings * __ptr64,class UnicodeString const & __ptr64,class TCopyParamType const * __ptr64,int,class TParallelOperation * __ptr64) __ptr64+0xFA (Terminal.cpp.obj): 00007ffc`be243201 488945bf mov qword ptr [rbp-41h],rax 00007ffc`be243205 488975c7 mov qword ptr [rbp-39h],rsi 00007ffc`be243209 488d458b lea rax,[rbp-75h] 00007ffc`be24320d 488945cf mov qword ptr [rbp-31h],rax 00007ffc`be243211 488d4587 lea rax,[rbp-79h] 00007ffc`be243215 488945d7 mov qword ptr [rbp-29h],rax 00007ffc`be243219 4c8d458f lea r8,[rbp-71h] 00007ffc`be24321d 488d559f lea rdx,[rbp-61h] 00007ffc`be243221 488d4de7 lea rcx,[rbp-19h] 00007ffc`be243225 e8a6850000 call NetBox+0x5b7d0 (00007ffc`be24b7d0) 00007ffc`be24322a 837d8b00 cmp dword ptr [rbp-75h],0 ====================================================================== Exception handler thread ====================================================================== ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- 0011E45B Far.exe!collect_information(class exception_context const & __ptr64,struct source_location const & __ptr64,class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,struct error_state_ex const & __ptr64,class std::span)+0x1A1B (exception_handler.obj) 00120928 Far.exe!handle_generic_exception(class exception_context const & __ptr64,struct source_location const & __ptr64,class Plugin const * __ptr64 const,class std::basic_string_view >,class std::basic_string_view >,struct error_state_ex const & __ptr64,class std::span)+0x8A8 (exception_handler.obj) 00121DAD Far.exe!handle_seh_exception(class exception_context const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)+0x28D (exception_handler.obj) 001229F3 Far.exe!detail::seh_filter(struct _EXCEPTION_POINTERS const * __ptr64,class Plugin const * __ptr64,struct source_location const & __ptr64)+0x173 (exception_handler.obj) 00394F97 Far.exe!int `detail::seh_try(class function_ref,class function_ref,class function_ref)'::`1'::filt$0+0x37 (exception_handler.obj) 00343833 Far.exe!__C_specific_handler+0x9F (libvcruntime:riscchandler.obj) 000A292F ntdll.dll!_chkstk+0x11F 00052554 ntdll.dll!RtlRaiseException+0x484 000A143E ntdll.dll!KiUserExceptionDispatcher+0x2E 00000020 NetBox.dll! (get the pdb) ====================================================================== Thread 18000 / 0x4650 (Window messages processor) ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC0000047 - Попытка освобождения семафора, при котором было бы превышено его максимальное значение счетчика. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- 00001104 win32u.dll!NtUserGetMessage+0x14 0002210E USER32.dll!GetMessageW+0x2E 0033B562 Far.exe!wm_listener::WindowThreadRoutine(class os::concurrency::event const & __ptr64) __ptr64+0x4A2 (wm_listener.obj) 0033BE1B Far.exe!os::concurrency::thread::wrapper >(void (__cdecl wm_listener::*&& __ptr64)(class os::concurrency::event const & __ptr64) __ptr64,class wm_listener * __ptr64 && __ptr64,class std::reference_wrapper && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x1B (wm_listener.obj) 0035CE02 Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj) 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000001006 RBX = 0000009C69CFFD00 RCX = 0000009C69CFFD00 RDX = 0000000000000000 RSI = 0000009C698FE950 RDI = 0000028720E6C440 R8 = 0000009C69CFFAD8 R9 = 0000009C69CFFD10 R10 = 0000000000000000 R11 = 0000000000000246 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 00007FF656F06C80 RIP = 00007FFD0A5F1104 RSP = 0000009C69CFFBA8 RBP = 0000009C69CFFD10 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- 00001104 win32u.dll!NtUserGetMessage+0x14: 00007ffd`0a5f10e4 c3 ret 00007ffd`0a5f10e5 cd2e int 2Eh 00007ffd`0a5f10e7 c3 ret 00007ffd`0a5f10e8 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserGetMessage: 00007ffd`0a5f10f0 4c8bd1 mov r10,rcx 00007ffd`0a5f10f3 b806100000 mov eax,1006h 00007ffd`0a5f10f8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffd`0a5f1100 7503 jne win32u!NtUserGetMessage+0x15 (00007ffd`0a5f1105) 00007ffd`0a5f1102 0f05 syscall 00007ffd`0a5f1104 c3 ret 0002210E USER32.dll!GetMessageW+0x2E: 00007ffd`0c8620e2 4883ec50 sub rsp,50h 00007ffd`0c8620e6 418bc1 mov eax,r9d 00007ffd`0c8620e9 488bd9 mov rbx,rcx 00007ffd`0c8620ec 458bc8 mov r9d,r8d 00007ffd`0c8620ef 440bc8 or r9d,eax 00007ffd`0c8620f2 41f7c10000feff test r9d,0FFFE0000h 00007ffd`0c8620f9 0f85b11d0200 jne USER32!SetWindowsHookExAW+0xd980 (00007ffd`0c883eb0) 00007ffd`0c8620ff 448bc8 mov r9d,eax 00007ffd`0c862102 48897c2460 mov qword ptr [rsp+60h],rdi 00007ffd`0c862107 48ff1502ea0600 call qword ptr [USER32!gapfnScSendMessage+0x11b0 (00007ffd`0c8d0b10)] 00007ffd`0c86210e 0f1f440000 nop dword ptr [rax+rax] 0033B562 Far.exe!wm_listener::WindowThreadRoutine(class os::concurrency::event const & __ptr64) __ptr64+0x4A2 (wm_listener.obj): 00007ff6`56e4b536 488bcf mov rcx,rdi 00007ff6`56e4b539 e8c287dcff call Far+0x103d00 (00007ff6`56c13d00) 00007ff6`56e4b53e 84c0 test al,al 00007ff6`56e4b540 0f853d010000 jne Far+0x33b683 (00007ff6`56e4b683) 00007ff6`56e4b546 66660f1f840000000000 nop word ptr [rax+rax] 00007ff6`56e4b550 4533c9 xor r9d,r9d 00007ff6`56e4b553 4533c0 xor r8d,r8d 00007ff6`56e4b556 33d2 xor edx,edx 00007ff6`56e4b558 488d4df0 lea rcx,[rbp-10h] 00007ff6`56e4b55c ff154ef50600 call qword ptr [Far+0x3aaab0 (00007ff6`56ebaab0)] 00007ff6`56e4b562 85c0 test eax,eax 0033BE1B Far.exe!os::concurrency::thread::wrapper >(void (__cdecl wm_listener::*&& __ptr64)(class os::concurrency::event const & __ptr64) __ptr64,class wm_listener * __ptr64 && __ptr64,class std::reference_wrapper && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x1B (wm_listener.obj): 00007ff6`56e4bdfe 5e pop rsi 00007ff6`56e4bdff c3 ret 00007ff6`56e4be00 4053 push rbx 00007ff6`56e4be02 4883ec20 sub rsp,20h 00007ff6`56e4be06 488bd9 mov rbx,rcx 00007ff6`56e4be09 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`56e4be0e 488b01 mov rax,qword ptr [rcx] 00007ff6`56e4be11 488b5108 mov rdx,qword ptr [rcx+8] 00007ff6`56e4be15 488b4910 mov rcx,qword ptr [rcx+10h] 00007ff6`56e4be19 ffd0 call rax 00007ff6`56e4be1b 90 nop 0035CE02 Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj): 00007ff6`56e6cdd9 7510 jne Far+0x35cdeb (00007ff6`56e6cdeb) 00007ff6`56e6cddb 8d48ff lea ecx,[rax-1] 00007ff6`56e6cdde e8cd210100 call Far+0x36efb0 (00007ff6`56e7efb0) 00007ff6`56e6cde3 85c0 test eax,eax 00007ff6`56e6cde5 0f94c0 sete al 00007ff6`56e6cde8 884320 mov byte ptr [rbx+20h],al 00007ff6`56e6cdeb 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`56e6cdf5 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`56e6cdf9 488b03 mov rax,qword ptr [rbx] 00007ff6`56e6cdfc ff152ee00400 call qword ptr [Far+0x3aae30 (00007ff6`56ebae30)] 00007ff6`56e6ce02 8bc8 mov ecx,eax 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffd`0b63735d cc int 3 00007ffd`0b63735e cc int 3 00007ffd`0b63735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffd`0b637360 4883ec28 sub rsp,28h 00007ffd`0b637364 85c9 test ecx,ecx 00007ffd`0b637366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffd`0b637383) 00007ffd`0b637368 498bc8 mov rcx,r8 00007ffd`0b63736b 488bc2 mov rax,rdx 00007ffd`0b63736e ff15d4f00600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13a88 (00007ffd`0b6a6448)] 00007ffd`0b637374 8bc8 mov ecx,eax 0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffd`0cb1cc72 ec in al,dx 00007ffd`0cb1cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffd`0cb1ccc1) 00007ffd`0cb1cc75 8bc9 mov ecx,ecx 00007ffd`0cb1cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffd`0cc3bff0)] 00007ffd`0cb1cc7e 4885c0 test rax,rax 00007ffd`0cb1cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffd`0cb1cc93) 00007ffd`0cb1cc83 4c8bc2 mov r8,rdx 00007ffd`0cb1cc86 488bd1 mov rdx,rcx 00007ffd`0cb1cc89 33c9 xor ecx,ecx 00007ffd`0cb1cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffd`0cc55000)] 00007ffd`0cb1cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffd`0cb1ccb3) ====================================================================== Thread 26352 / 0x66F0 (Taskbar processor) ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC0000034 - Объект с указанным именем не найден. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- 0009E0B4 ntdll.dll!NtWaitForMultipleObjects+0x14 00064030 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0 00063F2E KERNELBASE.dll!WaitForMultipleObjects+0xE 00250EC3 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj) 003064A6 Far.exe!taskbar_impl::handler(void)const __ptr64+0x3C6 (taskbar.obj) 001904F4 Far.exe!os::concurrency::thread::wrapper(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x14 (findfile.obj) 0035CE02 Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj) 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000003 RCX = 0000000000000003 RDX = 0000009C69EFFA20 RSI = 0000000000000000 RDI = 0000000000000003 R8 = 0000009C69EFE638 R9 = 0000009C69EFE999 R10 = 0000000000000000 R11 = 0000000000000246 R12 = 00000000FFFFFFFF R13 = 0000009C69EFFA20 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFD0CB6E0B4 RSP = 0000009C69EFF568 RBP = 0000009C69EFFA89 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- 0009E0B4 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffd`0cb6e091 fb sti 00007ffd`0cb6e092 8efd mov st(-1),bp 00007ffd`0cb6e094 ff6666 jmp qword ptr [rsi+66h] 00007ffd`0cb6e097 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffd`0cb6e0a0 4c8bd1 mov r10,rcx 00007ffd`0cb6e0a3 b85b000000 mov eax,5Bh 00007ffd`0cb6e0a8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffd`0cb6e0b0 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffd`0cb6e0b5) 00007ffd`0cb6e0b2 0f05 syscall 00007ffd`0cb6e0b4 c3 ret 00064030 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0: 00007ffd`0a684007 4c8d742450 lea r14,[rsp+50h] 00007ffd`0a68400c 448b7c2444 mov r15d,dword ptr [rsp+44h] 00007ffd`0a684011 4533c0 xor r8d,r8d 00007ffd`0a684014 4585ff test r15d,r15d 00007ffd`0a684017 410f94c0 sete r8b 00007ffd`0a68401b 4c89742420 mov qword ptr [rsp+20h],r14 00007ffd`0a684020 440fb6ce movzx r9d,sil 00007ffd`0a684024 498bd5 mov rdx,r13 00007ffd`0a684027 8bcb mov ecx,ebx 00007ffd`0a684029 48ff1560641800 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb7220 (00007ffd`0a80a490)] 00007ffd`0a684030 0f1f440000 nop dword ptr [rax+rax] 00063F2E KERNELBASE.dll!WaitForMultipleObjects+0xE: 00007ffd`0a683f1a cc int 3 00007ffd`0a683f1b cc int 3 00007ffd`0a683f1c cc int 3 00007ffd`0a683f1d cc int 3 00007ffd`0a683f1e cc int 3 00007ffd`0a683f1f cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffd`0a683f20 4883ec38 sub rsp,38h 00007ffd`0a683f24 8364242000 and dword ptr [rsp+20h],0 00007ffd`0a683f29 e812000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffd`0a683f40) 00007ffd`0a683f2e 4883c438 add rsp,38h 00250EC3 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj): 00007ff6`56d60e92 4881ec20010000 sub rsp,120h 00007ff6`56d60e99 488b05a0a32000 mov rax,qword ptr [Far+0x45b240 (00007ff6`56f6b240)] 00007ff6`56d60ea0 4833c4 xor rax,rsp 00007ff6`56d60ea3 4889842410010000 mov qword ptr [rsp+110h],rax 00007ff6`56d60eab 488b5908 mov rbx,qword ptr [rcx+8] 00007ff6`56d60eaf 41b9ffffffff mov r9d,0FFFFFFFFh 00007ff6`56d60eb5 4533c0 xor r8d,r8d 00007ff6`56d60eb8 488b11 mov rdx,qword ptr [rcx] 00007ff6`56d60ebb 8bcb mov ecx,ebx 00007ff6`56d60ebd ff1575941500 call qword ptr [Far+0x3aa338 (00007ff6`56eba338)] 00007ff6`56d60ec3 8bc8 mov ecx,eax 003064A6 Far.exe!taskbar_impl::handler(void)const __ptr64+0x3C6 (taskbar.obj): 00007ff6`56e1647f 00498b add byte ptr [rcx-75h],cl 00007ff6`56e16482 47184889 sbb byte ptr [r8-77h],r9b 00007ff6`56e16486 4597 xchg eax,r15d 00007ff6`56e16488 498b4720 mov rax,qword ptr [r15+20h] 00007ff6`56e1648c 4889459f mov qword ptr [rbp-61h],rax 00007ff6`56e16490 498b4728 mov rax,qword ptr [r15+28h] 00007ff6`56e16494 488945a7 mov qword ptr [rbp-59h],rax 00007ff6`56e16498 660f7f75c7 movdqa xmmword ptr [rbp-39h],xmm6 00007ff6`56e1649d 488d4dc7 lea rcx,[rbp-39h] 00007ff6`56e164a1 e8eaa9f4ff call Far+0x250e90 (00007ff6`56d60e90) 00007ff6`56e164a6 4885c0 test rax,rax 001904F4 Far.exe!os::concurrency::thread::wrapper(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x14 (findfile.obj): 00007ff6`56ca04dc cc int 3 00007ff6`56ca04dd cc int 3 00007ff6`56ca04de cc int 3 00007ff6`56ca04df cc int 3 00007ff6`56ca04e0 4053 push rbx 00007ff6`56ca04e2 4883ec20 sub rsp,20h 00007ff6`56ca04e6 488bd9 mov rbx,rcx 00007ff6`56ca04e9 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`56ca04ee 488b4908 mov rcx,qword ptr [rcx+8] 00007ff6`56ca04f2 ff13 call qword ptr [rbx] 00007ff6`56ca04f4 90 nop 0035CE02 Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj): 00007ff6`56e6cdd9 7510 jne Far+0x35cdeb (00007ff6`56e6cdeb) 00007ff6`56e6cddb 8d48ff lea ecx,[rax-1] 00007ff6`56e6cdde e8cd210100 call Far+0x36efb0 (00007ff6`56e7efb0) 00007ff6`56e6cde3 85c0 test eax,eax 00007ff6`56e6cde5 0f94c0 sete al 00007ff6`56e6cde8 884320 mov byte ptr [rbx+20h],al 00007ff6`56e6cdeb 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`56e6cdf5 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`56e6cdf9 488b03 mov rax,qword ptr [rbx] 00007ff6`56e6cdfc ff152ee00400 call qword ptr [Far+0x3aae30 (00007ff6`56ebae30)] 00007ff6`56e6ce02 8bc8 mov ecx,eax 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffd`0b63735d cc int 3 00007ffd`0b63735e cc int 3 00007ffd`0b63735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffd`0b637360 4883ec28 sub rsp,28h 00007ffd`0b637364 85c9 test ecx,ecx 00007ffd`0b637366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffd`0b637383) 00007ffd`0b637368 498bc8 mov rcx,r8 00007ffd`0b63736b 488bc2 mov rax,rdx 00007ffd`0b63736e ff15d4f00600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13a88 (00007ffd`0b6a6448)] 00007ffd`0b637374 8bc8 mov ecx,eax 0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffd`0cb1cc72 ec in al,dx 00007ffd`0cb1cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffd`0cb1ccc1) 00007ffd`0cb1cc75 8bc9 mov ecx,ecx 00007ffd`0cb1cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffd`0cc3bff0)] 00007ffd`0cb1cc7e 4885c0 test rax,rax 00007ffd`0cb1cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffd`0cb1cc93) 00007ffd`0cb1cc83 4c8bc2 mov r8,rdx 00007ffd`0cb1cc86 488bd1 mov rdx,rcx 00007ffd`0cb1cc89 33c9 xor ecx,ecx 00007ffd`0cb1cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffd`0cc55000)] 00007ffd`0cb1cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffd`0cb1ccb3) ====================================================================== Thread 26040 / 0x65B8 ====================================================================== LastError: 0x000003F0 - Попытка ссылки на несуществующий токен. NTSTATUS: 0xC000007C - Попытка ссылки на несуществующий токен. Как правило, это происходит при ссылке на токен, связанный с потоком команд, не олицетворяющим клиента. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- 00001104 win32u.dll!NtUserGetMessage+0x14 0002210E USER32.dll!GetMessageW+0x2E 000836D8 combase.dll!CoDisconnectContext+0xB08 00083610 combase.dll!CoDisconnectContext+0xA40 000CCFD0 combase.dll!RoGetServerActivatableClasses+0x1240 000CCF59 combase.dll!RoGetServerActivatableClasses+0x11C9 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000001006 RBX = 0000009C6A2FFB60 RCX = 0000009C6A2FFB60 RDX = 0000000000000000 RSI = 00000000001928DE RDI = 0000000000000000 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 00007FFD0C660000 R11 = 00007FFD0C671A80 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000001000 R15 = 0000000000000000 RIP = 00007FFD0A5F1104 RSP = 0000009C6A2FFAB8 RBP = 000000000000038C EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- 00001104 win32u.dll!NtUserGetMessage+0x14: 00007ffd`0a5f10e4 c3 ret 00007ffd`0a5f10e5 cd2e int 2Eh 00007ffd`0a5f10e7 c3 ret 00007ffd`0a5f10e8 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserGetMessage: 00007ffd`0a5f10f0 4c8bd1 mov r10,rcx 00007ffd`0a5f10f3 b806100000 mov eax,1006h 00007ffd`0a5f10f8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffd`0a5f1100 7503 jne win32u!NtUserGetMessage+0x15 (00007ffd`0a5f1105) 00007ffd`0a5f1102 0f05 syscall 00007ffd`0a5f1104 c3 ret 0002210E USER32.dll!GetMessageW+0x2E: 00007ffd`0c8620e2 4883ec50 sub rsp,50h 00007ffd`0c8620e6 418bc1 mov eax,r9d 00007ffd`0c8620e9 488bd9 mov rbx,rcx 00007ffd`0c8620ec 458bc8 mov r9d,r8d 00007ffd`0c8620ef 440bc8 or r9d,eax 00007ffd`0c8620f2 41f7c10000feff test r9d,0FFFE0000h 00007ffd`0c8620f9 0f85b11d0200 jne USER32!SetWindowsHookExAW+0xd980 (00007ffd`0c883eb0) 00007ffd`0c8620ff 448bc8 mov r9d,eax 00007ffd`0c862102 48897c2460 mov qword ptr [rsp+60h],rdi 00007ffd`0c862107 48ff1502ea0600 call qword ptr [USER32!gapfnScSendMessage+0x11b0 (00007ffd`0c8d0b10)] 00007ffd`0c86210e 0f1f440000 nop dword ptr [rax+rax] 000836D8 combase.dll!CoDisconnectContext+0xB08: 00007ffd`0acb36a7 488bb1c0000000 mov rsi,qword ptr [rcx+0C0h] 00007ffd`0acb36ae 488bce mov rcx,rsi 00007ffd`0acb36b1 48ff15e8ce2a00 call qword ptr [combase!Ordinal183+0x809d8 (00007ffd`0af605a0)] 00007ffd`0acb36b8 0f1f440000 nop dword ptr [rax+rax] 00007ffd`0acb36bd 488905ecf62700 mov qword ptr [combase!Ordinal183+0x531e8 (00007ffd`0af32db0)],rax 00007ffd`0acb36c4 4533c9 xor r9d,r9d 00007ffd`0acb36c7 488d4c2440 lea rcx,[rsp+40h] 00007ffd`0acb36cc 4533c0 xor r8d,r8d 00007ffd`0acb36cf 33d2 xor edx,edx 00007ffd`0acb36d1 48ff15b0ce2a00 call qword ptr [combase!Ordinal183+0x809c0 (00007ffd`0af60588)] 00007ffd`0acb36d8 0f1f440000 nop dword ptr [rax+rax] 00083610 combase.dll!CoDisconnectContext+0xA40: 00007ffd`0acb35ec 488bcd mov rcx,rbp 00007ffd`0acb35ef 894658 mov dword ptr [rsi+58h],eax 00007ffd`0acb35f2 48ff155f971f00 call qword ptr [combase!Ordinal79+0x60ce8 (00007ffd`0aeacd58)] 00007ffd`0acb35f9 0f1f440000 nop dword ptr [rax+rax] 00007ffd`0acb35fe 8b4630 mov eax,dword ptr [rsi+30h] 00007ffd`0acb3601 83e01f and eax,1Fh 00007ffd`0acb3604 ffc8 dec eax 00007ffd`0acb3606 83f801 cmp eax,1 00007ffd`0acb3609 7705 ja combase!CoDisconnectContext+0xa40 (00007ffd`0acb3610) 00007ffd`0acb360b e864000000 call combase!CoDisconnectContext+0xaa4 (00007ffd`0acb3674) 00007ffd`0acb3610 488b442440 mov rax,qword ptr [rsp+40h] 000CCFD0 combase.dll!RoGetServerActivatableClasses+0x1240: 00007ffd`0acfcf9c 44397108 cmp dword ptr [rcx+8],r14d 00007ffd`0acfcfa0 0f8538010000 jne combase!RoGetServerActivatableClasses+0x134e (00007ffd`0acfd0de) 00007ffd`0acfcfa6 65488b042530000000 mov rax,qword ptr gs:[30h] 00007ffd`0acfcfaf 488b8058170000 mov rax,qword ptr [rax+1758h] 00007ffd`0acfcfb6 4885c0 test rax,rax 00007ffd`0acfcfb9 7407 je combase!RoGetServerActivatableClasses+0x1232 (00007ffd`0acfcfc2) 00007ffd`0acfcfbb 4489b038010000 mov dword ptr [rax+138h],r14d 00007ffd`0acfcfc2 488b4b18 mov rcx,qword ptr [rbx+18h] 00007ffd`0acfcfc6 488b4310 mov rax,qword ptr [rbx+10h] 00007ffd`0acfcfca ff1598051b00 call qword ptr [combase!Ordinal79+0x614f8 (00007ffd`0aead568)] 00007ffd`0acfcfd0 48ff15d9fa1a00 call qword ptr [combase!Ordinal79+0x60a40 (00007ffd`0aeacab0)] 000CCF59 combase.dll!RoGetServerActivatableClasses+0x11C9: 00007ffd`0acfcf30 48895c2408 mov qword ptr [rsp+8],rbx 00007ffd`0acfcf35 57 push rdi 00007ffd`0acfcf36 4883ec20 sub rsp,20h 00007ffd`0acfcf3a 488bf9 mov rdi,rcx 00007ffd`0acfcf3d 48ff155cfb1a00 call qword ptr [combase!Ordinal79+0x60a30 (00007ffd`0aeacaa0)] 00007ffd`0acfcf44 0f1f440000 nop dword ptr [rax+rax] 00007ffd`0acfcf49 894728 mov dword ptr [rdi+28h],eax 00007ffd`0acfcf4c e847040000 call combase!RoGetServerActivatableClasses+0x1608 (00007ffd`0acfd398) 00007ffd`0acfcf51 488bcf mov rcx,rdi 00007ffd`0acfcf54 e82b000000 call combase!RoGetServerActivatableClasses+0x11f4 (00007ffd`0acfcf84) 00007ffd`0acfcf59 488b5f30 mov rbx,qword ptr [rdi+30h] 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffd`0b63735d cc int 3 00007ffd`0b63735e cc int 3 00007ffd`0b63735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffd`0b637360 4883ec28 sub rsp,28h 00007ffd`0b637364 85c9 test ecx,ecx 00007ffd`0b637366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffd`0b637383) 00007ffd`0b637368 498bc8 mov rcx,r8 00007ffd`0b63736b 488bc2 mov rax,rdx 00007ffd`0b63736e ff15d4f00600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13a88 (00007ffd`0b6a6448)] 00007ffd`0b637374 8bc8 mov ecx,eax 0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffd`0cb1cc72 ec in al,dx 00007ffd`0cb1cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffd`0cb1ccc1) 00007ffd`0cb1cc75 8bc9 mov ecx,ecx 00007ffd`0cb1cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffd`0cc3bff0)] 00007ffd`0cb1cc7e 4885c0 test rax,rax 00007ffd`0cb1cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffd`0cb1cc93) 00007ffd`0cb1cc83 4c8bc2 mov r8,rdx 00007ffd`0cb1cc86 488bd1 mov rdx,rcx 00007ffd`0cb1cc89 33c9 xor ecx,ecx 00007ffd`0cb1cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffd`0cc55000)] 00007ffd`0cb1cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffd`0cb1ccb3) ====================================================================== Thread 15600 / 0x3CF0 (NetBox IdleThread) ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- 0009D5E4 ntdll.dll!ZwWaitForSingleObject+0x14 0002920E KERNELBASE.dll!WaitForSingleObjectEx+0x8E 00166766 NetBox.dll!OpenW+0x79D6 00060B18 NetBox.dll!TSimpleThread::ThreadProc(void * __ptr64)+0x18 (Queue.cpp.obj) 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000000004 RBX = 0000000000000000 RCX = 0000000000000380 RDX = 0000000000000000 RSI = 0000009C6A3FFCC8 RDI = 0000000000000380 R8 = 0000000000000024 R9 = 00007FF656E92228 R10 = 00007FF656B10000 R11 = 00000000FFFFFFFF R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000380 R15 = 0000000000000000 RIP = 00007FFD0CB6D5E4 RSP = 0000009C6A3FFC98 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- 0009D5E4 ntdll.dll!ZwWaitForSingleObject+0x14: 00007ffd`0cb6d5c4 c3 ret 00007ffd`0cb6d5c5 cd2e int 2Eh 00007ffd`0cb6d5c7 c3 ret 00007ffd`0cb6d5c8 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForSingleObject: 00007ffd`0cb6d5d0 4c8bd1 mov r10,rcx 00007ffd`0cb6d5d3 b804000000 mov eax,4 00007ffd`0cb6d5d8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffd`0cb6d5e0 7503 jne ntdll!ZwWaitForSingleObject+0x15 (00007ffd`0cb6d5e5) 00007ffd`0cb6d5e2 0f05 syscall 00007ffd`0cb6d5e4 c3 ret 0002920E KERNELBASE.dll!WaitForSingleObjectEx+0x8E: 00007ffd`0a6491e3 7445 je KERNELBASE!WaitForSingleObjectEx+0xaa (00007ffd`0a64922a) 00007ffd`0a6491e5 4869ce10270000 imul rcx,rsi,2710h 00007ffd`0a6491ec 48894c2428 mov qword ptr [rsp+28h],rcx 00007ffd`0a6491f1 48f7d9 neg rcx 00007ffd`0a6491f4 48894c2428 mov qword ptr [rsp+28h],rcx 00007ffd`0a6491f9 488d742428 lea rsi,[rsp+28h] 00007ffd`0a6491fe 4c8bc6 mov r8,rsi 00007ffd`0a649201 0fb6d3 movzx edx,bl 00007ffd`0a649204 498bce mov rcx,r14 00007ffd`0a649207 48ff153a091c00 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb68d8 (00007ffd`0a809b48)] 00007ffd`0a64920e 0f1f440000 nop dword ptr [rax+rax] 00166766 NetBox.dll!OpenW+0x79D6: 00007ffc`be356737 0f85a8000000 jne NetBox!OpenW+0x7a55 (00007ffc`be3567e5) 00007ffc`be35673d 48897c2430 mov qword ptr [rsp+30h],rdi 00007ffc`be356742 807b3000 cmp byte ptr [rbx+30h],0 00007ffc`be356746 757c jne NetBox!OpenW+0x7a34 (00007ffc`be3567c4) 00007ffc`be356748 0f1f840000000000 nop dword ptr [rax+rax] 00007ffc`be356750 488d4b38 lea rcx,[rbx+38h] 00007ffc`be356754 ff1556bf4600 call qword ptr [NetBox!OpenW+0x473920 (00007ffc`be7c26b0)] 00007ffc`be35675a 488b4b60 mov rcx,qword ptr [rbx+60h] 00007ffc`be35675e 8bd6 mov edx,esi 00007ffc`be356760 ff157ab94600 call qword ptr [NetBox!OpenW+0x473350 (00007ffc`be7c20e0)] 00007ffc`be356766 488d4b38 lea rcx,[rbx+38h] 00060B18 NetBox.dll!TSimpleThread::ThreadProc(void * __ptr64)+0x18 (Queue.cpp.obj): 00007ffc`be250afe cc int 3 00007ffc`be250aff cc int 3 00007ffc`be250b00 48894c2408 mov qword ptr [rsp+8],rcx 00007ffc`be250b05 53 push rbx 00007ffc`be250b06 4883ec20 sub rsp,20h 00007ffc`be250b0a 488bd9 mov rbx,rcx 00007ffc`be250b0d 4885c9 test rcx,rcx 00007ffc`be250b10 7432 je NetBox+0x60b44 (00007ffc`be250b44) 00007ffc`be250b12 488b01 mov rax,qword ptr [rcx] 00007ffc`be250b15 ff5030 call qword ptr [rax+30h] 00007ffc`be250b18 90 nop 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffd`0b63735d cc int 3 00007ffd`0b63735e cc int 3 00007ffd`0b63735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffd`0b637360 4883ec28 sub rsp,28h 00007ffd`0b637364 85c9 test ecx,ecx 00007ffd`0b637366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffd`0b637383) 00007ffd`0b637368 498bc8 mov rcx,r8 00007ffd`0b63736b 488bc2 mov rax,rdx 00007ffd`0b63736e ff15d4f00600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13a88 (00007ffd`0b6a6448)] 00007ffd`0b637374 8bc8 mov ecx,eax 0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffd`0cb1cc72 ec in al,dx 00007ffd`0cb1cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffd`0cb1ccc1) 00007ffd`0cb1cc75 8bc9 mov ecx,ecx 00007ffd`0cb1cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffd`0cc3bff0)] 00007ffd`0cb1cc7e 4885c0 test rax,rax 00007ffd`0cb1cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffd`0cb1cc93) 00007ffd`0cb1cc83 4c8bc2 mov r8,rdx 00007ffd`0cb1cc86 488bd1 mov rdx,rcx 00007ffd`0cb1cc89 33c9 xor ecx,ecx 00007ffd`0cb1cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffd`0cc55000)] 00007ffd`0cb1cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffd`0cb1ccb3) ====================================================================== Thread 18612 / 0x48B4 (Async history config) ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- 0009E0B4 ntdll.dll!NtWaitForMultipleObjects+0x14 00064030 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0 00063F2E KERNELBASE.dll!WaitForMultipleObjects+0xE 00250EC3 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj) 000756DD Far.exe!`anonymous namespace'::HistoryConfigCustom::ThreadProc(void) __ptr64+0x49D (configdb.obj) 0008179E Far.exe!os::concurrency::thread::wrapper(void (__cdecl `anonymous namespace'::HistoryConfigCustom::*&& __ptr64)(void) __ptr64,class A0x6002ce20::HistoryConfigCustom * __ptr64 const && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x2E (configdb.obj) 0035CE02 Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj) 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000002 RCX = 0000000000000002 RDX = 0000009C6A4FFAE8 RSI = 0000000000000000 RDI = 0000000000000002 R8 = 000002872784BE60 R9 = 0000000000000001 R10 = 0000000000024A2E R11 = 0000028727843000 R12 = 00000000FFFFFFFF R13 = 0000009C6A4FFAE8 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFD0CB6E0B4 RSP = 0000009C6A4FF5F8 RBP = 0000009C6A4FFB60 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- 0009E0B4 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffd`0cb6e091 fb sti 00007ffd`0cb6e092 8efd mov st(-1),bp 00007ffd`0cb6e094 ff6666 jmp qword ptr [rsi+66h] 00007ffd`0cb6e097 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffd`0cb6e0a0 4c8bd1 mov r10,rcx 00007ffd`0cb6e0a3 b85b000000 mov eax,5Bh 00007ffd`0cb6e0a8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffd`0cb6e0b0 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffd`0cb6e0b5) 00007ffd`0cb6e0b2 0f05 syscall 00007ffd`0cb6e0b4 c3 ret 00064030 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0: 00007ffd`0a684007 4c8d742450 lea r14,[rsp+50h] 00007ffd`0a68400c 448b7c2444 mov r15d,dword ptr [rsp+44h] 00007ffd`0a684011 4533c0 xor r8d,r8d 00007ffd`0a684014 4585ff test r15d,r15d 00007ffd`0a684017 410f94c0 sete r8b 00007ffd`0a68401b 4c89742420 mov qword ptr [rsp+20h],r14 00007ffd`0a684020 440fb6ce movzx r9d,sil 00007ffd`0a684024 498bd5 mov rdx,r13 00007ffd`0a684027 8bcb mov ecx,ebx 00007ffd`0a684029 48ff1560641800 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb7220 (00007ffd`0a80a490)] 00007ffd`0a684030 0f1f440000 nop dword ptr [rax+rax] 00063F2E KERNELBASE.dll!WaitForMultipleObjects+0xE: 00007ffd`0a683f1a cc int 3 00007ffd`0a683f1b cc int 3 00007ffd`0a683f1c cc int 3 00007ffd`0a683f1d cc int 3 00007ffd`0a683f1e cc int 3 00007ffd`0a683f1f cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffd`0a683f20 4883ec38 sub rsp,38h 00007ffd`0a683f24 8364242000 and dword ptr [rsp+20h],0 00007ffd`0a683f29 e812000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffd`0a683f40) 00007ffd`0a683f2e 4883c438 add rsp,38h 00250EC3 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj): 00007ff6`56d60e92 4881ec20010000 sub rsp,120h 00007ff6`56d60e99 488b05a0a32000 mov rax,qword ptr [Far+0x45b240 (00007ff6`56f6b240)] 00007ff6`56d60ea0 4833c4 xor rax,rsp 00007ff6`56d60ea3 4889842410010000 mov qword ptr [rsp+110h],rax 00007ff6`56d60eab 488b5908 mov rbx,qword ptr [rcx+8] 00007ff6`56d60eaf 41b9ffffffff mov r9d,0FFFFFFFFh 00007ff6`56d60eb5 4533c0 xor r8d,r8d 00007ff6`56d60eb8 488b11 mov rdx,qword ptr [rcx] 00007ff6`56d60ebb 8bcb mov ecx,ebx 00007ff6`56d60ebd ff1575941500 call qword ptr [Far+0x3aa338 (00007ff6`56eba338)] 00007ff6`56d60ec3 8bc8 mov ecx,eax 000756DD Far.exe!`anonymous namespace'::HistoryConfigCustom::ThreadProc(void) __ptr64+0x49D (configdb.obj): 00007ff6`56b856ac 48894588 mov qword ptr [rbp-78h],rax 00007ff6`56b856b0 488b8788000000 mov rax,qword ptr [rdi+88h] 00007ff6`56b856b7 48894590 mov qword ptr [rbp-70h],rax 00007ff6`56b856bb 488d4588 lea rax,[rbp-78h] 00007ff6`56b856bf 488945a0 mov qword ptr [rbp-60h],rax 00007ff6`56b856c3 48c745a802000000 mov qword ptr [rbp-58h],2 00007ff6`56b856cb 0f2845a0 movaps xmm0,xmmword ptr [rbp-60h] 00007ff6`56b856cf 660f7f45b0 movdqa xmmword ptr [rbp-50h],xmm0 00007ff6`56b856d4 488d4db0 lea rcx,[rbp-50h] 00007ff6`56b856d8 e8b3b71d00 call Far+0x250e90 (00007ff6`56d60e90) 00007ff6`56b856dd 4883f801 cmp rax,1 0008179E Far.exe!os::concurrency::thread::wrapper(void (__cdecl `anonymous namespace'::HistoryConfigCustom::*&& __ptr64)(void) __ptr64,class A0x6002ce20::HistoryConfigCustom * __ptr64 const && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x2E (configdb.obj): 00007ff6`56b91779 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`56b9177e 4c8b4910 mov r9,qword ptr [rcx+10h] 00007ff6`56b91782 4863510c movsxd rdx,dword ptr [rcx+0Ch] 00007ff6`56b91786 498b4108 mov rax,qword ptr [r9+8] 00007ff6`56b9178a 48630c02 movsxd rcx,dword ptr [rdx+rax] 00007ff6`56b9178e 48635308 movsxd rdx,dword ptr [rbx+8] 00007ff6`56b91792 4903c9 add rcx,r9 00007ff6`56b91795 4883c208 add rdx,8 00007ff6`56b91799 4803ca add rcx,rdx 00007ff6`56b9179c ff13 call qword ptr [rbx] 00007ff6`56b9179e 90 nop 0035CE02 Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj): 00007ff6`56e6cdd9 7510 jne Far+0x35cdeb (00007ff6`56e6cdeb) 00007ff6`56e6cddb 8d48ff lea ecx,[rax-1] 00007ff6`56e6cdde e8cd210100 call Far+0x36efb0 (00007ff6`56e7efb0) 00007ff6`56e6cde3 85c0 test eax,eax 00007ff6`56e6cde5 0f94c0 sete al 00007ff6`56e6cde8 884320 mov byte ptr [rbx+20h],al 00007ff6`56e6cdeb 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`56e6cdf5 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`56e6cdf9 488b03 mov rax,qword ptr [rbx] 00007ff6`56e6cdfc ff152ee00400 call qword ptr [Far+0x3aae30 (00007ff6`56ebae30)] 00007ff6`56e6ce02 8bc8 mov ecx,eax 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffd`0b63735d cc int 3 00007ffd`0b63735e cc int 3 00007ffd`0b63735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffd`0b637360 4883ec28 sub rsp,28h 00007ffd`0b637364 85c9 test ecx,ecx 00007ffd`0b637366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffd`0b637383) 00007ffd`0b637368 498bc8 mov rcx,r8 00007ffd`0b63736b 488bc2 mov rax,rdx 00007ffd`0b63736e ff15d4f00600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13a88 (00007ffd`0b6a6448)] 00007ffd`0b637374 8bc8 mov ecx,eax 0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffd`0cb1cc72 ec in al,dx 00007ffd`0cb1cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffd`0cb1ccc1) 00007ffd`0cb1cc75 8bc9 mov ecx,ecx 00007ffd`0cb1cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffd`0cc3bff0)] 00007ffd`0cb1cc7e 4885c0 test rax,rax 00007ffd`0cb1cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffd`0cb1cc93) 00007ffd`0cb1cc83 4c8bc2 mov r8,rdx 00007ffd`0cb1cc86 488bd1 mov rdx,rcx 00007ffd`0cb1cc89 33c9 xor ecx,ecx 00007ffd`0cb1cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffd`0cc55000)] 00007ffd`0cb1cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffd`0cb1ccb3) ====================================================================== Thread 24960 / 0x6180 (NetBox FTP Main Thread) ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC00000A3 - {Устройство не готово} Устройство не готово; возможно, открыта дверца. Проверьте наличие диска в устройстве %hs, а также положение дверцы устройства. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- 00001104 win32u.dll!NtUserGetMessage+0x14 0002210E USER32.dll!GetMessageW+0x2E 0014C6F8 NetBox.dll!CMainThread::Run(void) __ptr64+0x1D8 (MainThread.cpp.obj) 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000001006 RBX = 0000009C6A5FFA90 RCX = 0000009C6A5FFA90 RDX = 0000000000000000 RSI = 0000000000000000 RDI = 0000028723DE1170 R8 = 0000009C6A5FF5D8 R9 = 0000000000000001 R10 = 0000000000000000 R11 = 0000000000000246 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFD0A5F1104 RSP = 0000009C6A5FFA08 RBP = 0000028723DE1170 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- 00001104 win32u.dll!NtUserGetMessage+0x14: 00007ffd`0a5f10e4 c3 ret 00007ffd`0a5f10e5 cd2e int 2Eh 00007ffd`0a5f10e7 c3 ret 00007ffd`0a5f10e8 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserGetMessage: 00007ffd`0a5f10f0 4c8bd1 mov r10,rcx 00007ffd`0a5f10f3 b806100000 mov eax,1006h 00007ffd`0a5f10f8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffd`0a5f1100 7503 jne win32u!NtUserGetMessage+0x15 (00007ffd`0a5f1105) 00007ffd`0a5f1102 0f05 syscall 00007ffd`0a5f1104 c3 ret 0002210E USER32.dll!GetMessageW+0x2E: 00007ffd`0c8620e2 4883ec50 sub rsp,50h 00007ffd`0c8620e6 418bc1 mov eax,r9d 00007ffd`0c8620e9 488bd9 mov rbx,rcx 00007ffd`0c8620ec 458bc8 mov r9d,r8d 00007ffd`0c8620ef 440bc8 or r9d,eax 00007ffd`0c8620f2 41f7c10000feff test r9d,0FFFE0000h 00007ffd`0c8620f9 0f85b11d0200 jne USER32!SetWindowsHookExAW+0xd980 (00007ffd`0c883eb0) 00007ffd`0c8620ff 448bc8 mov r9d,eax 00007ffd`0c862102 48897c2460 mov qword ptr [rsp+60h],rdi 00007ffd`0c862107 48ff1502ea0600 call qword ptr [USER32!gapfnScSendMessage+0x11b0 (00007ffd`0c8d0b10)] 00007ffd`0c86210e 0f1f440000 nop dword ptr [rax+rax] 0014C6F8 NetBox.dll!CMainThread::Run(void) __ptr64+0x1D8 (MainThread.cpp.obj): 00007ffc`be33c6d0 8b542428 mov edx,dword ptr [rsp+28h] 00007ffc`be33c6d4 488bcb mov rcx,rbx 00007ffc`be33c6d7 ff5008 call qword ptr [rax+8] 00007ffc`be33c6da 488d4c2420 lea rcx,[rsp+20h] 00007ffc`be33c6df ff15c3614800 call qword ptr [NetBox!OpenW+0x473b18 (00007ffc`be7c28a8)] 00007ffc`be33c6e5 4533c9 xor r9d,r9d 00007ffc`be33c6e8 4533c0 xor r8d,r8d 00007ffc`be33c6eb 33d2 xor edx,edx 00007ffc`be33c6ed 488d4c2420 lea rcx,[rsp+20h] 00007ffc`be33c6f2 ff15a8614800 call qword ptr [NetBox!OpenW+0x473b10 (00007ffc`be7c28a0)] 00007ffc`be33c6f8 85c0 test eax,eax 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffd`0b63735d cc int 3 00007ffd`0b63735e cc int 3 00007ffd`0b63735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffd`0b637360 4883ec28 sub rsp,28h 00007ffd`0b637364 85c9 test ecx,ecx 00007ffd`0b637366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffd`0b637383) 00007ffd`0b637368 498bc8 mov rcx,r8 00007ffd`0b63736b 488bc2 mov rax,rdx 00007ffd`0b63736e ff15d4f00600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13a88 (00007ffd`0b6a6448)] 00007ffd`0b637374 8bc8 mov ecx,eax 0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffd`0cb1cc72 ec in al,dx 00007ffd`0cb1cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffd`0cb1ccc1) 00007ffd`0cb1cc75 8bc9 mov ecx,ecx 00007ffd`0cb1cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffd`0cc3bff0)] 00007ffd`0cb1cc7e 4885c0 test rax,rax 00007ffd`0cb1cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffd`0cb1cc93) 00007ffd`0cb1cc83 4c8bc2 mov r8,rdx 00007ffd`0cb1cc86 488bd1 mov rdx,rcx 00007ffd`0cb1cc89 33c9 xor ecx,ecx 00007ffd`0cb1cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffd`0cc55000)] 00007ffd`0cb1cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffd`0cb1ccb3) ====================================================================== Thread 25064 / 0x61E8 ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- 0009D684 ntdll.dll!NtRemoveIoCompletion+0x14 000010AB mswsock.dll! (get the pdb) 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000000009 RBX = 0000000000000000 RCX = 00000000000004D8 RDX = 0000009C6A6FF7A0 RSI = 0000000000000001 RDI = 00007FFD09520000 R8 = 0000009C6A6FF770 R9 = 000002872765D5D0 R10 = 0000000000000000 R11 = 0000000000000246 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFD0CB6D684 RSP = 0000009C6A6FF738 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- 0009D684 ntdll.dll!NtRemoveIoCompletion+0x14: 00007ffd`0cb6d664 c3 ret 00007ffd`0cb6d665 cd2e int 2Eh 00007ffd`0cb6d667 c3 ret 00007ffd`0cb6d668 0f1f840000000000 nop dword ptr [rax+rax] ntdll!NtRemoveIoCompletion: 00007ffd`0cb6d670 4c8bd1 mov r10,rcx 00007ffd`0cb6d673 b809000000 mov eax,9 00007ffd`0cb6d678 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffd`0cb6d680 7503 jne ntdll!NtRemoveIoCompletion+0x15 (00007ffd`0cb6d685) 00007ffd`0cb6d682 0f05 syscall 00007ffd`0cb6d684 c3 ret 000010AB mswsock.dll! (get the pdb): 00007ffd`09521073 0f1f440000 nop dword ptr [rax+rax] 00007ffd`09521078 3935a22a0600 cmp dword ptr [mswsock!Tcpip6_WSHOpenSocket+0x2e4e0 (00007ffd`09583b20)],esi 00007ffd`0952107e 488d059b4b0500 lea rax,[mswsock!Tcpip6_WSHOpenSocket+0x205e0 (00007ffd`09575c20)] 00007ffd`09521085 488b0dec290600 mov rcx,qword ptr [mswsock!Tcpip6_WSHOpenSocket+0x2e438 (00007ffd`09583a78)] 00007ffd`0952108c 4c8d4c2430 lea r9,[rsp+30h] 00007ffd`09521091 490f4fc6 cmovg rax,r14 00007ffd`09521095 4c8d442468 lea r8,[rsp+68h] 00007ffd`0952109a 488d542460 lea rdx,[rsp+60h] 00007ffd`0952109f 4889442420 mov qword ptr [rsp+20h],rax 00007ffd`095210a4 48ff1595370500 call qword ptr [mswsock!Tcpip6_WSHOpenSocket+0x1f200 (00007ffd`09574840)] 00007ffd`095210ab 0f1f440000 nop dword ptr [rax+rax] 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffd`0b63735d cc int 3 00007ffd`0b63735e cc int 3 00007ffd`0b63735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffd`0b637360 4883ec28 sub rsp,28h 00007ffd`0b637364 85c9 test ecx,ecx 00007ffd`0b637366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffd`0b637383) 00007ffd`0b637368 498bc8 mov rcx,r8 00007ffd`0b63736b 488bc2 mov rax,rdx 00007ffd`0b63736e ff15d4f00600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13a88 (00007ffd`0b6a6448)] 00007ffd`0b637374 8bc8 mov ecx,eax 0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffd`0cb1cc72 ec in al,dx 00007ffd`0cb1cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffd`0cb1ccc1) 00007ffd`0cb1cc75 8bc9 mov ecx,ecx 00007ffd`0cb1cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffd`0cc3bff0)] 00007ffd`0cb1cc7e 4885c0 test rax,rax 00007ffd`0cb1cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffd`0cb1cc93) 00007ffd`0cb1cc83 4c8bc2 mov r8,rdx 00007ffd`0cb1cc86 488bd1 mov rdx,rcx 00007ffd`0cb1cc89 33c9 xor ecx,ecx 00007ffd`0cb1cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffd`0cc55000)] 00007ffd`0cb1cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffd`0cb1ccb3) ====================================================================== Thread 26104 / 0x65F8 (NetBox FTP Main Thread) ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC00000A3 - {Устройство не готово} Устройство не готово; возможно, открыта дверца. Проверьте наличие диска в устройстве %hs, а также положение дверцы устройства. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- 00001104 win32u.dll!NtUserGetMessage+0x14 0002210E USER32.dll!GetMessageW+0x2E 0014C6F8 NetBox.dll!CMainThread::Run(void) __ptr64+0x1D8 (MainThread.cpp.obj) 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000001006 RBX = 0000009C69DFF790 RCX = 0000009C69DFF790 RDX = 0000000000000000 RSI = 0000000000000000 RDI = 0000028723DF4F50 R8 = 0000009C69DFF708 R9 = 0000028723DF4F50 R10 = 0000000000000000 R11 = 0000000000000246 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFD0A5F1104 RSP = 0000009C69DFF708 RBP = 0000028723DF4F50 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- 00001104 win32u.dll!NtUserGetMessage+0x14: 00007ffd`0a5f10e4 c3 ret 00007ffd`0a5f10e5 cd2e int 2Eh 00007ffd`0a5f10e7 c3 ret 00007ffd`0a5f10e8 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserGetMessage: 00007ffd`0a5f10f0 4c8bd1 mov r10,rcx 00007ffd`0a5f10f3 b806100000 mov eax,1006h 00007ffd`0a5f10f8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffd`0a5f1100 7503 jne win32u!NtUserGetMessage+0x15 (00007ffd`0a5f1105) 00007ffd`0a5f1102 0f05 syscall 00007ffd`0a5f1104 c3 ret 0002210E USER32.dll!GetMessageW+0x2E: 00007ffd`0c8620e2 4883ec50 sub rsp,50h 00007ffd`0c8620e6 418bc1 mov eax,r9d 00007ffd`0c8620e9 488bd9 mov rbx,rcx 00007ffd`0c8620ec 458bc8 mov r9d,r8d 00007ffd`0c8620ef 440bc8 or r9d,eax 00007ffd`0c8620f2 41f7c10000feff test r9d,0FFFE0000h 00007ffd`0c8620f9 0f85b11d0200 jne USER32!SetWindowsHookExAW+0xd980 (00007ffd`0c883eb0) 00007ffd`0c8620ff 448bc8 mov r9d,eax 00007ffd`0c862102 48897c2460 mov qword ptr [rsp+60h],rdi 00007ffd`0c862107 48ff1502ea0600 call qword ptr [USER32!gapfnScSendMessage+0x11b0 (00007ffd`0c8d0b10)] 00007ffd`0c86210e 0f1f440000 nop dword ptr [rax+rax] 0014C6F8 NetBox.dll!CMainThread::Run(void) __ptr64+0x1D8 (MainThread.cpp.obj): 00007ffc`be33c6d0 8b542428 mov edx,dword ptr [rsp+28h] 00007ffc`be33c6d4 488bcb mov rcx,rbx 00007ffc`be33c6d7 ff5008 call qword ptr [rax+8] 00007ffc`be33c6da 488d4c2420 lea rcx,[rsp+20h] 00007ffc`be33c6df ff15c3614800 call qword ptr [NetBox!OpenW+0x473b18 (00007ffc`be7c28a8)] 00007ffc`be33c6e5 4533c9 xor r9d,r9d 00007ffc`be33c6e8 4533c0 xor r8d,r8d 00007ffc`be33c6eb 33d2 xor edx,edx 00007ffc`be33c6ed 488d4c2420 lea rcx,[rsp+20h] 00007ffc`be33c6f2 ff15a8614800 call qword ptr [NetBox!OpenW+0x473b10 (00007ffc`be7c28a0)] 00007ffc`be33c6f8 85c0 test eax,eax 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffd`0b63735d cc int 3 00007ffd`0b63735e cc int 3 00007ffd`0b63735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffd`0b637360 4883ec28 sub rsp,28h 00007ffd`0b637364 85c9 test ecx,ecx 00007ffd`0b637366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffd`0b637383) 00007ffd`0b637368 498bc8 mov rcx,r8 00007ffd`0b63736b 488bc2 mov rax,rdx 00007ffd`0b63736e ff15d4f00600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13a88 (00007ffd`0b6a6448)] 00007ffd`0b637374 8bc8 mov ecx,eax 0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffd`0cb1cc72 ec in al,dx 00007ffd`0cb1cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffd`0cb1ccc1) 00007ffd`0cb1cc75 8bc9 mov ecx,ecx 00007ffd`0cb1cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffd`0cc3bff0)] 00007ffd`0cb1cc7e 4885c0 test rax,rax 00007ffd`0cb1cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffd`0cb1cc93) 00007ffd`0cb1cc83 4c8bc2 mov r8,rdx 00007ffd`0cb1cc86 488bd1 mov rdx,rcx 00007ffd`0cb1cc89 33c9 xor ecx,ecx 00007ffd`0cb1cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffd`0cc55000)] 00007ffd`0cb1cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffd`0cb1ccb3) ====================================================================== Thread 11476 / 0x2CD4 ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- 000A0FF4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 00000287275FE920 RCX = 0000000000000014 RDX = 00000287275FE5A0 RSI = 0000028720E02340 RDI = 00000287275FE920 R8 = 0000009C69AFF958 R9 = 00000287275F52C0 R10 = 0000000000000000 R11 = 0000000000000246 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFD0CB70FF4 RSP = 0000009C69AFFAC8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- 000A0FF4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffd`0cb70fd4 c3 ret 00007ffd`0cb70fd5 cd2e int 2Eh 00007ffd`0cb70fd7 c3 ret 00007ffd`0cb70fd8 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffd`0cb70fe0 4c8bd1 mov r10,rcx 00007ffd`0cb70fe3 b8d5010000 mov eax,1D5h 00007ffd`0cb70fe8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffd`0cb70ff0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffd`0cb70ff5) 00007ffd`0cb70ff2 0f05 syscall 00007ffd`0cb70ff4 c3 ret 0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffd`0cb1d3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffd`0cb1d3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffd`0cb1d3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffd`0cb1d3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffd`0cb1d3e6 488d842448020000 lea rax,[rsp+248h] 00007ffd`0cb1d3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffd`0cb1d3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffd`0cb1d3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffd`0cb1d3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffd`0cb1d402 e8d93b0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffd`0cb70fe0) 00007ffd`0cb1d407 8bc8 mov ecx,eax 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffd`0b63735d cc int 3 00007ffd`0b63735e cc int 3 00007ffd`0b63735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffd`0b637360 4883ec28 sub rsp,28h 00007ffd`0b637364 85c9 test ecx,ecx 00007ffd`0b637366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffd`0b637383) 00007ffd`0b637368 498bc8 mov rcx,r8 00007ffd`0b63736b 488bc2 mov rax,rdx 00007ffd`0b63736e ff15d4f00600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13a88 (00007ffd`0b6a6448)] 00007ffd`0b637374 8bc8 mov ecx,eax 0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffd`0cb1cc72 ec in al,dx 00007ffd`0cb1cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffd`0cb1ccc1) 00007ffd`0cb1cc75 8bc9 mov ecx,ecx 00007ffd`0cb1cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffd`0cc3bff0)] 00007ffd`0cb1cc7e 4885c0 test rax,rax 00007ffd`0cb1cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffd`0cb1cc93) 00007ffd`0cb1cc83 4c8bc2 mov r8,rdx 00007ffd`0cb1cc86 488bd1 mov rdx,rcx 00007ffd`0cb1cc89 33c9 xor ecx,ecx 00007ffd`0cb1cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffd`0cc55000)] 00007ffd`0cb1cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffd`0cb1ccb3) ====================================================================== Thread 8492 / 0x212C ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0x00000000 - STATUS_SUCCESS ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- 000A0FF4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 00000287275FD3C0 RCX = 0000000000000088 RDX = 00000287275FD040 RSI = 0000028720E079D0 RDI = 00000287275FD3C0 R8 = 00000000000000F0 R9 = 0000009C699FF250 R10 = 00007FFD042600F0 R11 = 0000000000000001 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFD0CB70FF4 RSP = 0000009C699FF7A8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- 000A0FF4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffd`0cb70fd4 c3 ret 00007ffd`0cb70fd5 cd2e int 2Eh 00007ffd`0cb70fd7 c3 ret 00007ffd`0cb70fd8 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffd`0cb70fe0 4c8bd1 mov r10,rcx 00007ffd`0cb70fe3 b8d5010000 mov eax,1D5h 00007ffd`0cb70fe8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffd`0cb70ff0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffd`0cb70ff5) 00007ffd`0cb70ff2 0f05 syscall 00007ffd`0cb70ff4 c3 ret 0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffd`0cb1d3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffd`0cb1d3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffd`0cb1d3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffd`0cb1d3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffd`0cb1d3e6 488d842448020000 lea rax,[rsp+248h] 00007ffd`0cb1d3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffd`0cb1d3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffd`0cb1d3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffd`0cb1d3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffd`0cb1d402 e8d93b0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffd`0cb70fe0) 00007ffd`0cb1d407 8bc8 mov ecx,eax 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffd`0b63735d cc int 3 00007ffd`0b63735e cc int 3 00007ffd`0b63735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffd`0b637360 4883ec28 sub rsp,28h 00007ffd`0b637364 85c9 test ecx,ecx 00007ffd`0b637366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffd`0b637383) 00007ffd`0b637368 498bc8 mov rcx,r8 00007ffd`0b63736b 488bc2 mov rax,rdx 00007ffd`0b63736e ff15d4f00600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13a88 (00007ffd`0b6a6448)] 00007ffd`0b637374 8bc8 mov ecx,eax 0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffd`0cb1cc72 ec in al,dx 00007ffd`0cb1cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffd`0cb1ccc1) 00007ffd`0cb1cc75 8bc9 mov ecx,ecx 00007ffd`0cb1cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffd`0cc3bff0)] 00007ffd`0cb1cc7e 4885c0 test rax,rax 00007ffd`0cb1cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffd`0cb1cc93) 00007ffd`0cb1cc83 4c8bc2 mov r8,rdx 00007ffd`0cb1cc86 488bd1 mov rdx,rcx 00007ffd`0cb1cc89 33c9 xor ecx,ecx 00007ffd`0cb1cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffd`0cc55000)] 00007ffd`0cb1cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffd`0cb1ccb3) ====================================================================== Thread 16584 / 0x40C8 ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0x00000000 - STATUS_SUCCESS ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- 000A0FF4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 0000028729557210 RCX = 0000000000000088 RDX = 0000028729556E90 RSI = 0000028720E079D0 RDI = 0000028729557210 R8 = 0000000000000008 R9 = 000000000000000A R10 = 0000000000000000 R11 = 00000000FFFFFFFF R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFD0CB70FF4 RSP = 0000009C69BFF558 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- 000A0FF4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffd`0cb70fd4 c3 ret 00007ffd`0cb70fd5 cd2e int 2Eh 00007ffd`0cb70fd7 c3 ret 00007ffd`0cb70fd8 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffd`0cb70fe0 4c8bd1 mov r10,rcx 00007ffd`0cb70fe3 b8d5010000 mov eax,1D5h 00007ffd`0cb70fe8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffd`0cb70ff0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffd`0cb70ff5) 00007ffd`0cb70ff2 0f05 syscall 00007ffd`0cb70ff4 c3 ret 0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffd`0cb1d3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffd`0cb1d3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffd`0cb1d3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffd`0cb1d3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffd`0cb1d3e6 488d842448020000 lea rax,[rsp+248h] 00007ffd`0cb1d3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffd`0cb1d3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffd`0cb1d3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffd`0cb1d3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffd`0cb1d402 e8d93b0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffd`0cb70fe0) 00007ffd`0cb1d407 8bc8 mov ecx,eax 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffd`0b63735d cc int 3 00007ffd`0b63735e cc int 3 00007ffd`0b63735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffd`0b637360 4883ec28 sub rsp,28h 00007ffd`0b637364 85c9 test ecx,ecx 00007ffd`0b637366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffd`0b637383) 00007ffd`0b637368 498bc8 mov rcx,r8 00007ffd`0b63736b 488bc2 mov rax,rdx 00007ffd`0b63736e ff15d4f00600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13a88 (00007ffd`0b6a6448)] 00007ffd`0b637374 8bc8 mov ecx,eax 0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffd`0cb1cc72 ec in al,dx 00007ffd`0cb1cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffd`0cb1ccc1) 00007ffd`0cb1cc75 8bc9 mov ecx,ecx 00007ffd`0cb1cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffd`0cc3bff0)] 00007ffd`0cb1cc7e 4885c0 test rax,rax 00007ffd`0cb1cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffd`0cb1cc93) 00007ffd`0cb1cc83 4c8bc2 mov r8,rdx 00007ffd`0cb1cc86 488bd1 mov rdx,rcx 00007ffd`0cb1cc89 33c9 xor ecx,ecx 00007ffd`0cb1cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffd`0cc55000)] 00007ffd`0cb1cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffd`0cb1ccb3) ====================================================================== Thread 10116 / 0x2784 ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0x00000000 - STATUS_SUCCESS ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- 000A0FF4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 0000028729555590 RCX = 0000000000000088 RDX = 0000028729555210 RSI = 0000028720E079D0 RDI = 0000028729555590 R8 = 0000000000000390 R9 = 0101010101010101 R10 = 00000000000000FF R11 = 0000000000001000 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFD0CB70FF4 RSP = 0000009C69FFF498 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- 000A0FF4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffd`0cb70fd4 c3 ret 00007ffd`0cb70fd5 cd2e int 2Eh 00007ffd`0cb70fd7 c3 ret 00007ffd`0cb70fd8 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffd`0cb70fe0 4c8bd1 mov r10,rcx 00007ffd`0cb70fe3 b8d5010000 mov eax,1D5h 00007ffd`0cb70fe8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffd`0cb70ff0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffd`0cb70ff5) 00007ffd`0cb70ff2 0f05 syscall 00007ffd`0cb70ff4 c3 ret 0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffd`0cb1d3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffd`0cb1d3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffd`0cb1d3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffd`0cb1d3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffd`0cb1d3e6 488d842448020000 lea rax,[rsp+248h] 00007ffd`0cb1d3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffd`0cb1d3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffd`0cb1d3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffd`0cb1d3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffd`0cb1d402 e8d93b0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffd`0cb70fe0) 00007ffd`0cb1d407 8bc8 mov ecx,eax 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffd`0b63735d cc int 3 00007ffd`0b63735e cc int 3 00007ffd`0b63735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffd`0b637360 4883ec28 sub rsp,28h 00007ffd`0b637364 85c9 test ecx,ecx 00007ffd`0b637366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffd`0b637383) 00007ffd`0b637368 498bc8 mov rcx,r8 00007ffd`0b63736b 488bc2 mov rax,rdx 00007ffd`0b63736e ff15d4f00600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13a88 (00007ffd`0b6a6448)] 00007ffd`0b637374 8bc8 mov ecx,eax 0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffd`0cb1cc72 ec in al,dx 00007ffd`0cb1cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffd`0cb1ccc1) 00007ffd`0cb1cc75 8bc9 mov ecx,ecx 00007ffd`0cb1cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffd`0cc3bff0)] 00007ffd`0cb1cc7e 4885c0 test rax,rax 00007ffd`0cb1cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffd`0cb1cc93) 00007ffd`0cb1cc83 4c8bc2 mov r8,rdx 00007ffd`0cb1cc86 488bd1 mov rdx,rcx 00007ffd`0cb1cc89 33c9 xor ecx,ecx 00007ffd`0cb1cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffd`0cc55000)] 00007ffd`0cb1cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffd`0cb1ccb3) ====================================================================== Thread 13112 / 0x3338 ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- 000A0FF4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 0000000000000000 RCX = 000000000000056C RDX = 0000028729556050 RSI = 00000287291CFF40 RDI = 0000000000000000 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 0000000000000000 R11 = 0000000000000000 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFD0CB70FF4 RSP = 0000009C6A0FF5B8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- 000A0FF4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffd`0cb70fd4 c3 ret 00007ffd`0cb70fd5 cd2e int 2Eh 00007ffd`0cb70fd7 c3 ret 00007ffd`0cb70fd8 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffd`0cb70fe0 4c8bd1 mov r10,rcx 00007ffd`0cb70fe3 b8d5010000 mov eax,1D5h 00007ffd`0cb70fe8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffd`0cb70ff0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffd`0cb70ff5) 00007ffd`0cb70ff2 0f05 syscall 00007ffd`0cb70ff4 c3 ret 0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffd`0cb1d3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffd`0cb1d3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffd`0cb1d3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffd`0cb1d3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffd`0cb1d3e6 488d842448020000 lea rax,[rsp+248h] 00007ffd`0cb1d3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffd`0cb1d3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffd`0cb1d3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffd`0cb1d3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffd`0cb1d402 e8d93b0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffd`0cb70fe0) 00007ffd`0cb1d407 8bc8 mov ecx,eax 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffd`0b63735d cc int 3 00007ffd`0b63735e cc int 3 00007ffd`0b63735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffd`0b637360 4883ec28 sub rsp,28h 00007ffd`0b637364 85c9 test ecx,ecx 00007ffd`0b637366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffd`0b637383) 00007ffd`0b637368 498bc8 mov rcx,r8 00007ffd`0b63736b 488bc2 mov rax,rdx 00007ffd`0b63736e ff15d4f00600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13a88 (00007ffd`0b6a6448)] 00007ffd`0b637374 8bc8 mov ecx,eax 0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffd`0cb1cc72 ec in al,dx 00007ffd`0cb1cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffd`0cb1ccc1) 00007ffd`0cb1cc75 8bc9 mov ecx,ecx 00007ffd`0cb1cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffd`0cc3bff0)] 00007ffd`0cb1cc7e 4885c0 test rax,rax 00007ffd`0cb1cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffd`0cb1cc93) 00007ffd`0cb1cc83 4c8bc2 mov r8,rdx 00007ffd`0cb1cc86 488bd1 mov rdx,rcx 00007ffd`0cb1cc89 33c9 xor ecx,ecx 00007ffd`0cb1cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffd`0cc55000)] 00007ffd`0cb1cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffd`0cb1ccb3) ====================================================================== Thread 24380 / 0x5F3C ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- 0009E0B4 ntdll.dll!NtWaitForMultipleObjects+0x14 00064030 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0 0004B087 CRYPT32.dll!CertFreeCRLContext+0x697 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000001 RCX = 0000000000000001 RDX = 00000287298A35E0 RSI = 0000000000000000 RDI = 0000000000000001 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 0000000000000000 R11 = 0000000000000000 R12 = 0000000000003A98 R13 = 00000287298A35E0 R14 = 0000009C6A1FF890 R15 = 0000000000000000 RIP = 00007FFD0CB6E0B4 RSP = 0000009C6A1FF838 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- 0009E0B4 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffd`0cb6e091 fb sti 00007ffd`0cb6e092 8efd mov st(-1),bp 00007ffd`0cb6e094 ff6666 jmp qword ptr [rsi+66h] 00007ffd`0cb6e097 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffd`0cb6e0a0 4c8bd1 mov r10,rcx 00007ffd`0cb6e0a3 b85b000000 mov eax,5Bh 00007ffd`0cb6e0a8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffd`0cb6e0b0 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffd`0cb6e0b5) 00007ffd`0cb6e0b2 0f05 syscall 00007ffd`0cb6e0b4 c3 ret 00064030 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0: 00007ffd`0a684007 4c8d742450 lea r14,[rsp+50h] 00007ffd`0a68400c 448b7c2444 mov r15d,dword ptr [rsp+44h] 00007ffd`0a684011 4533c0 xor r8d,r8d 00007ffd`0a684014 4585ff test r15d,r15d 00007ffd`0a684017 410f94c0 sete r8b 00007ffd`0a68401b 4c89742420 mov qword ptr [rsp+20h],r14 00007ffd`0a684020 440fb6ce movzx r9d,sil 00007ffd`0a684024 498bd5 mov rdx,r13 00007ffd`0a684027 8bcb mov ecx,ebx 00007ffd`0a684029 48ff1560641800 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb7220 (00007ffd`0a80a490)] 00007ffd`0a684030 0f1f440000 nop dword ptr [rax+rax] 0004B087 CRYPT32.dll!CertFreeCRLContext+0x697: 00007ffd`0a25b063 488bd9 mov rbx,rcx 00007ffd`0a25b066 48f7d8 neg rax 00007ffd`0a25b069 1bff sbb edi,edi 00007ffd`0a25b06b f7df neg edi 00007ffd`0a25b06d 448b4b30 mov r9d,dword ptr [rbx+30h] 00007ffd`0a25b071 488d5310 lea rdx,[rbx+10h] 00007ffd`0a25b075 8364242000 and dword ptr [rsp+20h],0 00007ffd`0a25b07a 8d4f01 lea ecx,[rdi+1] 00007ffd`0a25b07d 4533c0 xor r8d,r8d 00007ffd`0a25b080 48ff1521e60c00 call qword ptr [CRYPT32!CryptMsgSignCTL+0x1eec8 (00007ffd`0a3296a8)] 00007ffd`0a25b087 0f1f440000 nop dword ptr [rax+rax] 00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffd`0b63735d cc int 3 00007ffd`0b63735e cc int 3 00007ffd`0b63735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffd`0b637360 4883ec28 sub rsp,28h 00007ffd`0b637364 85c9 test ecx,ecx 00007ffd`0b637366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffd`0b637383) 00007ffd`0b637368 498bc8 mov rcx,r8 00007ffd`0b63736b 488bc2 mov rax,rdx 00007ffd`0b63736e ff15d4f00600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13a88 (00007ffd`0b6a6448)] 00007ffd`0b637374 8bc8 mov ecx,eax 0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffd`0cb1cc72 ec in al,dx 00007ffd`0cb1cc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffd`0cb1ccc1) 00007ffd`0cb1cc75 8bc9 mov ecx,ecx 00007ffd`0cb1cc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffd`0cc3bff0)] 00007ffd`0cb1cc7e 4885c0 test rax,rax 00007ffd`0cb1cc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffd`0cb1cc93) 00007ffd`0cb1cc83 4c8bc2 mov r8,rdx 00007ffd`0cb1cc86 488bd1 mov rdx,rcx 00007ffd`0cb1cc89 33c9 xor ecx,ecx 00007ffd`0cb1cc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffd`0cc55000)] 00007ffd`0cb1cc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffd`0cb1ccb3) ====================================================================== Modules ====================================================================== 0x00007FF656B10000 | C:\Program Files\Far Manager\Far.exe | File and archive manager | 3.0.6370.0 x64 0x00007FFD0CAD0000 | C:\WINDOWS\SYSTEM32\ntdll.dll | Системная библиотека NT | 10.0.19041.4842 (WinBuild.160101.0800) 0x00007FFD0B620000 | C:\WINDOWS\System32\KERNEL32.DLL | Библиотека клиента Windows NT BASE API | 10.0.19041.4842 (WinBuild.160101.0800) 0x00007FFD0A620000 | C:\WINDOWS\System32\KERNELBASE.dll | Библиотека клиента Windows NT BASE API | 10.0.19041.4842 (WinBuild.160101.0800) 0x00007FFD0B8A0000 | C:\WINDOWS\System32\ADVAPI32.dll | Расширенная библиотека API Windows 32 | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD0C540000 | C:\WINDOWS\System32\msvcrt.dll | Windows NT CRT DLL | 7.0.19041.3636 (WinBuild.160101.0800) 0x00007FFD0C3D0000 | C:\WINDOWS\System32\sechost.dll | Host for SCM/SDDL/LSA Lookup APIs | 10.0.19041.320 (WinBuild.160101.0800) 0x00007FFD0C660000 | C:\WINDOWS\System32\RPCRT4.dll | Библиотека удаленного вызова процедур | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD0A400000 | C:\WINDOWS\System32\bcrypt.dll | Библиотека криптографических примитивов Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD0C840000 | C:\WINDOWS\System32\USER32.dll | Многопользовательская библиотека клиента USER API Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD0A5F0000 | C:\WINDOWS\System32\win32u.dll | Win32u | 10.0.19041.4894 (WinBuild.160101.0800) 0x00007FFD0AB90000 | C:\WINDOWS\System32\GDI32.dll | GDI Client DLL | 10.0.19041.4474 (WinBuild.160101.0800) 0x00007FFD0AA70000 | C:\WINDOWS\System32\gdi32full.dll | GDI Client DLL | 10.0.19041.4717 (WinBuild.160101.0800) 0x00007FFD0A9D0000 | C:\WINDOWS\System32\msvcp_win.dll | Microsoft® C Runtime Library | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFD0A430000 | C:\WINDOWS\System32\ucrtbase.dll | Microsoft® C Runtime Library | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFD0BC60000 | C:\WINDOWS\System32\SHELL32.dll | Общая библиотека оболочки Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD0B950000 | C:\WINDOWS\System32\ole32.dll | Microsoft OLE для Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD0AC30000 | C:\WINDOWS\System32\combase.dll | Microsoft COM для Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD0C530000 | C:\WINDOWS\System32\PSAPI.DLL | Process Status Helper | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFD0B070000 | C:\WINDOWS\System32\SETUPAPI.dll | Windows Setup API | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFCF8430000 | C:\WINDOWS\SYSTEM32\WINSPOOL.DRV | Драйвер диспетчера очереди Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD0A5A0000 | C:\WINDOWS\System32\cfgmgr32.dll | Configuration Manager DLL | 10.0.19041.3996 (WinBuild.160101.0800) 0x00007FFD0BBA0000 | C:\WINDOWS\System32\shcore.dll | SHCORE | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD0AF90000 | C:\WINDOWS\System32\COMDLG32.dll | Библиотека общих диалоговых окон | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD03A40000 | C:\WINDOWS\SYSTEM32\MPR.dll | Библиотека маршрутизации для нескольких служб доступа | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD0B4F0000 | C:\WINDOWS\System32\SHLWAPI.dll | Библиотека небольших программ оболочки | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFCF89E0000 | C:\WINDOWS\SYSTEM32\NETAPI32.dll | Net Win32 API DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFD0C9E0000 | C:\WINDOWS\System32\IMM32.dll | Multi-User Windows IMM32 API Client DLL | 10.0.19041.4474 (WinBuild.160101.0800) 0x00007FFD04FC0000 | C:\WINDOWS\SYSTEM32\VERSION.dll | Version Checking and File Installation Libraries | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFCF6A70000 | C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.4355_none_60b8b9eb71f62e16\COMCTL32.dll | Библиотека элементов управления взаимодействия с пользователем | 6.10 (WinBuild.160101.0800) 0x00007FFD0A100000 | C:\WINDOWS\SYSTEM32\USERENV.dll | Userenv | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFCCDF50000 | C:\Program Files\Far Manager\sqlite3.dll | SQLite is a software library that implements a self-contained, serverless, zero-configuration, transactional SQL database engine. | 3.46.1 0x00007FFCF6A50000 | C:\WINDOWS\SYSTEM32\Secur32.dll | Security Support Provider Interface | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFD039E0000 | C:\WINDOWS\SYSTEM32\SRVCLI.DLL | Server Service Client DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFD03DA0000 | C:\WINDOWS\SYSTEM32\SAMCLI.DLL | Security Accounts Manager Client DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFD09330000 | C:\WINDOWS\SYSTEM32\NETUTILS.DLL | Net Win32 API Helpers DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFD0A0C0000 | C:\WINDOWS\SYSTEM32\SSPICLI.DLL | Security Support Provider Interface | 10.0.19041.4239 (WinBuild.160101.0800) 0x00007FFD07ED0000 | C:\WINDOWS\SYSTEM32\kernel.appcore.dll | AppModel API Host | 10.0.19041.3758 (WinBuild.160101.0800) 0x00007FFD07470000 | C:\WINDOWS\system32\uxtheme.dll | Библиотека тем UxTheme (Microsoft) | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD0BA80000 | C:\WINDOWS\System32\MSCTF.dll | Серверная библиотека MSCTF | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD0B550000 | C:\WINDOWS\System32\OLEAUT32.dll | OLEAUT32.DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFD08580000 | C:\WINDOWS\SYSTEM32\windows.storage.dll | API хранения Microsoft WinRT | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD09A90000 | C:\WINDOWS\SYSTEM32\Wldp.dll | Политика блокировки Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD0A140000 | C:\WINDOWS\SYSTEM32\profapi.dll | User Profile Basic API | 10.0.19041.4355 (WinBuild.160101.0800) 0x00007FFD0A370000 | C:\WINDOWS\System32\bcryptPrimitives.dll | Windows Cryptographic Primitives Library | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFD0C790000 | C:\WINDOWS\System32\clbcatq.dll | COM+ Configuration Catalog | 2001.12.10941.16384 (WinBuild.160101.0800) 0x00007FFCD0A40000 | C:\WINDOWS\system32\explorerframe.dll | ExplorerFrame | 10.0.19041.4842 (WinBuild.160101.0800) 0x00007FFD05760000 | C:\WINDOWS\system32\d2d1.dll | Библиотека Microsoft D2D | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFCFFFC0000 | C:\Windows\System32\OneCoreUAPCommonProxyStub.dll | OneCoreUAP Common Proxy Stub | 10.0.19041.4842 (WinBuild.160101.0800) 0x00007FFCF8900000 | C:\Program Files\Far Manager\Plugins\LuaMacro\LuaMacro.dll | Lua Macros for Far Manager | 3.0.848.0 0x0000000066D80000 | C:\Program Files\Far Manager\lua51.dll | 0x00000715 - Указанный тип ресурса в файле образа отсутствует. 0x00007FFCE45C0000 | C:\Program Files\Far Manager\luafar3.dll | LuaFar library | 3.0.848.0 0x00007FFD09A00000 | C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL | Base cryptographic API DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x0000000064480000 | C:\Program Files\Far Manager\lpeg.dll | 0x00000715 - Указанный тип ресурса в файле образа отсутствует. 0x00007FFCEA6C0000 | C:\Program Files\Far Manager\Plugins\TmpPanel\TmpPanel.dll | Temporary Panel for Far Manager | 3.0.120.0 0x00007FFCBE1F0000 | C:\Program Files\Far Manager\Plugins\NetBox\NetBox.dll | NetBox: SFTP/FTP/FTPS/SCP/WebDAV/S3 client for Far Manager 3.0 | 24.9.0.604 0x00007FFD09AD0000 | C:\WINDOWS\SYSTEM32\CRYPTSP.dll | Cryptographic Service Provider API | 10.0.19041.3636 (WinBuild.160101.0800) 0x00000000626E0000 | C:\Program Files\Common Files\Crypto Pro\AppCompat\cpadvai.dll | Модуль исправления функционирования advapi32 | 4.0.5191.0 0x00007FFD0A210000 | C:\WINDOWS\System32\CRYPT32.dll | API32 криптографии | 10.0.19041.4522 (WinBuild.160101.0800) 0x0000000062710000 | C:\Program Files\Common Files\Crypto Pro\AppCompat\cpcrypt.dll | Модуль исправления функционирования crypt32 | 4.0.5196.0 0x0000000062700000 | C:\Program Files\Common Files\Crypto Pro\AppCompat\detoured.dll | Marks process affected by Microsoft Research Detours Package | 2.1.312.0 0x00007FFD08E60000 | C:\WINDOWS\system32\rsaenh.dll | Microsoft Enhanced Cryptographic Provider | 10.0.19041.320 (WinBuild.160101.0800) 0x00007FFD07C00000 | C:\WINDOWS\system32\propsys.dll | Система страниц свойств (Майкрософт) | 7.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD0ABC0000 | C:\WINDOWS\System32\ws2_32.dll | 32-разрядная библиотека Windows Socket 2.0 | 10.0.19041.4522 (WinBuild.160101.0800) 0x0000028723D70000 | C:\WINDOWS\SYSTEM32\security.dll | Security Support Provider Interface | 10.0.19041.1 (WinBuild.160101.0800) 0x00007FFD09520000 | C:\WINDOWS\system32\mswsock.dll | Расширение поставщика службы API Microsoft Windows Sockets 2.0 | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD09260000 | C:\WINDOWS\SYSTEM32\DNSAPI.dll | Динамическая библиотека API DNS-клиента | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD09220000 | C:\WINDOWS\SYSTEM32\IPHLPAPI.DLL | API вспомогательного приложения IP | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD0B4E0000 | C:\WINDOWS\System32\NSI.dll | NSI User-mode interface DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFCFEA60000 | C:\Windows\System32\rasadhlp.dll | Remote Access AutoDial Helper | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFD036C0000 | C:\WINDOWS\System32\fwpuclnt.dll | API пользовательского режима FWP/IPsec | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFCBDE50000 | C:\Program Files\Far Manager\Plugins\FarColorer\bin\colorer.dll | FarColorer - Syntax Highlighting for Far Manager 3 x64 | 1.4.28 0x00007FFCF8810000 | C:\Program Files\Far Manager\Plugins\AutoWrap\AutoWrap.dll | Auto wrap for Far Manager | 3.0.27.0 0x00007FFCF8770000 | C:\Program Files\Far Manager\Plugins\HlfViewer\HlfViewer.dll | Hlf-file Viewer for Far Manager | 3.0.50.0 0x00007FFD090B0000 | C:\WINDOWS\SYSTEM32\ntmarta.dll | Поставщик Windows NT MARTA | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFD01D50000 | C:\WINDOWS\SYSTEM32\dbghelp.DLL | Windows Image Helper | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFD01AA0000 | C:\WINDOWS\SYSTEM32\dbgcore.DLL | Windows Core Debugging Helpers | 10.0.19041.4355 (WinBuild.160101.0800) 0x00007FFC96000000 | C:\WINDOWS\SYSTEM32\dbgeng.DLL | Windows Symbolic Debugger Engine | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFCCE090000 | C:\WINDOWS\SYSTEM32\dbgmodel.dll | Windows Debugger Data Model | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFD04260000 | C:\WINDOWS\SYSTEM32\XmlLite.dll | Microsoft XmlLite Library | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFD0A530000 | C:\WINDOWS\System32\wintrust.dll | Microsoft Trust Verification APIs | 10.0.19041.4780 (WinBuild.160101.0800) 0x00007FFD09DD0000 | C:\WINDOWS\SYSTEM32\MSASN1.dll | ASN.1 Runtime APIs | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFD0C640000 | C:\WINDOWS\System32\imagehlp.dll | Windows NT Image Helper | 10.0.19041.3636 (WinBuild.160101.0800) ====================================================================== Environment ====================================================================== FARHOME=C:\Program Files\Far Manager FARLANG=Russian FARLOCALPROFILE=C:\Users\Андрей Николаев\AppData\Local\Far Manager\Profile FARPROFILE=C:\Users\Андрей Николаев\AppData\Roaming\Far Manager\Profile