====================================================================== Summary ====================================================================== Exception: 0xC0000005 - STATUS_ACCESS_VIOLATION Details: Memory at [+00729C78 NetBox.dll!class malloc_state _gm_+0x288 (dlmalloc:dlmalloc.cc.obj)] could not be executed errno: 0x00000000 - No error LastError: 0x00000002 - Systém nemůže nalézt uvedený soubor. NTSTATUS: 0xC000000F - {Soubor nenalezen} Soubor %hs neexistuje. Address: +00729C78 NetBox.dll!class malloc_state _gm_+0x288 (dlmalloc:dlmalloc.cc.obj) Location: GetFiles, plclass.cpp(1020) Module: C:\Program Files\Far\Plugins\NetBox\NetBox.dll Plugin: NetBox 24.12.608.2 (SFTP/FTP(S)/SCP/WebDAV/S3 client for FAR 3.0 x86/x64/ARM64, Mikhail Lukashov) ====================================================================== System information ====================================================================== Far: 3.0.6575.0 x64 (c554345) Compiler: Microsoft Visual C++, version 19.41.33923.0 Library: Microsoft STL, version 14.3.202404 PE time: 2025-10-21 00:12:54.000 File time: 2025-10-21 00:12:57.101 Time: 2025-10-21 12:15:51.206 Local: 2025-10-21 14:15:51.206 +0200, Střední Evropa (letní čas) Uptime: 00:00:09 OS: Windows NT Workstation 10.0.26200, 0x100/0x30 (Windows 10 Pro, version 25H2, OS build 26200.6899) Locale: cs-CZ | LCID=00000405 (Lang=0405 (Primary=005 Sub=01) Sort=0 SortVersion=0) | ANSI=1250 OEM=852 Host: C:\Windows\System32\conhost.exe 10.0.26100.2308 (WinBuild.160101.0800) Parent: C:\Program Files\ConEmu\ConEmu\ConEmuC64.exe 230724 Command: "C:\Program Files\Far\Far.exe" Elevated: Yes (Full) Memory: 17.2 G out of 33.7 G free (50%); 35.5 M used by the process ====================================================================== Exception ====================================================================== ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00729C78 NetBox.dll!class malloc_state _gm_+0x288 (dlmalloc:dlmalloc.cc.obj) +00042D3F NetBox.dll!::operator()(void)const __ptr64+0xDF (Terminal.cpp.obj) +0005CE3A NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x3A (Terminal.cpp.obj) +0005CDC6 NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0xD6 (Terminal.cpp.obj) +00042B3D NetBox.dll!TTerminal::ProcessFiles(class TStrings * __ptr64,enum TFileOperation,class fastdelegate::FastDelegate3 && __ptr64,void * __ptr64,enum TOperationSide,bool) __ptr64+0x14D (Terminal.cpp.obj) +00046158 NetBox.dll!TTerminal::CalculateFilesSize(class TStrings * __ptr64,__int64 & __ptr64,struct TCalculateSizeParams & __ptr64) __ptr64+0x78 (Terminal.cpp.obj) +0005C23C NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x10C (Terminal.cpp.obj) +00053D19 NetBox.dll!::operator()(void)const __ptr64+0x219 (Terminal.cpp.obj) +0005C027 NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x37 (Terminal.cpp.obj) +000539FA NetBox.dll!TTerminal::CopyToLocal(class TStrings * __ptr64,class UnicodeString const & __ptr64,class TCopyParamType const * __ptr64,int,class TParallelOperation * __ptr64) __ptr64+0xFA (Terminal.cpp.obj) +0018214B NetBox.dll!TWinSCPFileSystem::GetFilesRemote(class TObjectList * __ptr64,bool,class UnicodeString & __ptr64,unsigned __int64) __ptr64+0x3CB (WinSCPFileSystem.cpp.obj) +0018A2F5 NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x65 (WinSCPFileSystem.cpp.obj) +00181A6D NetBox.dll!TWinSCPFileSystem::GetFilesEx(class TObjectList * __ptr64,bool,class UnicodeString & __ptr64,unsigned __int64) __ptr64+0x26D (WinSCPFileSystem.cpp.obj) +00174124 NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x54 (FarPlugin.cpp.obj) +0016C6E4 NetBox.dll!TCustomFarPlugin::GetFiles(struct GetFilesInfo * __ptr64) __ptr64+0x174 (FarPlugin.cpp.obj) +00162186 NetBox.dll!GetFilesW+0x46 (NetBox.cpp.obj) +00294EF9 Far.exe!`function_ref::function_ref,struct GetFilesInfo * __ptr64 & __ptr64>(struct Plugin::ExecuteStruct<11,1> & __ptr64,struct GetFilesInfo * __ptr64 & __ptr64) __ptr64'::`2':: >(class `Plugin::ExecuteFunction,struct GetFilesInfo * __ptr64 & __ptr64>(struct Plugin::ExecuteStruct<11,1> & __ptr64,struct GetFilesInfo * __ptr64 & __ptr64) __ptr64'::`2':: && __ptr64) __ptr64'::`1'::::(__int64)+0x19 (plclass.obj) +00294B62 Far.exe!`function_ref::function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64>(class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64) __ptr64'::`1'::::(__int64)+0x12 (plclass.obj) +0012CA56 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +00293B11 Far.exe!cpp_try,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2'::,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2'::,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: >(class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64,struct source_location const & __ptr64)+0x61 (plclass.obj) +00294C60 Far.exe!`function_ref::function_ref,struct source_location const & __ptr64) __ptr64'::`2':: const & __ptr64>(class `Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2':: const & __ptr64) __ptr64'::`1'::::(__int64)+0x80 (plclass.obj) +0012CA88 Far.exe!detail::seh_try(class function_ref,class function_ref,class function_ref)+0x18 (exception_handler.obj) +00293A9E Far.exe!Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64+0xAE (plclass.obj) +002928EE Far.exe!Plugin::GetFiles(struct GetFilesInfo * __ptr64) __ptr64+0xCE (plclass.obj) +002C8787 Far.exe!PluginManager::GetFile(class plugin_panel const * __ptr64,struct PluginPanelItem * __ptr64,class std::basic_string,class std::allocator > const & __ptr64,class std::basic_string,class std::allocator > & __ptr64,int)+0x97 (plugins.obj) +0016431B Far.exe!FileList::ProcessEnter(bool,bool,bool,bool,enum OPENFILEPLUGINTYPE) __ptr64+0x9CB (filelist.obj) +00163178 Far.exe!FileList::ProcessKey(class Manager::Key const & __ptr64) __ptr64+0x44C8 (filelist.obj) +00195240 Far.exe!FilePanels::ProcessKey(class Manager::Key const & __ptr64) __ptr64+0x15D0 (filepanels.obj) +00237F60 Far.exe!Manager::ProcessKey(class Manager::Key) __ptr64+0x700 (manager.obj) +00237313 Far.exe!Manager::ProcessMainLoop(void) __ptr64+0xB3 (manager.obj) +00237231 Far.exe!Manager::EnterMainLoop(void) __ptr64+0xC1 (manager.obj) +0022E6B1 Far.exe!MainProcess(class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,int,int)+0x1621 (main.obj) +00232E9C Far.exe!`mainImpl(class std::span)'::`2'::::operator()(void)const __ptr64+0xEC (main.obj) +00233A22 Far.exe!`function_ref::function_ref)'::`2'::,class `mainImpl(class std::span)'::`2'::,class `mainImpl(class std::span)'::`2':: >(class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: >(class `cpp_try)'::`2'::,class `mainImpl(class std::span)'::`2'::,class `mainImpl(class std::span)'::`2':: >(class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: && __ptr64) __ptr64'::`1'::::(__int64)+0x12 (main.obj) +0012CA56 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +00232966 Far.exe!mainImpl(class std::span)+0xE16 (main.obj) +00233389 Far.exe!`wmain_seh(void)'::`2'::::operator()(void)const __ptr64+0x19 (main.obj) +00233AA2 Far.exe!`function_ref::function_ref,class `wmain_seh(void)'::`2'::,class `wmain_seh(void)'::`2':: >(class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: >(class `cpp_try,class `wmain_seh(void)'::`2'::,class `wmain_seh(void)'::`2':: >(class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: && __ptr64) __ptr64'::`1'::::(__int64)+0x12 (main.obj) +0012CA56 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +002332BA Far.exe!wmain_seh(void)+0x3AA (main.obj) +00233B2C Far.exe!`function_ref::function_ref,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64)'::`3':: >(class `seh_try,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64)'::`3':: && __ptr64) __ptr64'::`1'::::(__int64)+0x4C (main.obj) +0012CA88 Far.exe!detail::seh_try(class function_ref,class function_ref,class function_ref)+0x18 (exception_handler.obj) +00233508 Far.exe!main+0xC8 (main.obj) +00365C00 Far.exe!__scrt_common_main_seh(void)+0x10C (LIBCMT:exe_main.obj) +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000002B9AB221780 RBX = 000002B9AB221790 RCX = 000002B9AB221790 RDX = 0000000000000033 RSI = 000000C86C2FAED0 RDI = 0000000000000000 R8 = 0000000000000010 R9 = 0000000000000020 R10 = 00007FFBD7750000 R11 = 00007FFBD7D06F54 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 000000C86C2FB050 RIP = 00007FFBD7E79C78 RSP = 000000C86C2FACF8 RBP = 000002B9AB2172A0 EFL = 00010206 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00729C78 NetBox.dll!class malloc_state _gm_+0x288 (dlmalloc:dlmalloc.cc.obj): 00007ffb`d7e79c5a fc cld 00007ffb`d7e79c5b a9b9020000 test eax,2B9h 00007ffb`d7e79c60 0000 add byte ptr [rax],al 00007ffb`d7e79c62 0000 add byte ptr [rax],al 00007ffb`d7e79c64 0000 add byte ptr [rax],al 00007ffb`d7e79c66 0000 add byte ptr [rax],al 00007ffb`d7e79c68 d0a121abb902 shl byte ptr [rcx+2B9AB21h],1 00007ffb`d7e79c6e 0000 add byte ptr [rax],al 00007ffb`d7e79c70 3036 xor byte ptr [rsi],dh 00007ffb`d7e79c72 22abb9020000 and ch,byte ptr [rbx+2B9h] 00007ffb`d7e79c78 50 push rax +00042D3F NetBox.dll!::operator()(void)const __ptr64+0xDF (Terminal.cpp.obj): 00007ffb`d7792d24 ffd0 call rax 00007ffb`d7792d26 488bd8 mov rbx,rax 00007ffb`d7792d29 4885c0 test rax,rax 00007ffb`d7792d2c 7505 jne NetBox+0x42d33 (00007ffb`d7792d33) 00007ffb`d7792d2e 498bdc mov rbx,r12 00007ffb`d7792d31 eb12 jmp NetBox+0x42d45 (00007ffb`d7792d45) 00007ffb`d7792d33 488b00 mov rax,qword ptr [rax] 00007ffb`d7792d36 66ba3300 mov dx,33h 00007ffb`d7792d3a 488bcb mov rcx,rbx 00007ffb`d7792d3d ff10 call qword ptr [rax] 00007ffb`d7792d3f 84c0 test al,al +0005CE3A NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x3A (Terminal.cpp.obj): 00007ffb`d77ace10 0f1101 movups xmmword ptr [rcx],xmm0 00007ffb`d77ace13 0f104a10 movups xmm1,xmmword ptr [rdx+10h] 00007ffb`d77ace17 0f114910 movups xmmword ptr [rcx+10h],xmm1 00007ffb`d77ace1b 0f104220 movups xmm0,xmmword ptr [rdx+20h] 00007ffb`d77ace1f 0f114120 movups xmmword ptr [rcx+20h],xmm0 00007ffb`d77ace23 f20f104a30 movsd xmm1,mmword ptr [rdx+30h] 00007ffb`d77ace28 f20f114930 movsd mmword ptr [rcx+30h],xmm1 00007ffb`d77ace2d 410f1000 movups xmm0,xmmword ptr [r8] 00007ffb`d77ace31 0f114138 movups xmmword ptr [rcx+38h],xmm0 00007ffb`d77ace35 e8265efeff call NetBox+0x42c60 (00007ffb`d7792c60) 00007ffb`d77ace3a 90 nop +0005CDC6 NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0xD6 (Terminal.cpp.obj): 00007ffb`d77acd9b 54 push rsp 00007ffb`d77acd9c 2440 and al,40h 00007ffb`d77acd9e 4c89442448 mov qword ptr [rsp+48h],r8 00007ffb`d77acda3 4c894c2450 mov qword ptr [rsp+50h],r9 00007ffb`d77acda8 4c895c2458 mov qword ptr [rsp+58h],r11 00007ffb`d77acdad 4c89542460 mov qword ptr [rsp+60h],r10 00007ffb`d77acdb2 4c8d442420 lea r8,[rsp+20h] 00007ffb`d77acdb7 488d542430 lea rdx,[rsp+30h] 00007ffb`d77acdbc 488d4c2470 lea rcx,[rsp+70h] 00007ffb`d77acdc1 e83a000000 call NetBox+0x5ce00 (00007ffb`d77ace00) 00007ffb`d77acdc6 488b4b18 mov rcx,qword ptr [rbx+18h] +00042B3D NetBox.dll!TTerminal::ProcessFiles(class TStrings * __ptr64,enum TFileOperation,class fastdelegate::FastDelegate3 && __ptr64,void * __ptr64,enum TOperationSide,bool) __ptr64+0x14D (Terminal.cpp.obj): 00007ffb`d7792af9 488d8424a0040000 lea rax,[rsp+4A0h] 00007ffb`d7792b01 48898424a0000000 mov qword ptr [rsp+0A0h],rax 00007ffb`d7792b09 488d442438 lea rax,[rsp+38h] 00007ffb`d7792b0e 48898424a8000000 mov qword ptr [rsp+0A8h],rax 00007ffb`d7792b16 488d8424b0040000 lea rax,[rsp+4B0h] 00007ffb`d7792b1e 48898424b0000000 mov qword ptr [rsp+0B0h],rax 00007ffb`d7792b26 4c8d442440 lea r8,[rsp+40h] 00007ffb`d7792b2b 488d542470 lea rdx,[rsp+70h] 00007ffb`d7792b30 488d8c24c0000000 lea rcx,[rsp+0C0h] 00007ffb`d7792b38 e8b3a10100 call NetBox+0x5ccf0 (00007ffb`d77accf0) 00007ffb`d7792b3d 90 nop +00046158 NetBox.dll!TTerminal::CalculateFilesSize(class TStrings * __ptr64,__int64 & __ptr64,struct TCalculateSizeParams & __ptr64) __ptr64+0x78 (Terminal.cpp.obj): 00007ffb`d7796126 488d15d3f5ffff lea rdx,[NetBox+0x45700 (00007ffb`d7795700)] 00007ffb`d779612d 488d4c2450 lea rcx,[rsp+50h] 00007ffb`d7796132 e879f9fdff call NetBox+0x25ab0 (00007ffb`d7775ab0) 00007ffb`d7796137 4c8bc8 mov r9,rax 00007ffb`d779613a c744242801000000 mov dword ptr [rsp+28h],1 00007ffb`d7796142 4c897c2420 mov qword ptr [rsp+20h],r15 00007ffb`d7796147 41b807000000 mov r8d,7 00007ffb`d779614d 488bd3 mov rdx,rbx 00007ffb`d7796150 488bcd mov rcx,rbp 00007ffb`d7796153 e898c8ffff call NetBox+0x429f0 (00007ffb`d77929f0) 00007ffb`d7796158 498b4740 mov rax,qword ptr [r15+40h] +0005C23C NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x10C (Terminal.cpp.obj): 00007ffb`d77ac212 7405 je NetBox+0x5c219 (00007ffb`d77ac219) 00007ffb`d77ac214 c644247801 mov byte ptr [rsp+78h],1 00007ffb`d77ac219 488d442420 lea rax,[rsp+20h] 00007ffb`d77ac21e 4889442470 mov qword ptr [rsp+70h],rax 00007ffb`d77ac223 488b5320 mov rdx,qword ptr [rbx+20h] 00007ffb`d77ac227 4c8d4c2450 lea r9,[rsp+50h] 00007ffb`d77ac22c 4c8b4328 mov r8,qword ptr [rbx+28h] 00007ffb`d77ac230 488b12 mov rdx,qword ptr [rdx] 00007ffb`d77ac233 488b4b18 mov rcx,qword ptr [rbx+18h] 00007ffb`d77ac237 e8a49efeff call NetBox+0x460e0 (00007ffb`d77960e0) 00007ffb`d77ac23c 84c0 test al,al +00053D19 NetBox.dll!::operator()(void)const __ptr64+0x219 (Terminal.cpp.obj): 00007ffb`d77a3ceb 48895598 mov qword ptr [rbp-68h],rdx 00007ffb`d77a3cef 48894da0 mov qword ptr [rbp-60h],rcx 00007ffb`d77a3cf3 488d442450 lea rax,[rsp+50h] 00007ffb`d77a3cf8 488945a8 mov qword ptr [rbp-58h],rax 00007ffb`d77a3cfc 488d8568040000 lea rax,[rbp+468h] 00007ffb`d77a3d03 488945b0 mov qword ptr [rbp-50h],rax 00007ffb`d77a3d07 4c8d442470 lea r8,[rsp+70h] 00007ffb`d77a3d0c 488d5580 lea rdx,[rbp-80h] 00007ffb`d77a3d10 488d4dc0 lea rcx,[rbp-40h] 00007ffb`d77a3d14 e817840000 call NetBox+0x5c130 (00007ffb`d77ac130) 00007ffb`d77a3d19 4c8b36 mov r14,qword ptr [rsi] +0005C027 NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x37 (Terminal.cpp.obj): 00007ffb`d77ac000 0f1101 movups xmmword ptr [rcx],xmm0 00007ffb`d77ac003 0f104a10 movups xmm1,xmmword ptr [rdx+10h] 00007ffb`d77ac007 0f114910 movups xmmword ptr [rcx+10h],xmm1 00007ffb`d77ac00b 0f104220 movups xmm0,xmmword ptr [rdx+20h] 00007ffb`d77ac00f 0f114120 movups xmmword ptr [rcx+20h],xmm0 00007ffb`d77ac013 0f104a30 movups xmm1,xmmword ptr [rdx+30h] 00007ffb`d77ac017 0f114930 movups xmmword ptr [rcx+30h],xmm1 00007ffb`d77ac01b 498b00 mov rax,qword ptr [r8] 00007ffb`d77ac01e 48894140 mov qword ptr [rcx+40h],rax 00007ffb`d77ac022 e8d97affff call NetBox+0x53b00 (00007ffb`d77a3b00) 00007ffb`d77ac027 90 nop +000539FA NetBox.dll!TTerminal::CopyToLocal(class TStrings * __ptr64,class UnicodeString const & __ptr64,class TCopyParamType const * __ptr64,int,class TParallelOperation * __ptr64) __ptr64+0xFA (Terminal.cpp.obj): 00007ffb`d77a39d1 488945bf mov qword ptr [rbp-41h],rax 00007ffb`d77a39d5 488975c7 mov qword ptr [rbp-39h],rsi 00007ffb`d77a39d9 488d458b lea rax,[rbp-75h] 00007ffb`d77a39dd 488945cf mov qword ptr [rbp-31h],rax 00007ffb`d77a39e1 488d4587 lea rax,[rbp-79h] 00007ffb`d77a39e5 488945d7 mov qword ptr [rbp-29h],rax 00007ffb`d77a39e9 4c8d458f lea r8,[rbp-71h] 00007ffb`d77a39ed 488d559f lea rdx,[rbp-61h] 00007ffb`d77a39f1 488d4de7 lea rcx,[rbp-19h] 00007ffb`d77a39f5 e8f6850000 call NetBox+0x5bff0 (00007ffb`d77abff0) 00007ffb`d77a39fa 837d8b00 cmp dword ptr [rbp-75h],0 ====================================================================== Exception handler thread ====================================================================== ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00128428 Far.exe!collect_information(class exception_context const & __ptr64,struct source_location const & __ptr64,class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,struct error_state_ex const & __ptr64,class std::span)+0x16D8 (exception_handler.obj) +0012A97B Far.exe!handle_generic_exception(class exception_context const & __ptr64,struct source_location const & __ptr64,class Plugin const * __ptr64 const,class std::basic_string_view >,class std::basic_string_view >,struct error_state_ex const & __ptr64,class std::span)+0xA6B (exception_handler.obj) +0012BE9F Far.exe!handle_seh_exception(class exception_context const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)+0x32F (exception_handler.obj) +0012CC53 Far.exe!detail::seh_filter(struct _EXCEPTION_POINTERS const * __ptr64,class Plugin const * __ptr64,struct source_location const & __ptr64)+0x173 (exception_handler.obj) +003B8E47 Far.exe!int `detail::seh_try(class function_ref,class function_ref,class function_ref)'::`1'::filt$0+0x37 (exception_handler.obj) +00367253 Far.exe!__C_specific_handler+0x9F (libvcruntime:riscchandler.obj) +0016632F ntdll.dll!_chkstk+0x9F +00012327 ntdll.dll!RtlLocateExtendedFeature+0x597 +00165C6E ntdll.dll!KiUserExceptionDispatcher+0x2E +00729C78 NetBox.dll!class malloc_state _gm_+0x288 (dlmalloc:dlmalloc.cc.obj) +00042D3F NetBox.dll!::operator()(void)const __ptr64+0xDF (Terminal.cpp.obj) +0005CE3A NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x3A (Terminal.cpp.obj) +0005CDC6 NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0xD6 (Terminal.cpp.obj) +00042B3D NetBox.dll!TTerminal::ProcessFiles(class TStrings * __ptr64,enum TFileOperation,class fastdelegate::FastDelegate3 && __ptr64,void * __ptr64,enum TOperationSide,bool) __ptr64+0x14D (Terminal.cpp.obj) +00046158 NetBox.dll!TTerminal::CalculateFilesSize(class TStrings * __ptr64,__int64 & __ptr64,struct TCalculateSizeParams & __ptr64) __ptr64+0x78 (Terminal.cpp.obj) +0005C23C NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x10C (Terminal.cpp.obj) +00053D19 NetBox.dll!::operator()(void)const __ptr64+0x219 (Terminal.cpp.obj) +0005C027 NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x37 (Terminal.cpp.obj) +000539FA NetBox.dll!TTerminal::CopyToLocal(class TStrings * __ptr64,class UnicodeString const & __ptr64,class TCopyParamType const * __ptr64,int,class TParallelOperation * __ptr64) __ptr64+0xFA (Terminal.cpp.obj) +0018214B NetBox.dll!TWinSCPFileSystem::GetFilesRemote(class TObjectList * __ptr64,bool,class UnicodeString & __ptr64,unsigned __int64) __ptr64+0x3CB (WinSCPFileSystem.cpp.obj) +0018A2F5 NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x65 (WinSCPFileSystem.cpp.obj) +00181A6D NetBox.dll!TWinSCPFileSystem::GetFilesEx(class TObjectList * __ptr64,bool,class UnicodeString & __ptr64,unsigned __int64) __ptr64+0x26D (WinSCPFileSystem.cpp.obj) +00174124 NetBox.dll!Sysutils::detail::scope_guard,class >::scope_guard,class >(class && __ptr64,class && __ptr64) __ptr64+0x54 (FarPlugin.cpp.obj) +0016C6E4 NetBox.dll!TCustomFarPlugin::GetFiles(struct GetFilesInfo * __ptr64) __ptr64+0x174 (FarPlugin.cpp.obj) +00162186 NetBox.dll!GetFilesW+0x46 (NetBox.cpp.obj) +00294EF9 Far.exe!`function_ref::function_ref,struct GetFilesInfo * __ptr64 & __ptr64>(struct Plugin::ExecuteStruct<11,1> & __ptr64,struct GetFilesInfo * __ptr64 & __ptr64) __ptr64'::`2':: >(class `Plugin::ExecuteFunction,struct GetFilesInfo * __ptr64 & __ptr64>(struct Plugin::ExecuteStruct<11,1> & __ptr64,struct GetFilesInfo * __ptr64 & __ptr64) __ptr64'::`2':: && __ptr64) __ptr64'::`1'::::(__int64)+0x19 (plclass.obj) +00294B62 Far.exe!`function_ref::function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64>(class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64) __ptr64'::`1'::::(__int64)+0x12 (plclass.obj) +0012CA56 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +00293B11 Far.exe!cpp_try,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2'::,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2'::,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: >(class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64,class ``Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2'::::operator()(void)const __ptr64'::`2':: const & __ptr64,struct source_location const & __ptr64)+0x61 (plclass.obj) +00294C60 Far.exe!`function_ref::function_ref,struct source_location const & __ptr64) __ptr64'::`2':: const & __ptr64>(class `Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64'::`2':: const & __ptr64) __ptr64'::`1'::::(__int64)+0x80 (plclass.obj) +0012CA88 Far.exe!detail::seh_try(class function_ref,class function_ref,class function_ref)+0x18 (exception_handler.obj) +00293A9E Far.exe!Plugin::ExecuteFunctionImpl(enum export_index,class function_ref,struct source_location const & __ptr64) __ptr64+0xAE (plclass.obj) +002928EE Far.exe!Plugin::GetFiles(struct GetFilesInfo * __ptr64) __ptr64+0xCE (plclass.obj) +002C8787 Far.exe!PluginManager::GetFile(class plugin_panel const * __ptr64,struct PluginPanelItem * __ptr64,class std::basic_string,class std::allocator > const & __ptr64,class std::basic_string,class std::allocator > & __ptr64,int)+0x97 (plugins.obj) +0016431B Far.exe!FileList::ProcessEnter(bool,bool,bool,bool,enum OPENFILEPLUGINTYPE) __ptr64+0x9CB (filelist.obj) +00163178 Far.exe!FileList::ProcessKey(class Manager::Key const & __ptr64) __ptr64+0x44C8 (filelist.obj) +00195240 Far.exe!FilePanels::ProcessKey(class Manager::Key const & __ptr64) __ptr64+0x15D0 (filepanels.obj) +00237F60 Far.exe!Manager::ProcessKey(class Manager::Key) __ptr64+0x700 (manager.obj) +00237313 Far.exe!Manager::ProcessMainLoop(void) __ptr64+0xB3 (manager.obj) +00237231 Far.exe!Manager::EnterMainLoop(void) __ptr64+0xC1 (manager.obj) +0022E6B1 Far.exe!MainProcess(class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,int,int)+0x1621 (main.obj) +00232E9C Far.exe!`mainImpl(class std::span)'::`2'::::operator()(void)const __ptr64+0xEC (main.obj) +00233A22 Far.exe!`function_ref::function_ref)'::`2'::,class `mainImpl(class std::span)'::`2'::,class `mainImpl(class std::span)'::`2':: >(class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: >(class `cpp_try)'::`2'::,class `mainImpl(class std::span)'::`2'::,class `mainImpl(class std::span)'::`2':: >(class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: && __ptr64) __ptr64'::`1'::::(__int64)+0x12 (main.obj) +0012CA56 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +00232966 Far.exe!mainImpl(class std::span)+0xE16 (main.obj) +00233389 Far.exe!`wmain_seh(void)'::`2'::::operator()(void)const __ptr64+0x19 (main.obj) +00233AA2 Far.exe!`function_ref::function_ref,class `wmain_seh(void)'::`2'::,class `wmain_seh(void)'::`2':: >(class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: >(class `cpp_try,class `wmain_seh(void)'::`2'::,class `wmain_seh(void)'::`2':: >(class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: && __ptr64) __ptr64'::`1'::::(__int64)+0x12 (main.obj) +0012CA56 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +002332BA Far.exe!wmain_seh(void)+0x3AA (main.obj) +00233B2C Far.exe!`function_ref::function_ref,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64)'::`3':: >(class `seh_try,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64)'::`3':: && __ptr64) __ptr64'::`1'::::(__int64)+0x4C (main.obj) +0012CA88 Far.exe!detail::seh_try(class function_ref,class function_ref,class function_ref)+0x18 (exception_handler.obj) +00233508 Far.exe!main+0xC8 (main.obj) +00365C00 Far.exe!__scrt_common_main_seh(void)+0x10C (LIBCMT:exe_main.obj) +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ====================================================================== Thread 8628 / 0x21B4 (Window messages processor) ====================================================================== LastError: 0x00000000 - Operace byla dokončena úspěšně. NTSTATUS: 0xC0000047 - Došlo k pokusu uvolnit semafor tak, že by byl překročen jeho maximální počet. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00001324 win32u.dll!NtUserGetMessage+0x14 +0003F622 USER32.dll!GetMessageW+0x22 +0002D384 ConEmuHk64.dll!SetLoadLibraryCallback+0xD914 +0035EDA2 Far.exe!wm_listener::WindowThreadRoutine(class os::concurrency::event const & __ptr64) __ptr64+0x662 (wm_listener.obj) +0035F70B Far.exe!os::concurrency::thread::wrapper >(void (__cdecl wm_listener::*&& __ptr64)(class os::concurrency::event const & __ptr64) __ptr64,class wm_listener * __ptr64 && __ptr64,class std::reference_wrapper && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x1B (wm_listener.obj) +0038085A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj) +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000001004 RBX = 000000C86C3FECE0 RCX = 000000C86C3FECE0 RDX = 0000000000000000 RSI = 0000000000000000 RDI = 0000000000000000 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 000000C86C3FECE0 R11 = 000000C86C3FECE0 R12 = 00007FF6EF43A770 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 00007FF6EF86A7F0 RIP = 00007FFC759F1324 RSP = 000000C86C3FEB28 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00001324 win32u.dll!NtUserGetMessage+0x14: 00007ffc`759f1304 c3 ret 00007ffc`759f1305 cd2e int 2Eh 00007ffc`759f1307 c3 ret 00007ffc`759f1308 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserGetMessage: 00007ffc`759f1310 4c8bd1 mov r10,rcx 00007ffc`759f1313 b804100000 mov eax,1004h 00007ffc`759f1318 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`759f1320 7503 jne win32u!NtUserGetMessage+0x15 (00007ffc`759f1325) 00007ffc`759f1322 0f05 syscall 00007ffc`759f1324 c3 ret +0003F622 USER32.dll!GetMessageW+0x22: USER32!GetMessageW: 00007ffc`7868f600 e98f0b4dfd jmp 00007ffc`75b60194 00007ffc`7868f605 50 push rax 00007ffc`7868f606 418bc0 mov eax,r8d 00007ffc`7868f609 488bd9 mov rbx,rcx 00007ffc`7868f60c 410bc1 or eax,r9d 00007ffc`7868f60f a90000feff test eax,0FFFE0000h 00007ffc`7868f614 753b jne USER32!GetMessageW+0x51 (00007ffc`7868f651) 00007ffc`7868f616 48897c2460 mov qword ptr [rsp+60h],rdi 00007ffc`7868f61b 48ff156ec90600 call qword ptr [USER32!gapfnScSendMessage+0x1b50 (00007ffc`786fbf90)] 00007ffc`7868f622 0f1f440000 nop dword ptr [rax+rax] +0002D384 ConEmuHk64.dll!SetLoadLibraryCallback+0xD914: 00007e11`0002d363 488d0dbeffffff lea rcx,[ConEmuHk64!SetLoadLibraryCallback+0xd8b8 (00007e11`0002d328)] 00007e11`0002d36a e8010cffff call ConEmuHk64!GetLoadLibraryW+0x54 (00007e11`0001df70) 00007e11`0002d36f 33ff xor edi,edi 00007e11`0002d371 4885c0 test rax,rax 00007e11`0002d374 7439 je ConEmuHk64!SetLoadLibraryCallback+0xd93f (00007e11`0002d3af) 00007e11`0002d376 448bce mov r9d,esi 00007e11`0002d379 448bc5 mov r8d,ebp 00007e11`0002d37c 498bd6 mov rdx,r14 00007e11`0002d37f 488bcb mov rcx,rbx 00007e11`0002d382 ffd0 call rax 00007e11`0002d384 8bf8 mov edi,eax +0035EDA2 Far.exe!wm_listener::WindowThreadRoutine(class os::concurrency::event const & __ptr64) __ptr64+0x662 (wm_listener.obj): 00007ff6`ef78ed7c 8bce mov ecx,esi 00007ff6`ef78ed7e e88dd6daff call Far+0x10c410 (00007ff6`ef53c410) 00007ff6`ef78ed83 84c0 test al,al 00007ff6`ef78ed85 0f85fb010000 jne Far+0x35ef86 (00007ff6`ef78ef86) 00007ff6`ef78ed8b 0f1f440000 nop dword ptr [rax+rax] 00007ff6`ef78ed90 4533c9 xor r9d,r9d 00007ff6`ef78ed93 4533c0 xor r8d,r8d 00007ff6`ef78ed96 33d2 xor edx,edx 00007ff6`ef78ed98 488d4d00 lea rcx,[rbp] 00007ff6`ef78ed9c ff150efd0600 call qword ptr [Far+0x3ceab0 (00007ff6`ef7feab0)] 00007ff6`ef78eda2 85c0 test eax,eax +0035F70B Far.exe!os::concurrency::thread::wrapper >(void (__cdecl wm_listener::*&& __ptr64)(class os::concurrency::event const & __ptr64) __ptr64,class wm_listener * __ptr64 && __ptr64,class std::reference_wrapper && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x1B (wm_listener.obj): 00007ff6`ef78f6ee 5e pop rsi 00007ff6`ef78f6ef c3 ret 00007ff6`ef78f6f0 4053 push rbx 00007ff6`ef78f6f2 4883ec20 sub rsp,20h 00007ff6`ef78f6f6 488bd9 mov rbx,rcx 00007ff6`ef78f6f9 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`ef78f6fe 488b01 mov rax,qword ptr [rcx] 00007ff6`ef78f701 488b5108 mov rdx,qword ptr [rcx+8] 00007ff6`ef78f705 488b4910 mov rcx,qword ptr [rcx+10h] 00007ff6`ef78f709 ffd0 call rax 00007ff6`ef78f70b 90 nop +0038085A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj): 00007ff6`ef7b0831 7510 jne Far+0x380843 (00007ff6`ef7b0843) 00007ff6`ef7b0833 8d48ff lea ecx,[rax-1] 00007ff6`ef7b0836 e8ed230100 call Far+0x392c28 (00007ff6`ef7c2c28) 00007ff6`ef7b083b 85c0 test eax,eax 00007ff6`ef7b083d 0f94c0 sete al 00007ff6`ef7b0840 884320 mov byte ptr [rbx+20h],al 00007ff6`ef7b0843 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`ef7b084d 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`ef7b0851 488b03 mov rax,qword ptr [rbx] 00007ff6`ef7b0854 ff151ee60400 call qword ptr [Far+0x3cee78 (00007ff6`ef7fee78)] 00007ff6`ef7b085a 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`780fe8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`780fe8c0 4053 push rbx 00007ffc`780fe8c2 4883ec20 sub rsp,20h 00007ffc`780fe8c6 33db xor ebx,ebx 00007ffc`780fe8c8 85c9 test ecx,ecx 00007ffc`780fe8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`780fe8e6) 00007ffc`780fe8cc 498bc8 mov rcx,r8 00007ffc`780fe8cf 488bc2 mov rax,rdx 00007ffc`780fe8d2 e839770500 call KERNEL32!TlsGetValue+0x1b00 (00007ffc`78156010) 00007ffc`780fe8d7 8bc8 mov ecx,eax +0008C53C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`788ec517 488b05c2621400 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x40f0 (00007ffc`78a327e0)] 00007ffc`788ec51e 4885c0 test rax,rax 00007ffc`788ec521 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`788ec547) 00007ffc`788ec523 488d0d5613f8ff lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7886d880)] 00007ffc`788ec52a 4c8bc2 mov r8,rdx 00007ffc`788ec52d 498bd1 mov rdx,r9 00007ffc`788ec530 483bc1 cmp rax,rcx 00007ffc`788ec533 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`788ec53e) 00007ffc`788ec535 33c9 xor ecx,ecx 00007ffc`788ec537 e8e45a0e00 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`789d2020) 00007ffc`788ec53c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`788ec566) ====================================================================== Thread 6272 / 0x1880 (FS watcher) ====================================================================== LastError: 0x000003FE - Požadavek na změnu oznámení se dokončuje a do vyrovnávací paměti volajícího se nevrací žádná informace. Volající nyní potřebuje provést výčet souborů a zjistit tak změny. NTSTATUS: 0x0000010C - Požadavek na změnu oznámení je dokončován a do vyrovnávací paměti volajícího se nevrací žádná informace. Volající teď potřebuje provést výčet souborů, aby zjistil změny. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00162744 ntdll.dll!NtWaitForMultipleObjects+0x14 +00039333 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123 +00039201 KERNELBASE.dll!WaitForMultipleObjects+0x11 +0002BD63 ConEmuHk64.dll!SetLoadLibraryCallback+0xC2F3 +0025F223 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj) +0019B901 Far.exe!background_watcher::process(void) __ptr64+0x2A1 (filesystemwatcher.obj) +0019D424 Far.exe!os::concurrency::thread::wrapper(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x14 (findfile.obj) +0038085A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj) +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000002 RCX = 0000000000000002 RDX = 000002B9A7E0BF60 RSI = 0000000000000000 RDI = 0000000000000002 R8 = 0000000000000001 R9 = 0000000000000000 R10 = 0000000000000002 R11 = 0000000000000002 R12 = 000002B9A7E0BF60 R13 = 000000C86C0FB000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFC789C2744 RSP = 000000C86C4FF1B8 RBP = 000000C86C4FF599 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00162744 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffc`789c271f 00e9 add cl,ch 00007ffc`789c2721 cb retf 00007ffc`789c2722 b9f8ff6666 mov ecx,6666FFF8h 00007ffc`789c2727 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffc`789c2730 4c8bd1 mov r10,rcx 00007ffc`789c2733 b85b000000 mov eax,5Bh 00007ffc`789c2738 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`789c2740 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffc`789c2745) 00007ffc`789c2742 0f05 syscall 00007ffc`789c2744 c3 ret +00039333 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123: 00007ffc`75bb930a 488d742440 lea rsi,[rsp+40h] 00007ffc`75bb930f 448b7c2438 mov r15d,dword ptr [rsp+38h] 00007ffc`75bb9314 4533c0 xor r8d,r8d 00007ffc`75bb9317 4585ff test r15d,r15d 00007ffc`75bb931a 410f94c0 sete r8b 00007ffc`75bb931e 4889742420 mov qword ptr [rsp+20h],rsi 00007ffc`75bb9323 450fb6ce movzx r9d,r14b 00007ffc`75bb9327 498bd4 mov rdx,r12 00007ffc`75bb932a 8bcb mov ecx,ebx 00007ffc`75bb932c 48ff1545af2500 call qword ptr [KERNELBASE!TlsGetValue+0xfdb88 (00007ffc`75e14278)] 00007ffc`75bb9333 0f1f440000 nop dword ptr [rax+rax] +00039201 KERNELBASE.dll!WaitForMultipleObjects+0x11: 00007ffc`75bb91ec cc int 3 00007ffc`75bb91ed cc int 3 00007ffc`75bb91ee cc int 3 00007ffc`75bb91ef cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffc`75bb91f0 e9257ba802 jmp 00007ffc`78640d1a 00007ffc`75bb91f5 442420 and al,20h 00007ffc`75bb91f8 0000 add byte ptr [rax],al 00007ffc`75bb91fa 0000 add byte ptr [rax],al 00007ffc`75bb91fc e80f000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffc`75bb9210) 00007ffc`75bb9201 4883c438 add rsp,38h +0002BD63 ConEmuHk64.dll!SetLoadLibraryCallback+0xC2F3: 00007e11`0002bd42 4c8965cf mov qword ptr [rbp-31h],r12 00007e11`0002bd46 ff5078 call qword ptr [rax+78h] 00007e11`0002bd49 8bcb mov ecx,ebx 00007e11`0002bd4b 41b501 mov r13b,1 00007e11`0002bd4e ff1504630200 call qword ptr [ConEmuHk64!SetLoadLibraryCallback+0x325e8 (00007e11`00052058)] 00007e11`0002bd54 458bcc mov r9d,r12d 00007e11`0002bd57 458bc7 mov r8d,r15d 00007e11`0002bd5a 488bd6 mov rdx,rsi 00007e11`0002bd5d 418bce mov ecx,r14d 00007e11`0002bd60 ff5597 call qword ptr [rbp-69h] 00007e11`0002bd63 894587 mov dword ptr [rbp-79h],eax +0025F223 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj): 00007ff6`ef68f1f2 4881ec00010000 sub rsp,100h 00007ff6`ef68f1f9 488b0540402400 mov rax,qword ptr [Far+0x4a3240 (00007ff6`ef8d3240)] 00007ff6`ef68f200 4833c4 xor rax,rsp 00007ff6`ef68f203 48898424f0000000 mov qword ptr [rsp+0F0h],rax 00007ff6`ef68f20b 488b5908 mov rbx,qword ptr [rcx+8] 00007ff6`ef68f20f 41b9ffffffff mov r9d,0FFFFFFFFh 00007ff6`ef68f215 4533c0 xor r8d,r8d 00007ff6`ef68f218 488b11 mov rdx,qword ptr [rcx] 00007ff6`ef68f21b 8bcb mov ecx,ebx 00007ff6`ef68f21d ff1515f11600 call qword ptr [Far+0x3ce338 (00007ff6`ef7fe338)] 00007ff6`ef68f223 8bc8 mov ecx,eax +0019B901 Far.exe!background_watcher::process(void) __ptr64+0x2A1 (filesystemwatcher.obj): 00007ff6`ef5cb8d6 488b4c2438 mov rcx,qword ptr [rsp+38h] 00007ff6`ef5cb8db 488b442430 mov rax,qword ptr [rsp+30h] 00007ff6`ef5cb8e0 482bc8 sub rcx,rax 00007ff6`ef5cb8e3 48c1f903 sar rcx,3 00007ff6`ef5cb8e7 488945c0 mov qword ptr [rbp-40h],rax 00007ff6`ef5cb8eb 48894dc8 mov qword ptr [rbp-38h],rcx 00007ff6`ef5cb8ef 0f2845c0 movaps xmm0,xmmword ptr [rbp-40h] 00007ff6`ef5cb8f3 660f7f4580 movdqa xmmword ptr [rbp-80h],xmm0 00007ff6`ef5cb8f8 488d4d80 lea rcx,[rbp-80h] 00007ff6`ef5cb8fc e8ef380c00 call Far+0x25f1f0 (00007ff6`ef68f1f0) 00007ff6`ef5cb901 4c8be0 mov r12,rax +0019D424 Far.exe!os::concurrency::thread::wrapper(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x14 (findfile.obj): 00007ff6`ef5cd40c cc int 3 00007ff6`ef5cd40d cc int 3 00007ff6`ef5cd40e cc int 3 00007ff6`ef5cd40f cc int 3 00007ff6`ef5cd410 4053 push rbx 00007ff6`ef5cd412 4883ec20 sub rsp,20h 00007ff6`ef5cd416 488bd9 mov rbx,rcx 00007ff6`ef5cd419 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`ef5cd41e 488b4908 mov rcx,qword ptr [rcx+8] 00007ff6`ef5cd422 ff13 call qword ptr [rbx] 00007ff6`ef5cd424 90 nop +0038085A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj): 00007ff6`ef7b0831 7510 jne Far+0x380843 (00007ff6`ef7b0843) 00007ff6`ef7b0833 8d48ff lea ecx,[rax-1] 00007ff6`ef7b0836 e8ed230100 call Far+0x392c28 (00007ff6`ef7c2c28) 00007ff6`ef7b083b 85c0 test eax,eax 00007ff6`ef7b083d 0f94c0 sete al 00007ff6`ef7b0840 884320 mov byte ptr [rbx+20h],al 00007ff6`ef7b0843 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`ef7b084d 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`ef7b0851 488b03 mov rax,qword ptr [rbx] 00007ff6`ef7b0854 ff151ee60400 call qword ptr [Far+0x3cee78 (00007ff6`ef7fee78)] 00007ff6`ef7b085a 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`780fe8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`780fe8c0 4053 push rbx 00007ffc`780fe8c2 4883ec20 sub rsp,20h 00007ffc`780fe8c6 33db xor ebx,ebx 00007ffc`780fe8c8 85c9 test ecx,ecx 00007ffc`780fe8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`780fe8e6) 00007ffc`780fe8cc 498bc8 mov rcx,r8 00007ffc`780fe8cf 488bc2 mov rax,rdx 00007ffc`780fe8d2 e839770500 call KERNEL32!TlsGetValue+0x1b00 (00007ffc`78156010) 00007ffc`780fe8d7 8bc8 mov ecx,eax +0008C53C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`788ec517 488b05c2621400 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x40f0 (00007ffc`78a327e0)] 00007ffc`788ec51e 4885c0 test rax,rax 00007ffc`788ec521 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`788ec547) 00007ffc`788ec523 488d0d5613f8ff lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7886d880)] 00007ffc`788ec52a 4c8bc2 mov r8,rdx 00007ffc`788ec52d 498bd1 mov rdx,r9 00007ffc`788ec530 483bc1 cmp rax,rcx 00007ffc`788ec533 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`788ec53e) 00007ffc`788ec535 33c9 xor ecx,ecx 00007ffc`788ec537 e8e45a0e00 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`789d2020) 00007ffc`788ec53c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`788ec566) ====================================================================== Thread 21952 / 0x55C0 (Taskbar processor) ====================================================================== LastError: 0x00000000 - Operace byla dokončena úspěšně. NTSTATUS: 0xC0000034 - Název objektu nebyl nalezen. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00162744 ntdll.dll!NtWaitForMultipleObjects+0x14 +00039333 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123 +00039201 KERNELBASE.dll!WaitForMultipleObjects+0x11 +0002BD63 ConEmuHk64.dll!SetLoadLibraryCallback+0xC2F3 +0025F223 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj) +0031E836 Far.exe!taskbar_impl::handler(void)const __ptr64+0x346 (taskbar.obj) +0019D424 Far.exe!os::concurrency::thread::wrapper(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x14 (findfile.obj) +0038085A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj) +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000003 RCX = 0000000000000003 RDX = 000000C86C5FFD48 RSI = 0000000000000000 RDI = 0000000000000003 R8 = 0000000000000001 R9 = 0000000000000000 R10 = 0000000000000003 R11 = 0000000000000003 R12 = 000000C86C5FFD48 R13 = 000000C86C0FB000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFC789C2744 RSP = 000000C86C5FF798 RBP = 000000C86C5FFB79 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00162744 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffc`789c271f 00e9 add cl,ch 00007ffc`789c2721 cb retf 00007ffc`789c2722 b9f8ff6666 mov ecx,6666FFF8h 00007ffc`789c2727 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffc`789c2730 4c8bd1 mov r10,rcx 00007ffc`789c2733 b85b000000 mov eax,5Bh 00007ffc`789c2738 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`789c2740 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffc`789c2745) 00007ffc`789c2742 0f05 syscall 00007ffc`789c2744 c3 ret +00039333 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123: 00007ffc`75bb930a 488d742440 lea rsi,[rsp+40h] 00007ffc`75bb930f 448b7c2438 mov r15d,dword ptr [rsp+38h] 00007ffc`75bb9314 4533c0 xor r8d,r8d 00007ffc`75bb9317 4585ff test r15d,r15d 00007ffc`75bb931a 410f94c0 sete r8b 00007ffc`75bb931e 4889742420 mov qword ptr [rsp+20h],rsi 00007ffc`75bb9323 450fb6ce movzx r9d,r14b 00007ffc`75bb9327 498bd4 mov rdx,r12 00007ffc`75bb932a 8bcb mov ecx,ebx 00007ffc`75bb932c 48ff1545af2500 call qword ptr [KERNELBASE!TlsGetValue+0xfdb88 (00007ffc`75e14278)] 00007ffc`75bb9333 0f1f440000 nop dword ptr [rax+rax] +00039201 KERNELBASE.dll!WaitForMultipleObjects+0x11: 00007ffc`75bb91ec cc int 3 00007ffc`75bb91ed cc int 3 00007ffc`75bb91ee cc int 3 00007ffc`75bb91ef cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffc`75bb91f0 e9257ba802 jmp 00007ffc`78640d1a 00007ffc`75bb91f5 442420 and al,20h 00007ffc`75bb91f8 0000 add byte ptr [rax],al 00007ffc`75bb91fa 0000 add byte ptr [rax],al 00007ffc`75bb91fc e80f000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffc`75bb9210) 00007ffc`75bb9201 4883c438 add rsp,38h +0002BD63 ConEmuHk64.dll!SetLoadLibraryCallback+0xC2F3: 00007e11`0002bd42 4c8965cf mov qword ptr [rbp-31h],r12 00007e11`0002bd46 ff5078 call qword ptr [rax+78h] 00007e11`0002bd49 8bcb mov ecx,ebx 00007e11`0002bd4b 41b501 mov r13b,1 00007e11`0002bd4e ff1504630200 call qword ptr [ConEmuHk64!SetLoadLibraryCallback+0x325e8 (00007e11`00052058)] 00007e11`0002bd54 458bcc mov r9d,r12d 00007e11`0002bd57 458bc7 mov r8d,r15d 00007e11`0002bd5a 488bd6 mov rdx,rsi 00007e11`0002bd5d 418bce mov ecx,r14d 00007e11`0002bd60 ff5597 call qword ptr [rbp-69h] 00007e11`0002bd63 894587 mov dword ptr [rbp-79h],eax +0025F223 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj): 00007ff6`ef68f1f2 4881ec00010000 sub rsp,100h 00007ff6`ef68f1f9 488b0540402400 mov rax,qword ptr [Far+0x4a3240 (00007ff6`ef8d3240)] 00007ff6`ef68f200 4833c4 xor rax,rsp 00007ff6`ef68f203 48898424f0000000 mov qword ptr [rsp+0F0h],rax 00007ff6`ef68f20b 488b5908 mov rbx,qword ptr [rcx+8] 00007ff6`ef68f20f 41b9ffffffff mov r9d,0FFFFFFFFh 00007ff6`ef68f215 4533c0 xor r8d,r8d 00007ff6`ef68f218 488b11 mov rdx,qword ptr [rcx] 00007ff6`ef68f21b 8bcb mov ecx,ebx 00007ff6`ef68f21d ff1515f11600 call qword ptr [Far+0x3ce338 (00007ff6`ef7fe338)] 00007ff6`ef68f223 8bc8 mov ecx,eax +0031E836 Far.exe!taskbar_impl::handler(void)const __ptr64+0x346 (taskbar.obj): 00007ff6`ef74e807 660f1f840000000000 nop word ptr [rax+rax] 00007ff6`ef74e810 498b4718 mov rax,qword ptr [r15+18h] 00007ff6`ef74e814 488945cf mov qword ptr [rbp-31h],rax 00007ff6`ef74e818 498b4720 mov rax,qword ptr [r15+20h] 00007ff6`ef74e81c 488945d7 mov qword ptr [rbp-29h],rax 00007ff6`ef74e820 498b4728 mov rax,qword ptr [r15+28h] 00007ff6`ef74e824 488945df mov qword ptr [rbp-21h],rax 00007ff6`ef74e828 660f7f75b7 movdqa xmmword ptr [rbp-49h],xmm6 00007ff6`ef74e82d 488d4db7 lea rcx,[rbp-49h] 00007ff6`ef74e831 e8ba09f4ff call Far+0x25f1f0 (00007ff6`ef68f1f0) 00007ff6`ef74e836 4885c0 test rax,rax +0019D424 Far.exe!os::concurrency::thread::wrapper(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x14 (findfile.obj): 00007ff6`ef5cd40c cc int 3 00007ff6`ef5cd40d cc int 3 00007ff6`ef5cd40e cc int 3 00007ff6`ef5cd40f cc int 3 00007ff6`ef5cd410 4053 push rbx 00007ff6`ef5cd412 4883ec20 sub rsp,20h 00007ff6`ef5cd416 488bd9 mov rbx,rcx 00007ff6`ef5cd419 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`ef5cd41e 488b4908 mov rcx,qword ptr [rcx+8] 00007ff6`ef5cd422 ff13 call qword ptr [rbx] 00007ff6`ef5cd424 90 nop +0038085A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj): 00007ff6`ef7b0831 7510 jne Far+0x380843 (00007ff6`ef7b0843) 00007ff6`ef7b0833 8d48ff lea ecx,[rax-1] 00007ff6`ef7b0836 e8ed230100 call Far+0x392c28 (00007ff6`ef7c2c28) 00007ff6`ef7b083b 85c0 test eax,eax 00007ff6`ef7b083d 0f94c0 sete al 00007ff6`ef7b0840 884320 mov byte ptr [rbx+20h],al 00007ff6`ef7b0843 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`ef7b084d 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`ef7b0851 488b03 mov rax,qword ptr [rbx] 00007ff6`ef7b0854 ff151ee60400 call qword ptr [Far+0x3cee78 (00007ff6`ef7fee78)] 00007ff6`ef7b085a 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`780fe8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`780fe8c0 4053 push rbx 00007ffc`780fe8c2 4883ec20 sub rsp,20h 00007ffc`780fe8c6 33db xor ebx,ebx 00007ffc`780fe8c8 85c9 test ecx,ecx 00007ffc`780fe8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`780fe8e6) 00007ffc`780fe8cc 498bc8 mov rcx,r8 00007ffc`780fe8cf 488bc2 mov rax,rdx 00007ffc`780fe8d2 e839770500 call KERNEL32!TlsGetValue+0x1b00 (00007ffc`78156010) 00007ffc`780fe8d7 8bc8 mov ecx,eax +0008C53C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`788ec517 488b05c2621400 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x40f0 (00007ffc`78a327e0)] 00007ffc`788ec51e 4885c0 test rax,rax 00007ffc`788ec521 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`788ec547) 00007ffc`788ec523 488d0d5613f8ff lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7886d880)] 00007ffc`788ec52a 4c8bc2 mov r8,rdx 00007ffc`788ec52d 498bd1 mov rdx,r9 00007ffc`788ec530 483bc1 cmp rax,rcx 00007ffc`788ec533 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`788ec53e) 00007ffc`788ec535 33c9 xor ecx,ecx 00007ffc`788ec537 e8e45a0e00 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`789d2020) 00007ffc`788ec53c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`788ec566) ====================================================================== Thread 22872 / 0x5958 ====================================================================== LastError: 0x00000000 - Operace byla dokončena úspěšně. NTSTATUS: 0xC000000D - Službě nebo funkci byl předán neplatný parametr. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00162744 ntdll.dll!NtWaitForMultipleObjects+0x14 +00039333 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123 +000ED34E combase.dll!CoLockObjectExternal+0x2FAE +0012CC21 combase.dll!RoParameterizedTypeExtraGetTypeSignature+0x231 +0012CAD9 combase.dll!RoParameterizedTypeExtraGetTypeSignature+0xE9 +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000001 RCX = 0000000000000001 RDX = 000000C86C6FFBB0 RSI = 0000000000000000 RDI = 0000000000000001 R8 = 0000000000000001 R9 = 0000000000000000 R10 = 0000000000000001 R11 = 0000000000000001 R12 = 000000C86C6FFBB0 R13 = 000000C86C0FB000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFC789C2744 RSP = 000000C86C6FF868 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00162744 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffc`789c271f 00e9 add cl,ch 00007ffc`789c2721 cb retf 00007ffc`789c2722 b9f8ff6666 mov ecx,6666FFF8h 00007ffc`789c2727 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffc`789c2730 4c8bd1 mov r10,rcx 00007ffc`789c2733 b85b000000 mov eax,5Bh 00007ffc`789c2738 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`789c2740 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffc`789c2745) 00007ffc`789c2742 0f05 syscall 00007ffc`789c2744 c3 ret +00039333 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123: 00007ffc`75bb930a 488d742440 lea rsi,[rsp+40h] 00007ffc`75bb930f 448b7c2438 mov r15d,dword ptr [rsp+38h] 00007ffc`75bb9314 4533c0 xor r8d,r8d 00007ffc`75bb9317 4585ff test r15d,r15d 00007ffc`75bb931a 410f94c0 sete r8b 00007ffc`75bb931e 4889742420 mov qword ptr [rsp+20h],rsi 00007ffc`75bb9323 450fb6ce movzx r9d,r14b 00007ffc`75bb9327 498bd4 mov rdx,r12 00007ffc`75bb932a 8bcb mov ecx,ebx 00007ffc`75bb932c 48ff1545af2500 call qword ptr [KERNELBASE!TlsGetValue+0xfdb88 (00007ffc`75e14278)] 00007ffc`75bb9333 0f1f440000 nop dword ptr [rax+rax] +000ED34E combase.dll!CoLockObjectExternal+0x2FAE: 00007ffc`7790d32b 1579090083 adc eax,83000979h 00007ffc`7790d330 642420 and al,20h 00007ffc`7790d333 00488d add byte ptr [rax-73h],cl 00007ffc`7790d336 54 push rsp 00007ffc`7790d337 2450 and al,50h 00007ffc`7790d339 4533c0 xor r8d,r8d 00007ffc`7790d33c 48895c2450 mov qword ptr [rsp+50h],rbx 00007ffc`7790d341 4183c9ff or r9d,0FFFFFFFFh 00007ffc`7790d345 418d4801 lea ecx,[r8+1] 00007ffc`7790d349 e8c2800900 call combase!HDC_UserFree+0x1c50 (00007ffc`779a5410) 00007ffc`7790d34e 4084ff test dil,dil +0012CC21 combase.dll!RoParameterizedTypeExtraGetTypeSignature+0x231: 00007ffc`7794cbee 0f8533010000 jne combase!RoParameterizedTypeExtraGetTypeSignature+0x337 (00007ffc`7794cd27) 00007ffc`7794cbf4 458d7e01 lea r15d,[r14+1] 00007ffc`7794cbf8 65488b042530000000 mov rax,qword ptr gs:[30h] 00007ffc`7794cc01 488b8058170000 mov rax,qword ptr [rax+1758h] 00007ffc`7794cc08 4885c0 test rax,rax 00007ffc`7794cc0b 7407 je combase!RoParameterizedTypeExtraGetTypeSignature+0x224 (00007ffc`7794cc14) 00007ffc`7794cc0d 4489b038010000 mov dword ptr [rax+138h],r14d 00007ffc`7794cc14 488b4b18 mov rcx,qword ptr [rbx+18h] 00007ffc`7794cc18 488b4310 mov rax,qword ptr [rbx+10h] 00007ffc`7794cc1c e8efa31300 call combase!ObjectStublessClient32+0x279c0 (00007ffc`77a87010) 00007ffc`7794cc21 48ff15a0e81700 call qword ptr [combase!ObjectStublessClient32+0x6be78 (00007ffc`77acb4c8)] +0012CAD9 combase.dll!RoParameterizedTypeExtraGetTypeSignature+0xE9: 00007ffc`7794cab0 48895c2408 mov qword ptr [rsp+8],rbx 00007ffc`7794cab5 57 push rdi 00007ffc`7794cab6 4883ec20 sub rsp,20h 00007ffc`7794caba 488bf9 mov rdi,rcx 00007ffc`7794cabd 48ff153cea1700 call qword ptr [combase!ObjectStublessClient32+0x6beb0 (00007ffc`77acb500)] 00007ffc`7794cac4 0f1f440000 nop dword ptr [rax+rax] 00007ffc`7794cac9 894728 mov dword ptr [rdi+28h],eax 00007ffc`7794cacc e833000000 call combase!RoParameterizedTypeExtraGetTypeSignature+0x114 (00007ffc`7794cb04) 00007ffc`7794cad1 488bcf mov rcx,rdi 00007ffc`7794cad4 e8fb000000 call combase!RoParameterizedTypeExtraGetTypeSignature+0x1e4 (00007ffc`7794cbd4) 00007ffc`7794cad9 488b5f30 mov rbx,qword ptr [rdi+30h] +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`780fe8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`780fe8c0 4053 push rbx 00007ffc`780fe8c2 4883ec20 sub rsp,20h 00007ffc`780fe8c6 33db xor ebx,ebx 00007ffc`780fe8c8 85c9 test ecx,ecx 00007ffc`780fe8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`780fe8e6) 00007ffc`780fe8cc 498bc8 mov rcx,r8 00007ffc`780fe8cf 488bc2 mov rax,rdx 00007ffc`780fe8d2 e839770500 call KERNEL32!TlsGetValue+0x1b00 (00007ffc`78156010) 00007ffc`780fe8d7 8bc8 mov ecx,eax +0008C53C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`788ec517 488b05c2621400 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x40f0 (00007ffc`78a327e0)] 00007ffc`788ec51e 4885c0 test rax,rax 00007ffc`788ec521 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`788ec547) 00007ffc`788ec523 488d0d5613f8ff lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7886d880)] 00007ffc`788ec52a 4c8bc2 mov r8,rdx 00007ffc`788ec52d 498bd1 mov rdx,r9 00007ffc`788ec530 483bc1 cmp rax,rcx 00007ffc`788ec533 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`788ec53e) 00007ffc`788ec535 33c9 xor ecx,ecx 00007ffc`788ec537 e8e45a0e00 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`789d2020) 00007ffc`788ec53c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`788ec566) ====================================================================== Thread 23048 / 0x5A08 ====================================================================== LastError: 0x000000EA - Jsou k dispozici další data. NTSTATUS: 0x80000005 - {Přetečení vyrovnávací paměti} Data byla příliš rozsáhlá a nevešla se do zadané vyrovnávací paměti. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +001658A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +00075F3E ntdll.dll!RtlSetThreadSubProcessTag+0x1AEE +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001E6 RBX = 000002B9A7F740C0 RCX = 0000000000000020 RDX = 000002B9A7F73D40 RSI = 00007FFC788D4EA0 RDI = 000002B9A7103280 R8 = 0000000000000010 R9 = 000000C86C7FF918 R10 = 0000000000000020 R11 = 0000000000000020 R12 = 00007FFC78938330 R13 = 0000000000000000 R14 = 000000000000FFFF R15 = 00007FFC788D2C10 RIP = 00007FFC789C58A4 RSP = 000000C86C7FF8B8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +001658A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffc`789c5884 c3 ret 00007ffc`789c5885 cd2e int 2Eh 00007ffc`789c5887 c3 ret 00007ffc`789c5888 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffc`789c5890 4c8bd1 mov r10,rcx 00007ffc`789c5893 b8e6010000 mov eax,1E6h 00007ffc`789c5898 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`789c58a0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffc`789c58a5) 00007ffc`789c58a2 0f05 syscall 00007ffc`789c58a4 c3 ret +00075F3E ntdll.dll!RtlSetThreadSubProcessTag+0x1AEE: 00007ffc`788d5f06 488b03 mov rax,qword ptr [rbx] 00007ffc`788d5f09 4889842488000000 mov qword ptr [rsp+88h],rax 00007ffc`788d5f11 44896c2458 mov dword ptr [rsp+58h],r13d 00007ffc`788d5f16 488d842468020000 lea rax,[rsp+268h] 00007ffc`788d5f1e 4889442420 mov qword ptr [rsp+20h],rax 00007ffc`788d5f23 4c8d4c2458 lea r9,[rsp+58h] 00007ffc`788d5f28 448b442454 mov r8d,dword ptr [rsp+54h] 00007ffc`788d5f2d 488b942488000000 mov rdx,qword ptr [rsp+88h] 00007ffc`788d5f35 488b4f38 mov rcx,qword ptr [rdi+38h] 00007ffc`788d5f39 e852f90e00 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffc`789c5890) 00007ffc`788d5f3e 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`780fe8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`780fe8c0 4053 push rbx 00007ffc`780fe8c2 4883ec20 sub rsp,20h 00007ffc`780fe8c6 33db xor ebx,ebx 00007ffc`780fe8c8 85c9 test ecx,ecx 00007ffc`780fe8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`780fe8e6) 00007ffc`780fe8cc 498bc8 mov rcx,r8 00007ffc`780fe8cf 488bc2 mov rax,rdx 00007ffc`780fe8d2 e839770500 call KERNEL32!TlsGetValue+0x1b00 (00007ffc`78156010) 00007ffc`780fe8d7 8bc8 mov ecx,eax +0008C53C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`788ec517 488b05c2621400 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x40f0 (00007ffc`78a327e0)] 00007ffc`788ec51e 4885c0 test rax,rax 00007ffc`788ec521 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`788ec547) 00007ffc`788ec523 488d0d5613f8ff lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7886d880)] 00007ffc`788ec52a 4c8bc2 mov r8,rdx 00007ffc`788ec52d 498bd1 mov rdx,r9 00007ffc`788ec530 483bc1 cmp rax,rcx 00007ffc`788ec533 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`788ec53e) 00007ffc`788ec535 33c9 xor ecx,ecx 00007ffc`788ec537 e8e45a0e00 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`789d2020) 00007ffc`788ec53c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`788ec566) ====================================================================== Thread 9124 / 0x23A4 ====================================================================== LastError: 0x00000000 - Operace byla dokončena úspěšně. NTSTATUS: 0x00000000 - STATUS_SUCCESS ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +001658A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +00075F3E ntdll.dll!RtlSetThreadSubProcessTag+0x1AEE +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001E6 RBX = 000002B9A7F76140 RCX = 0000000000000020 RDX = 000002B9A7F75DC0 RSI = 00007FFC788D4EA0 RDI = 000002B9A7103280 R8 = 0000000000000010 R9 = 000000C86C8FFC38 R10 = 0000000000000020 R11 = 0000000000000020 R12 = 00007FFC78938330 R13 = 0000000000000000 R14 = 000000000000FFFF R15 = 00007FFC788D2C10 RIP = 00007FFC789C58A4 RSP = 000000C86C8FFBD8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +001658A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffc`789c5884 c3 ret 00007ffc`789c5885 cd2e int 2Eh 00007ffc`789c5887 c3 ret 00007ffc`789c5888 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffc`789c5890 4c8bd1 mov r10,rcx 00007ffc`789c5893 b8e6010000 mov eax,1E6h 00007ffc`789c5898 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`789c58a0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffc`789c58a5) 00007ffc`789c58a2 0f05 syscall 00007ffc`789c58a4 c3 ret +00075F3E ntdll.dll!RtlSetThreadSubProcessTag+0x1AEE: 00007ffc`788d5f06 488b03 mov rax,qword ptr [rbx] 00007ffc`788d5f09 4889842488000000 mov qword ptr [rsp+88h],rax 00007ffc`788d5f11 44896c2458 mov dword ptr [rsp+58h],r13d 00007ffc`788d5f16 488d842468020000 lea rax,[rsp+268h] 00007ffc`788d5f1e 4889442420 mov qword ptr [rsp+20h],rax 00007ffc`788d5f23 4c8d4c2458 lea r9,[rsp+58h] 00007ffc`788d5f28 448b442454 mov r8d,dword ptr [rsp+54h] 00007ffc`788d5f2d 488b942488000000 mov rdx,qword ptr [rsp+88h] 00007ffc`788d5f35 488b4f38 mov rcx,qword ptr [rdi+38h] 00007ffc`788d5f39 e852f90e00 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffc`789c5890) 00007ffc`788d5f3e 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`780fe8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`780fe8c0 4053 push rbx 00007ffc`780fe8c2 4883ec20 sub rsp,20h 00007ffc`780fe8c6 33db xor ebx,ebx 00007ffc`780fe8c8 85c9 test ecx,ecx 00007ffc`780fe8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`780fe8e6) 00007ffc`780fe8cc 498bc8 mov rcx,r8 00007ffc`780fe8cf 488bc2 mov rax,rdx 00007ffc`780fe8d2 e839770500 call KERNEL32!TlsGetValue+0x1b00 (00007ffc`78156010) 00007ffc`780fe8d7 8bc8 mov ecx,eax +0008C53C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`788ec517 488b05c2621400 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x40f0 (00007ffc`78a327e0)] 00007ffc`788ec51e 4885c0 test rax,rax 00007ffc`788ec521 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`788ec547) 00007ffc`788ec523 488d0d5613f8ff lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7886d880)] 00007ffc`788ec52a 4c8bc2 mov r8,rdx 00007ffc`788ec52d 498bd1 mov rdx,r9 00007ffc`788ec530 483bc1 cmp rax,rcx 00007ffc`788ec533 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`788ec53e) 00007ffc`788ec535 33c9 xor ecx,ecx 00007ffc`788ec537 e8e45a0e00 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`789d2020) 00007ffc`788ec53c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`788ec566) ====================================================================== Thread 7212 / 0x1C2C ====================================================================== LastError: 0x000003F0 - Byl proveden pokus o odkaz na neexistující token. NTSTATUS: 0xC000007C - Došlo k pokusu odkázat se na token, který neexistuje. Většinou k tomu dochází odkazem na token, který je přidružen k vláknu nezosobňujícímu žádného klienta. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00001324 win32u.dll!NtUserGetMessage+0x14 +0003F622 USER32.dll!GetMessageW+0x22 +0002D384 ConEmuHk64.dll!SetLoadLibraryCallback+0xD914 +0012B8EE combase.dll!CoGetMarshalSizeMax+0x71E +000A361F combase.dll!CoDisconnectObject+0x74F +0012CC21 combase.dll!RoParameterizedTypeExtraGetTypeSignature+0x231 +0012CAD9 combase.dll!RoParameterizedTypeExtraGetTypeSignature+0xE9 +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000001004 RBX = 000000C86C9FF940 RCX = 000000C86C9FF940 RDX = 0000000000000000 RSI = 0000000000000000 RDI = 0000000000000000 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 000000C86C9FF940 R11 = 000000C86C9FF940 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000001 RIP = 00007FFC759F1324 RSP = 000000C86C9FF858 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00001324 win32u.dll!NtUserGetMessage+0x14: 00007ffc`759f1304 c3 ret 00007ffc`759f1305 cd2e int 2Eh 00007ffc`759f1307 c3 ret 00007ffc`759f1308 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserGetMessage: 00007ffc`759f1310 4c8bd1 mov r10,rcx 00007ffc`759f1313 b804100000 mov eax,1004h 00007ffc`759f1318 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`759f1320 7503 jne win32u!NtUserGetMessage+0x15 (00007ffc`759f1325) 00007ffc`759f1322 0f05 syscall 00007ffc`759f1324 c3 ret +0003F622 USER32.dll!GetMessageW+0x22: USER32!GetMessageW: 00007ffc`7868f600 e98f0b4dfd jmp 00007ffc`75b60194 00007ffc`7868f605 50 push rax 00007ffc`7868f606 418bc0 mov eax,r8d 00007ffc`7868f609 488bd9 mov rbx,rcx 00007ffc`7868f60c 410bc1 or eax,r9d 00007ffc`7868f60f a90000feff test eax,0FFFE0000h 00007ffc`7868f614 753b jne USER32!GetMessageW+0x51 (00007ffc`7868f651) 00007ffc`7868f616 48897c2460 mov qword ptr [rsp+60h],rdi 00007ffc`7868f61b 48ff156ec90600 call qword ptr [USER32!gapfnScSendMessage+0x1b50 (00007ffc`786fbf90)] 00007ffc`7868f622 0f1f440000 nop dword ptr [rax+rax] +0002D384 ConEmuHk64.dll!SetLoadLibraryCallback+0xD914: 00007e11`0002d363 488d0dbeffffff lea rcx,[ConEmuHk64!SetLoadLibraryCallback+0xd8b8 (00007e11`0002d328)] 00007e11`0002d36a e8010cffff call ConEmuHk64!GetLoadLibraryW+0x54 (00007e11`0001df70) 00007e11`0002d36f 33ff xor edi,edi 00007e11`0002d371 4885c0 test rax,rax 00007e11`0002d374 7439 je ConEmuHk64!SetLoadLibraryCallback+0xd93f (00007e11`0002d3af) 00007e11`0002d376 448bce mov r9d,esi 00007e11`0002d379 448bc5 mov r8d,ebp 00007e11`0002d37c 498bd6 mov rdx,r14 00007e11`0002d37f 488bcb mov rcx,rbx 00007e11`0002d382 ffd0 call rax 00007e11`0002d384 8bf8 mov edi,eax +0012B8EE combase.dll!CoGetMarshalSizeMax+0x71E: 00007ffc`7794b8c1 0f57c0 xorps xmm0,xmm0 00007ffc`7794b8c4 488905c52e2000 mov qword ptr [combase!Ordinal183+0x5dbb8 (00007ffc`77b4e790)],rax 00007ffc`7794b8cb 0f11442430 movups xmmword ptr [rsp+30h],xmm0 00007ffc`7794b8d0 0f11442440 movups xmmword ptr [rsp+40h],xmm0 00007ffc`7794b8d5 0f11442450 movups xmmword ptr [rsp+50h],xmm0 00007ffc`7794b8da 4533c9 xor r9d,r9d 00007ffc`7794b8dd 488d4c2430 lea rcx,[rsp+30h] 00007ffc`7794b8e2 4533c0 xor r8d,r8d 00007ffc`7794b8e5 33d2 xor edx,edx 00007ffc`7794b8e7 48ff15fadc2200 call qword ptr [combase!Ordinal183+0x88a10 (00007ffc`77b795e8)] 00007ffc`7794b8ee 0f1f440000 nop dword ptr [rax+rax] +000A361F combase.dll!CoDisconnectObject+0x74F: 00007ffc`778c35f7 894758 mov dword ptr [rdi+58h],eax 00007ffc`778c35fa 48ff15df812000 call qword ptr [combase!ObjectStublessClient32+0x6c190 (00007ffc`77acb7e0)] 00007ffc`778c3601 0f1f440000 nop dword ptr [rax+rax] 00007ffc`778c3606 8b4730 mov eax,dword ptr [rdi+30h] 00007ffc`778c3609 83e01f and eax,1Fh 00007ffc`778c360c 83e801 sub eax,1 00007ffc`778c360f 7409 je combase!CoDisconnectObject+0x74a (00007ffc`778c361a) 00007ffc`778c3611 83f801 cmp eax,1 00007ffc`778c3614 0f8573ffffff jne combase!CoDisconnectObject+0x6bd (00007ffc`778c358d) 00007ffc`778c361a e859820800 call combase!CoGetMarshalSizeMax+0x6a8 (00007ffc`7794b878) 00007ffc`778c361f e969ffffff jmp combase!CoDisconnectObject+0x6bd (00007ffc`778c358d) +0012CC21 combase.dll!RoParameterizedTypeExtraGetTypeSignature+0x231: 00007ffc`7794cbee 0f8533010000 jne combase!RoParameterizedTypeExtraGetTypeSignature+0x337 (00007ffc`7794cd27) 00007ffc`7794cbf4 458d7e01 lea r15d,[r14+1] 00007ffc`7794cbf8 65488b042530000000 mov rax,qword ptr gs:[30h] 00007ffc`7794cc01 488b8058170000 mov rax,qword ptr [rax+1758h] 00007ffc`7794cc08 4885c0 test rax,rax 00007ffc`7794cc0b 7407 je combase!RoParameterizedTypeExtraGetTypeSignature+0x224 (00007ffc`7794cc14) 00007ffc`7794cc0d 4489b038010000 mov dword ptr [rax+138h],r14d 00007ffc`7794cc14 488b4b18 mov rcx,qword ptr [rbx+18h] 00007ffc`7794cc18 488b4310 mov rax,qword ptr [rbx+10h] 00007ffc`7794cc1c e8efa31300 call combase!ObjectStublessClient32+0x279c0 (00007ffc`77a87010) 00007ffc`7794cc21 48ff15a0e81700 call qword ptr [combase!ObjectStublessClient32+0x6be78 (00007ffc`77acb4c8)] +0012CAD9 combase.dll!RoParameterizedTypeExtraGetTypeSignature+0xE9: 00007ffc`7794cab0 48895c2408 mov qword ptr [rsp+8],rbx 00007ffc`7794cab5 57 push rdi 00007ffc`7794cab6 4883ec20 sub rsp,20h 00007ffc`7794caba 488bf9 mov rdi,rcx 00007ffc`7794cabd 48ff153cea1700 call qword ptr [combase!ObjectStublessClient32+0x6beb0 (00007ffc`77acb500)] 00007ffc`7794cac4 0f1f440000 nop dword ptr [rax+rax] 00007ffc`7794cac9 894728 mov dword ptr [rdi+28h],eax 00007ffc`7794cacc e833000000 call combase!RoParameterizedTypeExtraGetTypeSignature+0x114 (00007ffc`7794cb04) 00007ffc`7794cad1 488bcf mov rcx,rdi 00007ffc`7794cad4 e8fb000000 call combase!RoParameterizedTypeExtraGetTypeSignature+0x1e4 (00007ffc`7794cbd4) 00007ffc`7794cad9 488b5f30 mov rbx,qword ptr [rdi+30h] +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`780fe8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`780fe8c0 4053 push rbx 00007ffc`780fe8c2 4883ec20 sub rsp,20h 00007ffc`780fe8c6 33db xor ebx,ebx 00007ffc`780fe8c8 85c9 test ecx,ecx 00007ffc`780fe8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`780fe8e6) 00007ffc`780fe8cc 498bc8 mov rcx,r8 00007ffc`780fe8cf 488bc2 mov rax,rdx 00007ffc`780fe8d2 e839770500 call KERNEL32!TlsGetValue+0x1b00 (00007ffc`78156010) 00007ffc`780fe8d7 8bc8 mov ecx,eax +0008C53C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`788ec517 488b05c2621400 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x40f0 (00007ffc`78a327e0)] 00007ffc`788ec51e 4885c0 test rax,rax 00007ffc`788ec521 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`788ec547) 00007ffc`788ec523 488d0d5613f8ff lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7886d880)] 00007ffc`788ec52a 4c8bc2 mov r8,rdx 00007ffc`788ec52d 498bd1 mov rdx,r9 00007ffc`788ec530 483bc1 cmp rax,rcx 00007ffc`788ec533 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`788ec53e) 00007ffc`788ec535 33c9 xor ecx,ecx 00007ffc`788ec537 e8e45a0e00 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`789d2020) 00007ffc`788ec53c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`788ec566) ====================================================================== Thread 22068 / 0x5634 ====================================================================== LastError: 0x000003E5 - Překrývající vstupně-výstupní operace se zpracovává. NTSTATUS: 0x00000103 - Požadovaná operace čeká na úplné vyřízení. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00162744 ntdll.dll!NtWaitForMultipleObjects+0x14 +00039333 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123 +00039201 KERNELBASE.dll!WaitForMultipleObjects+0x11 +000168A1 ConEmu.x64.dll!PipeServer::WaitOverlapped(struct PipeServer::PipeInst * __ptr64,unsigned long * __ptr64) __ptr64+0x61 (PluginSrv.obj) +0001676B ConEmu.x64.dll!PipeServer::WaitForClient(struct PipeServer::PipeInst * __ptr64,int & __ptr64,int & __ptr64) __ptr64+0x243 (PluginSrv.obj) +0001547C ConEmu.x64.dll!PipeServer::PipeServerThread(struct PipeServer::PipeInst * __ptr64) __ptr64+0x6C (PluginSrv.obj) +00016ACE ConEmu.x64.dll!PipeServer::_PipeServerThread(void * __ptr64)+0x3A (PluginSrv.obj) +0001954C ConEmu.x64.dll!apiThreadHelper(void * __ptr64)+0x188 (common-kernel64:WThreads.obj) +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000002 RCX = 0000000000000002 RDX = 000000C86CAFF930 RSI = 000000C86CAFF620 RDI = 0000000000000002 R8 = 0000000000000001 R9 = 0000000000000000 R10 = 0000000000000002 R11 = 0000000000000002 R12 = 000000C86CAFF930 R13 = 000000C86C0FB000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFC789C2744 RSP = 000000C86CAFF5D8 RBP = 0000000000000217 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00162744 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffc`789c271f 00e9 add cl,ch 00007ffc`789c2721 cb retf 00007ffc`789c2722 b9f8ff6666 mov ecx,6666FFF8h 00007ffc`789c2727 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffc`789c2730 4c8bd1 mov r10,rcx 00007ffc`789c2733 b85b000000 mov eax,5Bh 00007ffc`789c2738 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`789c2740 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffc`789c2745) 00007ffc`789c2742 0f05 syscall 00007ffc`789c2744 c3 ret +00039333 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123: 00007ffc`75bb930a 488d742440 lea rsi,[rsp+40h] 00007ffc`75bb930f 448b7c2438 mov r15d,dword ptr [rsp+38h] 00007ffc`75bb9314 4533c0 xor r8d,r8d 00007ffc`75bb9317 4585ff test r15d,r15d 00007ffc`75bb931a 410f94c0 sete r8b 00007ffc`75bb931e 4889742420 mov qword ptr [rsp+20h],rsi 00007ffc`75bb9323 450fb6ce movzx r9d,r14b 00007ffc`75bb9327 498bd4 mov rdx,r12 00007ffc`75bb932a 8bcb mov ecx,ebx 00007ffc`75bb932c 48ff1545af2500 call qword ptr [KERNELBASE!TlsGetValue+0xfdb88 (00007ffc`75e14278)] 00007ffc`75bb9333 0f1f440000 nop dword ptr [rax+rax] +00039201 KERNELBASE.dll!WaitForMultipleObjects+0x11: 00007ffc`75bb91ec cc int 3 00007ffc`75bb91ed cc int 3 00007ffc`75bb91ee cc int 3 00007ffc`75bb91ef cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffc`75bb91f0 e9257ba802 jmp 00007ffc`78640d1a 00007ffc`75bb91f5 442420 and al,20h 00007ffc`75bb91f8 0000 add byte ptr [rax],al 00007ffc`75bb91fa 0000 add byte ptr [rax],al 00007ffc`75bb91fc e80f000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffc`75bb9210) 00007ffc`75bb9201 4883c438 add rsp,38h +000168A1 ConEmu.x64.dll!PipeServer::WaitOverlapped(struct PipeServer::PipeInst * __ptr64,unsigned long * __ptr64) __ptr64+0x61 (PluginSrv.obj): 00007ffc`58d56870 498943e0 mov qword ptr [r11-20h],rax 00007ffc`58d56874 ff1576d80100 call qword ptr [ConEmu_x64!GetGlobalInfoW+0x2c4b0 (00007ffc`58d740f0)] 00007ffc`58d5687a 83a78c01000000 and dword ptr [rdi+18Ch],0 00007ffc`58d56881 448bf8 mov r15d,eax 00007ffc`58d56884 e99a000000 jmp ConEmu_x64!GetGlobalInfoW+0xece3 (00007ffc`58d56923) 00007ffc`58d56889 4533c0 xor r8d,r8d 00007ffc`58d5688c 488d542420 lea rdx,[rsp+20h] 00007ffc`58d56891 41b9e8030000 mov r9d,3E8h 00007ffc`58d56897 418d4802 lea ecx,[r8+2] 00007ffc`58d5689b ff1507d80100 call qword ptr [ConEmu_x64!GetGlobalInfoW+0x2c468 (00007ffc`58d740a8)] 00007ffc`58d568a1 8bd8 mov ebx,eax +0001676B ConEmu.x64.dll!PipeServer::WaitForClient(struct PipeServer::PipeInst * __ptr64,int & __ptr64,int & __ptr64) __ptr64+0x243 (PluginSrv.obj): 00007ffc`58d56749 385e04 cmp byte ptr [rsi+4],bl 00007ffc`58d5674c 744f je ConEmu_x64!GetGlobalInfoW+0xeb5d (00007ffc`58d5679d) 00007ffc`58d5674e 396f1c cmp dword ptr [rdi+1Ch],ebp 00007ffc`58d56751 7505 jne ConEmu_x64!GetGlobalInfoW+0xeb18 (00007ffc`58d56758) 00007ffc`58d56753 418bed mov ebp,r13d 00007ffc`58d56756 eb15 jmp ConEmu_x64!GetGlobalInfoW+0xeb2d (00007ffc`58d5676d) 00007ffc`58d56758 4c8d842480000000 lea r8,[rsp+80h] 00007ffc`58d56760 488bd7 mov rdx,rdi 00007ffc`58d56763 488bce mov rcx,rsi 00007ffc`58d56766 e8d5000000 call ConEmu_x64!GetGlobalInfoW+0xec00 (00007ffc`58d56840) 00007ffc`58d5676b 8be8 mov ebp,eax +0001547C ConEmu.x64.dll!PipeServer::PipeServerThread(struct PipeServer::PipeInst * __ptr64) __ptr64+0x6C (PluginSrv.obj): 00007ffc`58d5544e 48896b30 mov qword ptr [rbx+30h],rbp 00007ffc`58d55452 40386f01 cmp byte ptr [rdi+1],bpl 00007ffc`58d55456 0f85e4010000 jne ConEmu_x64!GetGlobalInfoW+0xda00 (00007ffc`58d55640) 00007ffc`58d5545c 4c8d4c2470 lea r9,[rsp+70h] 00007ffc`58d55461 896c2470 mov dword ptr [rsp+70h],ebp 00007ffc`58d55465 4c8d442478 lea r8,[rsp+78h] 00007ffc`58d5546a 89ac2480000000 mov dword ptr [rsp+80h],ebp 00007ffc`58d55471 488bd3 mov rdx,rbx 00007ffc`58d55474 488bcf mov rcx,rdi 00007ffc`58d55477 e8ac100000 call ConEmu_x64!GetGlobalInfoW+0xe8e8 (00007ffc`58d56528) 00007ffc`58d5547c 40386f01 cmp byte ptr [rdi+1],bpl +00016ACE ConEmu.x64.dll!PipeServer::_PipeServerThread(void * __ptr64)+0x3A (PluginSrv.obj): 00007ffc`58d56a9e 488bd9 mov rbx,rcx 00007ffc`58d56aa1 bf65000000 mov edi,65h 00007ffc`58d56aa6 ff1544d60100 call qword ptr [ConEmu_x64!GetGlobalInfoW+0x2c4b0 (00007ffc`58d740f0)] 00007ffc`58d56aac 488b8bb0010000 mov rcx,qword ptr [rbx+1B0h] 00007ffc`58d56ab3 898380000000 mov dword ptr [rbx+80h],eax 00007ffc`58d56ab9 c7437401000000 mov dword ptr [rbx+74h],1 00007ffc`58d56ac0 80790100 cmp byte ptr [rcx+1],0 00007ffc`58d56ac4 750a jne ConEmu_x64!GetGlobalInfoW+0xee90 (00007ffc`58d56ad0) 00007ffc`58d56ac6 488bd3 mov rdx,rbx 00007ffc`58d56ac9 e842e9ffff call ConEmu_x64!GetGlobalInfoW+0xd7d0 (00007ffc`58d55410) 00007ffc`58d56ace 8bf8 mov edi,eax +0001954C ConEmu.x64.dll!apiThreadHelper(void * __ptr64)+0x188 (common-kernel64:WThreads.obj): 00007ffc`58d59523 488d0df60c0300 lea rcx,[ConEmu_x64!GetGlobalInfoW+0x425e0 (00007ffc`58d8a220)] 00007ffc`58d5952a 4803c8 add rcx,rax 00007ffc`58d5952d 488bc1 mov rax,rcx 00007ffc`58d59530 4889442428 mov qword ptr [rsp+28h],rax 00007ffc`58d59535 eb05 jmp ConEmu_x64!GetGlobalInfoW+0x118fc (00007ffc`58d5953c) 00007ffc`58d59537 e965ffffff jmp ConEmu_x64!GetGlobalInfoW+0x11861 (00007ffc`58d594a1) 00007ffc`58d5953c 488b442420 mov rax,qword ptr [rsp+20h] 00007ffc`58d59541 488b4808 mov rcx,qword ptr [rax+8] 00007ffc`58d59545 488b442420 mov rax,qword ptr [rsp+20h] 00007ffc`58d5954a ff10 call qword ptr [rax] 00007ffc`58d5954c 89442434 mov dword ptr [rsp+34h],eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`780fe8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`780fe8c0 4053 push rbx 00007ffc`780fe8c2 4883ec20 sub rsp,20h 00007ffc`780fe8c6 33db xor ebx,ebx 00007ffc`780fe8c8 85c9 test ecx,ecx 00007ffc`780fe8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`780fe8e6) 00007ffc`780fe8cc 498bc8 mov rcx,r8 00007ffc`780fe8cf 488bc2 mov rax,rdx 00007ffc`780fe8d2 e839770500 call KERNEL32!TlsGetValue+0x1b00 (00007ffc`78156010) 00007ffc`780fe8d7 8bc8 mov ecx,eax +0008C53C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`788ec517 488b05c2621400 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x40f0 (00007ffc`78a327e0)] 00007ffc`788ec51e 4885c0 test rax,rax 00007ffc`788ec521 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`788ec547) 00007ffc`788ec523 488d0d5613f8ff lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7886d880)] 00007ffc`788ec52a 4c8bc2 mov r8,rdx 00007ffc`788ec52d 498bd1 mov rdx,r9 00007ffc`788ec530 483bc1 cmp rax,rcx 00007ffc`788ec533 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`788ec53e) 00007ffc`788ec535 33c9 xor ecx,ecx 00007ffc`788ec537 e8e45a0e00 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`789d2020) 00007ffc`788ec53c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`788ec566) ====================================================================== Thread 18876 / 0x49BC ====================================================================== LastError: 0x00000057 - Parametr není správný. NTSTATUS: 0xC000000D - Službě nebo funkci byl předán neplatný parametr. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00161C74 ntdll.dll!NtWaitForSingleObject+0x14 +00032A5F KERNELBASE.dll!WaitForSingleObjectEx+0xAF +0000E140 ConEmu.x64.dll!CPluginBase::MonitorThreadProcW(void * __ptr64)+0x64 (ConEmuPluginBase.obj) +0001954C ConEmu.x64.dll!apiThreadHelper(void * __ptr64)+0x188 (common-kernel64:WThreads.obj) +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000000004 RBX = 000000000000045C RCX = 000000000000045C RDX = 0000000000000000 RSI = 00000000000001F4 RDI = 0000000000000000 R8 = 000000C86CBFF6E8 R9 = 0000000000000000 R10 = 000000000000045C R11 = 000000000000045C R12 = 0000000000000000 R13 = 0000000000000000 R14 = 000000C86CBFF6E8 R15 = 0000000000000000 RIP = 00007FFC789C1C74 RSP = 000000C86CBFF6B8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00161C74 ntdll.dll!NtWaitForSingleObject+0x14: 00007ffc`789c1c54 c3 ret 00007ffc`789c1c55 cd2e int 2Eh 00007ffc`789c1c57 c3 ret 00007ffc`789c1c58 0f1f840000000000 nop dword ptr [rax+rax] ntdll!NtWaitForSingleObject: 00007ffc`789c1c60 4c8bd1 mov r10,rcx 00007ffc`789c1c63 b804000000 mov eax,4 00007ffc`789c1c68 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`789c1c70 7503 jne ntdll!NtWaitForSingleObject+0x15 (00007ffc`789c1c75) 00007ffc`789c1c72 0f05 syscall 00007ffc`789c1c74 c3 ret +00032A5F KERNELBASE.dll!WaitForSingleObjectEx+0xAF: 00007ffc`75bb2a33 7419 je KERNELBASE!WaitForSingleObjectEx+0x9e (00007ffc`75bb2a4e) 00007ffc`75bb2a35 4869ce10270000 imul rcx,rsi,2710h 00007ffc`75bb2a3c 48894c2428 mov qword ptr [rsp+28h],rcx 00007ffc`75bb2a41 48f7d9 neg rcx 00007ffc`75bb2a44 48894c2428 mov qword ptr [rsp+28h],rcx 00007ffc`75bb2a49 4c8d742428 lea r14,[rsp+28h] 00007ffc`75bb2a4e 4d8bc6 mov r8,r14 00007ffc`75bb2a51 400fb6d7 movzx edx,dil 00007ffc`75bb2a55 488bcb mov rcx,rbx 00007ffc`75bb2a58 48ff15690e2600 call qword ptr [KERNELBASE!TlsGetValue+0xfd1d8 (00007ffc`75e138c8)] 00007ffc`75bb2a5f 0f1f440000 nop dword ptr [rax+rax] +0000E140 ConEmu.x64.dll!CPluginBase::MonitorThreadProcW(void * __ptr64)+0x64 (ConEmuPluginBase.obj): 00007ffc`58d4e114 448d7501 lea r14d,[rbp+1] 00007ffc`58d4e118 48392d71bd0300 cmp qword ptr [ConEmu_x64!GetGlobalInfoW+0x42250 (00007ffc`58d89e90)],rbp 00007ffc`58d4e11f 750b jne ConEmu_x64!GetGlobalInfoW+0x64ec (00007ffc`58d4e12c) 00007ffc`58d4e121 392df1ac0300 cmp dword ptr [ConEmu_x64!GetGlobalInfoW+0x411d8 (00007ffc`58d88e18)],ebp 00007ffc`58d4e127 418bfe mov edi,r14d 00007ffc`58d4e12a 7402 je ConEmu_x64!GetGlobalInfoW+0x64ee (00007ffc`58d4e12e) 00007ffc`58d4e12c 8bfd mov edi,ebp 00007ffc`58d4e12e baf4010000 mov edx,1F4h 00007ffc`58d4e133 488b0d46be0300 mov rcx,qword ptr [ConEmu_x64!GetGlobalInfoW+0x42340 (00007ffc`58d89f80)] 00007ffc`58d4e13a ff1558600200 call qword ptr [ConEmu_x64!GetGlobalInfoW+0x2c558 (00007ffc`58d74198)] 00007ffc`58d4e140 85c0 test eax,eax +0001954C ConEmu.x64.dll!apiThreadHelper(void * __ptr64)+0x188 (common-kernel64:WThreads.obj): 00007ffc`58d59523 488d0df60c0300 lea rcx,[ConEmu_x64!GetGlobalInfoW+0x425e0 (00007ffc`58d8a220)] 00007ffc`58d5952a 4803c8 add rcx,rax 00007ffc`58d5952d 488bc1 mov rax,rcx 00007ffc`58d59530 4889442428 mov qword ptr [rsp+28h],rax 00007ffc`58d59535 eb05 jmp ConEmu_x64!GetGlobalInfoW+0x118fc (00007ffc`58d5953c) 00007ffc`58d59537 e965ffffff jmp ConEmu_x64!GetGlobalInfoW+0x11861 (00007ffc`58d594a1) 00007ffc`58d5953c 488b442420 mov rax,qword ptr [rsp+20h] 00007ffc`58d59541 488b4808 mov rcx,qword ptr [rax+8] 00007ffc`58d59545 488b442420 mov rax,qword ptr [rsp+20h] 00007ffc`58d5954a ff10 call qword ptr [rax] 00007ffc`58d5954c 89442434 mov dword ptr [rsp+34h],eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`780fe8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`780fe8c0 4053 push rbx 00007ffc`780fe8c2 4883ec20 sub rsp,20h 00007ffc`780fe8c6 33db xor ebx,ebx 00007ffc`780fe8c8 85c9 test ecx,ecx 00007ffc`780fe8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`780fe8e6) 00007ffc`780fe8cc 498bc8 mov rcx,r8 00007ffc`780fe8cf 488bc2 mov rax,rdx 00007ffc`780fe8d2 e839770500 call KERNEL32!TlsGetValue+0x1b00 (00007ffc`78156010) 00007ffc`780fe8d7 8bc8 mov ecx,eax +0008C53C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`788ec517 488b05c2621400 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x40f0 (00007ffc`78a327e0)] 00007ffc`788ec51e 4885c0 test rax,rax 00007ffc`788ec521 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`788ec547) 00007ffc`788ec523 488d0d5613f8ff lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7886d880)] 00007ffc`788ec52a 4c8bc2 mov r8,rdx 00007ffc`788ec52d 498bd1 mov rdx,r9 00007ffc`788ec530 483bc1 cmp rax,rcx 00007ffc`788ec533 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`788ec53e) 00007ffc`788ec535 33c9 xor ecx,ecx 00007ffc`788ec537 e8e45a0e00 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`789d2020) 00007ffc`788ec53c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`788ec566) ====================================================================== Thread 11980 / 0x2ECC ====================================================================== LastError: 0x00000000 - Operace byla dokončena úspěšně. NTSTATUS: 0xC000000D - Službě nebo funkci byl předán neplatný parametr. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00001324 win32u.dll!NtUserGetMessage+0x14 +0003F622 USER32.dll!GetMessageW+0x22 +0002D384 ConEmuHk64.dll!SetLoadLibraryCallback+0xD914 +0000C8AC PortaDev.dll! (get the pdb) +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000001004 RBX = 000000C86CDFFBA0 RCX = 000000C86CDFFBA0 RDX = 0000000000000000 RSI = 0000000000000000 RDI = 0000000000000000 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 000000C86CDFFBA0 R11 = 000000C86CDFFBA0 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFC759F1324 RSP = 000000C86CDFFA38 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00001324 win32u.dll!NtUserGetMessage+0x14: 00007ffc`759f1304 c3 ret 00007ffc`759f1305 cd2e int 2Eh 00007ffc`759f1307 c3 ret 00007ffc`759f1308 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserGetMessage: 00007ffc`759f1310 4c8bd1 mov r10,rcx 00007ffc`759f1313 b804100000 mov eax,1004h 00007ffc`759f1318 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`759f1320 7503 jne win32u!NtUserGetMessage+0x15 (00007ffc`759f1325) 00007ffc`759f1322 0f05 syscall 00007ffc`759f1324 c3 ret +0003F622 USER32.dll!GetMessageW+0x22: USER32!GetMessageW: 00007ffc`7868f600 e98f0b4dfd jmp 00007ffc`75b60194 00007ffc`7868f605 50 push rax 00007ffc`7868f606 418bc0 mov eax,r8d 00007ffc`7868f609 488bd9 mov rbx,rcx 00007ffc`7868f60c 410bc1 or eax,r9d 00007ffc`7868f60f a90000feff test eax,0FFFE0000h 00007ffc`7868f614 753b jne USER32!GetMessageW+0x51 (00007ffc`7868f651) 00007ffc`7868f616 48897c2460 mov qword ptr [rsp+60h],rdi 00007ffc`7868f61b 48ff156ec90600 call qword ptr [USER32!gapfnScSendMessage+0x1b50 (00007ffc`786fbf90)] 00007ffc`7868f622 0f1f440000 nop dword ptr [rax+rax] +0002D384 ConEmuHk64.dll!SetLoadLibraryCallback+0xD914: 00007e11`0002d363 488d0dbeffffff lea rcx,[ConEmuHk64!SetLoadLibraryCallback+0xd8b8 (00007e11`0002d328)] 00007e11`0002d36a e8010cffff call ConEmuHk64!GetLoadLibraryW+0x54 (00007e11`0001df70) 00007e11`0002d36f 33ff xor edi,edi 00007e11`0002d371 4885c0 test rax,rax 00007e11`0002d374 7439 je ConEmuHk64!SetLoadLibraryCallback+0xd93f (00007e11`0002d3af) 00007e11`0002d376 448bce mov r9d,esi 00007e11`0002d379 448bc5 mov r8d,ebp 00007e11`0002d37c 498bd6 mov rdx,r14 00007e11`0002d37f 488bcb mov rcx,rbx 00007e11`0002d382 ffd0 call rax 00007e11`0002d384 8bf8 mov edi,eax +0000C8AC PortaDev.dll! (get the pdb): 00007ffc`3fd6c884 742a je PortaDev+0xc8b0 (00007ffc`3fd6c8b0) 00007ffc`3fd6c886 488d4db0 lea rcx,[rbp-50h] 00007ffc`3fd6c88a ff15f0da0100 call qword ptr [PortaDev!ExitFARW+0x1b44c (00007ffc`3fd8a380)] 00007ffc`3fd6c890 488d4db0 lea rcx,[rbp-50h] 00007ffc`3fd6c894 ff15eeda0100 call qword ptr [PortaDev!ExitFARW+0x1b454 (00007ffc`3fd8a388)] 00007ffc`3fd6c89a 4533c9 xor r9d,r9d 00007ffc`3fd6c89d 488d4db0 lea rcx,[rbp-50h] 00007ffc`3fd6c8a1 4533c0 xor r8d,r8d 00007ffc`3fd6c8a4 33d2 xor edx,edx 00007ffc`3fd6c8a6 ff15ecda0100 call qword ptr [PortaDev!ExitFARW+0x1b464 (00007ffc`3fd8a398)] 00007ffc`3fd6c8ac 85c0 test eax,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`780fe8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`780fe8c0 4053 push rbx 00007ffc`780fe8c2 4883ec20 sub rsp,20h 00007ffc`780fe8c6 33db xor ebx,ebx 00007ffc`780fe8c8 85c9 test ecx,ecx 00007ffc`780fe8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`780fe8e6) 00007ffc`780fe8cc 498bc8 mov rcx,r8 00007ffc`780fe8cf 488bc2 mov rax,rdx 00007ffc`780fe8d2 e839770500 call KERNEL32!TlsGetValue+0x1b00 (00007ffc`78156010) 00007ffc`780fe8d7 8bc8 mov ecx,eax +0008C53C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`788ec517 488b05c2621400 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x40f0 (00007ffc`78a327e0)] 00007ffc`788ec51e 4885c0 test rax,rax 00007ffc`788ec521 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`788ec547) 00007ffc`788ec523 488d0d5613f8ff lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7886d880)] 00007ffc`788ec52a 4c8bc2 mov r8,rdx 00007ffc`788ec52d 498bd1 mov rdx,r9 00007ffc`788ec530 483bc1 cmp rax,rcx 00007ffc`788ec533 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`788ec53e) 00007ffc`788ec535 33c9 xor ecx,ecx 00007ffc`788ec537 e8e45a0e00 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`789d2020) 00007ffc`788ec53c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`788ec566) ====================================================================== Thread 1436 / 0x59C ====================================================================== LastError: 0x000003E5 - Překrývající vstupně-výstupní operace se zpracovává. NTSTATUS: 0x00000103 - Požadovaná operace čeká na úplné vyřízení. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00162744 ntdll.dll!NtWaitForMultipleObjects+0x14 +00039333 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123 +00039201 KERNELBASE.dll!WaitForMultipleObjects+0x11 +00018BCD ConEmuHk64.dll!RequestLocalServer+0x1485 +00018A97 ConEmuHk64.dll!RequestLocalServer+0x134F +00017324 ConEmuHk64.dll!GetRealConsoleWindow+0x1730 +00018DFA ConEmuHk64.dll!RequestLocalServer+0x16B2 +0003B100 ConEmuHk64.dll!SetLoadLibraryCallback+0x1B690 +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000002 RCX = 0000000000000002 RDX = 000000C86CCFFA60 RSI = 000000C86CCFF750 RDI = 0000000000000002 R8 = 0000000000000001 R9 = 0000000000000000 R10 = 0000000000000002 R11 = 0000000000000002 R12 = 000000C86CCFFA60 R13 = 000000C86C0FB000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFC789C2744 RSP = 000000C86CCFF708 RBP = 0000000000000217 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00162744 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffc`789c271f 00e9 add cl,ch 00007ffc`789c2721 cb retf 00007ffc`789c2722 b9f8ff6666 mov ecx,6666FFF8h 00007ffc`789c2727 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffc`789c2730 4c8bd1 mov r10,rcx 00007ffc`789c2733 b85b000000 mov eax,5Bh 00007ffc`789c2738 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`789c2740 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffc`789c2745) 00007ffc`789c2742 0f05 syscall 00007ffc`789c2744 c3 ret +00039333 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123: 00007ffc`75bb930a 488d742440 lea rsi,[rsp+40h] 00007ffc`75bb930f 448b7c2438 mov r15d,dword ptr [rsp+38h] 00007ffc`75bb9314 4533c0 xor r8d,r8d 00007ffc`75bb9317 4585ff test r15d,r15d 00007ffc`75bb931a 410f94c0 sete r8b 00007ffc`75bb931e 4889742420 mov qword ptr [rsp+20h],rsi 00007ffc`75bb9323 450fb6ce movzx r9d,r14b 00007ffc`75bb9327 498bd4 mov rdx,r12 00007ffc`75bb932a 8bcb mov ecx,ebx 00007ffc`75bb932c 48ff1545af2500 call qword ptr [KERNELBASE!TlsGetValue+0xfdb88 (00007ffc`75e14278)] 00007ffc`75bb9333 0f1f440000 nop dword ptr [rax+rax] +00039201 KERNELBASE.dll!WaitForMultipleObjects+0x11: 00007ffc`75bb91ec cc int 3 00007ffc`75bb91ed cc int 3 00007ffc`75bb91ee cc int 3 00007ffc`75bb91ef cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffc`75bb91f0 e9257ba802 jmp 00007ffc`78640d1a 00007ffc`75bb91f5 442420 and al,20h 00007ffc`75bb91f8 0000 add byte ptr [rax],al 00007ffc`75bb91fa 0000 add byte ptr [rax],al 00007ffc`75bb91fc e80f000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffc`75bb9210) 00007ffc`75bb9201 4883c438 add rsp,38h +00018BCD ConEmuHk64.dll!RequestLocalServer+0x1485: 00007e11`00018b9c 498943e0 mov qword ptr [r11-20h],rax 00007e11`00018ba0 ff15f2940300 call qword ptr [ConEmuHk64!SetLoadLibraryCallback+0x32628 (00007e11`00052098)] 00007e11`00018ba6 83a78c01000000 and dword ptr [rdi+18Ch],0 00007e11`00018bad 448bf8 mov r15d,eax 00007e11`00018bb0 e99a000000 jmp ConEmuHk64!RequestLocalServer+0x1507 (00007e11`00018c4f) 00007e11`00018bb5 4533c0 xor r8d,r8d 00007e11`00018bb8 488d542420 lea rdx,[rsp+20h] 00007e11`00018bbd 41b9e8030000 mov r9d,3E8h 00007e11`00018bc3 418d4802 lea ecx,[r8+2] 00007e11`00018bc7 ff15b3960300 call qword ptr [ConEmuHk64!SetLoadLibraryCallback+0x32810 (00007e11`00052280)] 00007e11`00018bcd 8bd8 mov ebx,eax +00018A97 ConEmuHk64.dll!RequestLocalServer+0x134F: 00007e11`00018a75 385e04 cmp byte ptr [rsi+4],bl 00007e11`00018a78 744f je ConEmuHk64!RequestLocalServer+0x1381 (00007e11`00018ac9) 00007e11`00018a7a 396f1c cmp dword ptr [rdi+1Ch],ebp 00007e11`00018a7d 7505 jne ConEmuHk64!RequestLocalServer+0x133c (00007e11`00018a84) 00007e11`00018a7f 418bed mov ebp,r13d 00007e11`00018a82 eb15 jmp ConEmuHk64!RequestLocalServer+0x1351 (00007e11`00018a99) 00007e11`00018a84 4c8d842480000000 lea r8,[rsp+80h] 00007e11`00018a8c 488bd7 mov rdx,rdi 00007e11`00018a8f 488bce mov rcx,rsi 00007e11`00018a92 e8d5000000 call ConEmuHk64!RequestLocalServer+0x1424 (00007e11`00018b6c) 00007e11`00018a97 8be8 mov ebp,eax +00017324 ConEmuHk64.dll!GetRealConsoleWindow+0x1730: 00007e11`000172f6 48896b30 mov qword ptr [rbx+30h],rbp 00007e11`000172fa 40386f01 cmp byte ptr [rdi+1],bpl 00007e11`000172fe 0f85e4010000 jne ConEmuHk64!GetRealConsoleWindow+0x18f4 (00007e11`000174e8) 00007e11`00017304 4c8d4c2470 lea r9,[rsp+70h] 00007e11`00017309 896c2470 mov dword ptr [rsp+70h],ebp 00007e11`0001730d 4c8d442478 lea r8,[rsp+78h] 00007e11`00017312 89ac2480000000 mov dword ptr [rsp+80h],ebp 00007e11`00017319 488bd3 mov rdx,rbx 00007e11`0001731c 488bcf mov rcx,rdi 00007e11`0001731f e830150000 call ConEmuHk64!RequestLocalServer+0x110c (00007e11`00018854) 00007e11`00017324 40386f01 cmp byte ptr [rdi+1],bpl +00018DFA ConEmuHk64.dll!RequestLocalServer+0x16B2: 00007e11`00018dca 488bd9 mov rbx,rcx 00007e11`00018dcd bf65000000 mov edi,65h 00007e11`00018dd2 ff15c0920300 call qword ptr [ConEmuHk64!SetLoadLibraryCallback+0x32628 (00007e11`00052098)] 00007e11`00018dd8 488b8bb0010000 mov rcx,qword ptr [rbx+1B0h] 00007e11`00018ddf 898380000000 mov dword ptr [rbx+80h],eax 00007e11`00018de5 c7437401000000 mov dword ptr [rbx+74h],1 00007e11`00018dec 80790100 cmp byte ptr [rcx+1],0 00007e11`00018df0 750a jne ConEmuHk64!RequestLocalServer+0x16b4 (00007e11`00018dfc) 00007e11`00018df2 488bd3 mov rdx,rbx 00007e11`00018df5 e8bee4ffff call ConEmuHk64!GetRealConsoleWindow+0x16c4 (00007e11`000172b8) 00007e11`00018dfa 8bf8 mov edi,eax +0003B100 ConEmuHk64.dll!SetLoadLibraryCallback+0x1B690: 00007e11`0003b0d7 488d0dc28b0300 lea rcx,[ConEmuHk64!SetLoadLibraryCallback+0x54230 (00007e11`00073ca0)] 00007e11`0003b0de 4803c8 add rcx,rax 00007e11`0003b0e1 488bc1 mov rax,rcx 00007e11`0003b0e4 4889442428 mov qword ptr [rsp+28h],rax 00007e11`0003b0e9 eb05 jmp ConEmuHk64!SetLoadLibraryCallback+0x1b680 (00007e11`0003b0f0) 00007e11`0003b0eb e965ffffff jmp ConEmuHk64!SetLoadLibraryCallback+0x1b5e5 (00007e11`0003b055) 00007e11`0003b0f0 488b442420 mov rax,qword ptr [rsp+20h] 00007e11`0003b0f5 488b4808 mov rcx,qword ptr [rax+8] 00007e11`0003b0f9 488b442420 mov rax,qword ptr [rsp+20h] 00007e11`0003b0fe ff10 call qword ptr [rax] 00007e11`0003b100 89442434 mov dword ptr [rsp+34h],eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`780fe8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`780fe8c0 4053 push rbx 00007ffc`780fe8c2 4883ec20 sub rsp,20h 00007ffc`780fe8c6 33db xor ebx,ebx 00007ffc`780fe8c8 85c9 test ecx,ecx 00007ffc`780fe8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`780fe8e6) 00007ffc`780fe8cc 498bc8 mov rcx,r8 00007ffc`780fe8cf 488bc2 mov rax,rdx 00007ffc`780fe8d2 e839770500 call KERNEL32!TlsGetValue+0x1b00 (00007ffc`78156010) 00007ffc`780fe8d7 8bc8 mov ecx,eax +0008C53C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`788ec517 488b05c2621400 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x40f0 (00007ffc`78a327e0)] 00007ffc`788ec51e 4885c0 test rax,rax 00007ffc`788ec521 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`788ec547) 00007ffc`788ec523 488d0d5613f8ff lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7886d880)] 00007ffc`788ec52a 4c8bc2 mov r8,rdx 00007ffc`788ec52d 498bd1 mov rdx,r9 00007ffc`788ec530 483bc1 cmp rax,rcx 00007ffc`788ec533 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`788ec53e) 00007ffc`788ec535 33c9 xor ecx,ecx 00007ffc`788ec537 e8e45a0e00 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`789d2020) 00007ffc`788ec53c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`788ec566) ====================================================================== Thread 15460 / 0x3C64 ====================================================================== LastError: 0x00000000 - Operace byla dokončena úspěšně. NTSTATUS: 0x00000000 - STATUS_SUCCESS ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +001658A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +00075F3E ntdll.dll!RtlSetThreadSubProcessTag+0x1AEE +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001E6 RBX = 000002B9AA0443D0 RCX = 00000000000000B4 RDX = 000002B9AA044050 RSI = 00007FFC788D4EA0 RDI = 000002B9A710F600 R8 = 0000000000000010 R9 = 000000C86CEFFB78 R10 = 00000000000000B4 R11 = 00000000000000B4 R12 = 00007FFC78938330 R13 = 0000000000000000 R14 = 000000000000FFFF R15 = 00007FFC788D2C10 RIP = 00007FFC789C58A4 RSP = 000000C86CEFFB18 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +001658A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffc`789c5884 c3 ret 00007ffc`789c5885 cd2e int 2Eh 00007ffc`789c5887 c3 ret 00007ffc`789c5888 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffc`789c5890 4c8bd1 mov r10,rcx 00007ffc`789c5893 b8e6010000 mov eax,1E6h 00007ffc`789c5898 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`789c58a0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffc`789c58a5) 00007ffc`789c58a2 0f05 syscall 00007ffc`789c58a4 c3 ret +00075F3E ntdll.dll!RtlSetThreadSubProcessTag+0x1AEE: 00007ffc`788d5f06 488b03 mov rax,qword ptr [rbx] 00007ffc`788d5f09 4889842488000000 mov qword ptr [rsp+88h],rax 00007ffc`788d5f11 44896c2458 mov dword ptr [rsp+58h],r13d 00007ffc`788d5f16 488d842468020000 lea rax,[rsp+268h] 00007ffc`788d5f1e 4889442420 mov qword ptr [rsp+20h],rax 00007ffc`788d5f23 4c8d4c2458 lea r9,[rsp+58h] 00007ffc`788d5f28 448b442454 mov r8d,dword ptr [rsp+54h] 00007ffc`788d5f2d 488b942488000000 mov rdx,qword ptr [rsp+88h] 00007ffc`788d5f35 488b4f38 mov rcx,qword ptr [rdi+38h] 00007ffc`788d5f39 e852f90e00 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffc`789c5890) 00007ffc`788d5f3e 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`780fe8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`780fe8c0 4053 push rbx 00007ffc`780fe8c2 4883ec20 sub rsp,20h 00007ffc`780fe8c6 33db xor ebx,ebx 00007ffc`780fe8c8 85c9 test ecx,ecx 00007ffc`780fe8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`780fe8e6) 00007ffc`780fe8cc 498bc8 mov rcx,r8 00007ffc`780fe8cf 488bc2 mov rax,rdx 00007ffc`780fe8d2 e839770500 call KERNEL32!TlsGetValue+0x1b00 (00007ffc`78156010) 00007ffc`780fe8d7 8bc8 mov ecx,eax +0008C53C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`788ec517 488b05c2621400 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x40f0 (00007ffc`78a327e0)] 00007ffc`788ec51e 4885c0 test rax,rax 00007ffc`788ec521 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`788ec547) 00007ffc`788ec523 488d0d5613f8ff lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7886d880)] 00007ffc`788ec52a 4c8bc2 mov r8,rdx 00007ffc`788ec52d 498bd1 mov rdx,r9 00007ffc`788ec530 483bc1 cmp rax,rcx 00007ffc`788ec533 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`788ec53e) 00007ffc`788ec535 33c9 xor ecx,ecx 00007ffc`788ec537 e8e45a0e00 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`789d2020) 00007ffc`788ec53c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`788ec566) ====================================================================== Thread 23136 / 0x5A60 (NetBox IdleThread) ====================================================================== LastError: 0x00000000 - Operace byla dokončena úspěšně. NTSTATUS: 0xC000000D - Službě nebo funkci byl předán neplatný parametr. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00161C74 ntdll.dll!NtWaitForSingleObject+0x14 +00032A5F KERNELBASE.dll!WaitForSingleObjectEx+0xAF +0016A166 NetBox.dll!TPluginIdleThread::Execute(void) __ptr64+0x56 (FarPlugin.cpp.obj) +000614D8 NetBox.dll!TSimpleThread::ThreadProc(void * __ptr64)+0x18 (Queue.cpp.obj) +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000000004 RBX = 0000000000000574 RCX = 0000000000000574 RDX = 0000000000000000 RSI = 0000000000000190 RDI = 0000000000000000 R8 = 000000C86CFFF768 R9 = 0000000000000095 R10 = 0000000000000574 R11 = 0000000000000574 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 000000C86CFFF768 R15 = 0000000000000000 RIP = 00007FFC789C1C74 RSP = 000000C86CFFF738 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00161C74 ntdll.dll!NtWaitForSingleObject+0x14: 00007ffc`789c1c54 c3 ret 00007ffc`789c1c55 cd2e int 2Eh 00007ffc`789c1c57 c3 ret 00007ffc`789c1c58 0f1f840000000000 nop dword ptr [rax+rax] ntdll!NtWaitForSingleObject: 00007ffc`789c1c60 4c8bd1 mov r10,rcx 00007ffc`789c1c63 b804000000 mov eax,4 00007ffc`789c1c68 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`789c1c70 7503 jne ntdll!NtWaitForSingleObject+0x15 (00007ffc`789c1c75) 00007ffc`789c1c72 0f05 syscall 00007ffc`789c1c74 c3 ret +00032A5F KERNELBASE.dll!WaitForSingleObjectEx+0xAF: 00007ffc`75bb2a33 7419 je KERNELBASE!WaitForSingleObjectEx+0x9e (00007ffc`75bb2a4e) 00007ffc`75bb2a35 4869ce10270000 imul rcx,rsi,2710h 00007ffc`75bb2a3c 48894c2428 mov qword ptr [rsp+28h],rcx 00007ffc`75bb2a41 48f7d9 neg rcx 00007ffc`75bb2a44 48894c2428 mov qword ptr [rsp+28h],rcx 00007ffc`75bb2a49 4c8d742428 lea r14,[rsp+28h] 00007ffc`75bb2a4e 4d8bc6 mov r8,r14 00007ffc`75bb2a51 400fb6d7 movzx edx,dil 00007ffc`75bb2a55 488bcb mov rcx,rbx 00007ffc`75bb2a58 48ff15690e2600 call qword ptr [KERNELBASE!TlsGetValue+0xfd1d8 (00007ffc`75e138c8)] 00007ffc`75bb2a5f 0f1f440000 nop dword ptr [rax+rax] +0016A166 NetBox.dll!TPluginIdleThread::Execute(void) __ptr64+0x56 (FarPlugin.cpp.obj): 00007ffb`d78ba137 0f85a8000000 jne NetBox!OpenW+0x7e05 (00007ffb`d78ba1e5) 00007ffb`d78ba13d 48897c2430 mov qword ptr [rsp+30h],rdi 00007ffb`d78ba142 807b3000 cmp byte ptr [rbx+30h],0 00007ffb`d78ba146 757c jne NetBox!OpenW+0x7de4 (00007ffb`d78ba1c4) 00007ffb`d78ba148 0f1f840000000000 nop dword ptr [rax+rax] 00007ffb`d78ba150 488d4b38 lea rcx,[rbx+38h] 00007ffb`d78ba154 ff154e654600 call qword ptr [NetBox!OpenW+0x46e2c8 (00007ffb`d7d206a8)] 00007ffb`d78ba15a 488b4b60 mov rcx,qword ptr [rbx+60h] 00007ffb`d78ba15e 8bd6 mov edx,esi 00007ffb`d78ba160 ff157a5f4600 call qword ptr [NetBox!OpenW+0x46dd00 (00007ffb`d7d200e0)] 00007ffb`d78ba166 488d4b38 lea rcx,[rbx+38h] +000614D8 NetBox.dll!TSimpleThread::ThreadProc(void * __ptr64)+0x18 (Queue.cpp.obj): 00007ffb`d77b14be c3 ret 00007ffb`d77b14bf cc int 3 00007ffb`d77b14c0 48894c2408 mov qword ptr [rsp+8],rcx 00007ffb`d77b14c5 53 push rbx 00007ffb`d77b14c6 4883ec20 sub rsp,20h 00007ffb`d77b14ca 488bd9 mov rbx,rcx 00007ffb`d77b14cd 4885c9 test rcx,rcx 00007ffb`d77b14d0 742f je NetBox+0x61501 (00007ffb`d77b1501) 00007ffb`d77b14d2 488b01 mov rax,qword ptr [rcx] 00007ffb`d77b14d5 ff5030 call qword ptr [rax+30h] 00007ffb`d77b14d8 90 nop +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`780fe8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`780fe8c0 4053 push rbx 00007ffc`780fe8c2 4883ec20 sub rsp,20h 00007ffc`780fe8c6 33db xor ebx,ebx 00007ffc`780fe8c8 85c9 test ecx,ecx 00007ffc`780fe8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`780fe8e6) 00007ffc`780fe8cc 498bc8 mov rcx,r8 00007ffc`780fe8cf 488bc2 mov rax,rdx 00007ffc`780fe8d2 e839770500 call KERNEL32!TlsGetValue+0x1b00 (00007ffc`78156010) 00007ffc`780fe8d7 8bc8 mov ecx,eax +0008C53C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`788ec517 488b05c2621400 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x40f0 (00007ffc`78a327e0)] 00007ffc`788ec51e 4885c0 test rax,rax 00007ffc`788ec521 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`788ec547) 00007ffc`788ec523 488d0d5613f8ff lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7886d880)] 00007ffc`788ec52a 4c8bc2 mov r8,rdx 00007ffc`788ec52d 498bd1 mov rdx,r9 00007ffc`788ec530 483bc1 cmp rax,rcx 00007ffc`788ec533 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`788ec53e) 00007ffc`788ec535 33c9 xor ecx,ecx 00007ffc`788ec537 e8e45a0e00 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`789d2020) 00007ffc`788ec53c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`788ec566) ====================================================================== Thread 18836 / 0x4994 (Async history config) ====================================================================== LastError: 0x00000000 - Operace byla dokončena úspěšně. NTSTATUS: 0xC000000D - Službě nebo funkci byl předán neplatný parametr. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00162744 ntdll.dll!NtWaitForMultipleObjects+0x14 +00039333 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123 +00039201 KERNELBASE.dll!WaitForMultipleObjects+0x11 +0002BD63 ConEmuHk64.dll!SetLoadLibraryCallback+0xC2F3 +0025F223 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj) +00078DAD Far.exe!`anonymous namespace'::HistoryConfigCustom::ThreadProc(void) __ptr64+0x49D (configdb.obj) +00084DDE Far.exe!os::concurrency::thread::wrapper(void (__cdecl `anonymous namespace'::HistoryConfigCustom::*&& __ptr64)(void) __ptr64,class A0x6002ce20::HistoryConfigCustom * __ptr64 const && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x2E (configdb.obj) +0038085A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj) +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000002 RCX = 0000000000000002 RDX = 000000C86D0FFD98 RSI = 0000000000000000 RDI = 0000000000000002 R8 = 0000000000000001 R9 = 0000000000000000 R10 = 0000000000000002 R11 = 0000000000000002 R12 = 000000C86D0FFD98 R13 = 000000C86C0FB000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFC789C2744 RSP = 000000C86D0FF7B8 RBP = 000000C86D0FFB99 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00162744 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffc`789c271f 00e9 add cl,ch 00007ffc`789c2721 cb retf 00007ffc`789c2722 b9f8ff6666 mov ecx,6666FFF8h 00007ffc`789c2727 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffc`789c2730 4c8bd1 mov r10,rcx 00007ffc`789c2733 b85b000000 mov eax,5Bh 00007ffc`789c2738 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`789c2740 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffc`789c2745) 00007ffc`789c2742 0f05 syscall 00007ffc`789c2744 c3 ret +00039333 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123: 00007ffc`75bb930a 488d742440 lea rsi,[rsp+40h] 00007ffc`75bb930f 448b7c2438 mov r15d,dword ptr [rsp+38h] 00007ffc`75bb9314 4533c0 xor r8d,r8d 00007ffc`75bb9317 4585ff test r15d,r15d 00007ffc`75bb931a 410f94c0 sete r8b 00007ffc`75bb931e 4889742420 mov qword ptr [rsp+20h],rsi 00007ffc`75bb9323 450fb6ce movzx r9d,r14b 00007ffc`75bb9327 498bd4 mov rdx,r12 00007ffc`75bb932a 8bcb mov ecx,ebx 00007ffc`75bb932c 48ff1545af2500 call qword ptr [KERNELBASE!TlsGetValue+0xfdb88 (00007ffc`75e14278)] 00007ffc`75bb9333 0f1f440000 nop dword ptr [rax+rax] +00039201 KERNELBASE.dll!WaitForMultipleObjects+0x11: 00007ffc`75bb91ec cc int 3 00007ffc`75bb91ed cc int 3 00007ffc`75bb91ee cc int 3 00007ffc`75bb91ef cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffc`75bb91f0 e9257ba802 jmp 00007ffc`78640d1a 00007ffc`75bb91f5 442420 and al,20h 00007ffc`75bb91f8 0000 add byte ptr [rax],al 00007ffc`75bb91fa 0000 add byte ptr [rax],al 00007ffc`75bb91fc e80f000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffc`75bb9210) 00007ffc`75bb9201 4883c438 add rsp,38h +0002BD63 ConEmuHk64.dll!SetLoadLibraryCallback+0xC2F3: 00007e11`0002bd42 4c8965cf mov qword ptr [rbp-31h],r12 00007e11`0002bd46 ff5078 call qword ptr [rax+78h] 00007e11`0002bd49 8bcb mov ecx,ebx 00007e11`0002bd4b 41b501 mov r13b,1 00007e11`0002bd4e ff1504630200 call qword ptr [ConEmuHk64!SetLoadLibraryCallback+0x325e8 (00007e11`00052058)] 00007e11`0002bd54 458bcc mov r9d,r12d 00007e11`0002bd57 458bc7 mov r8d,r15d 00007e11`0002bd5a 488bd6 mov rdx,rsi 00007e11`0002bd5d 418bce mov ecx,r14d 00007e11`0002bd60 ff5597 call qword ptr [rbp-69h] 00007e11`0002bd63 894587 mov dword ptr [rbp-79h],eax +0025F223 Far.exe!os::detail::handle_implementation::wait_any(class span)+0x33 (platform.obj): 00007ff6`ef68f1f2 4881ec00010000 sub rsp,100h 00007ff6`ef68f1f9 488b0540402400 mov rax,qword ptr [Far+0x4a3240 (00007ff6`ef8d3240)] 00007ff6`ef68f200 4833c4 xor rax,rsp 00007ff6`ef68f203 48898424f0000000 mov qword ptr [rsp+0F0h],rax 00007ff6`ef68f20b 488b5908 mov rbx,qword ptr [rcx+8] 00007ff6`ef68f20f 41b9ffffffff mov r9d,0FFFFFFFFh 00007ff6`ef68f215 4533c0 xor r8d,r8d 00007ff6`ef68f218 488b11 mov rdx,qword ptr [rcx] 00007ff6`ef68f21b 8bcb mov ecx,ebx 00007ff6`ef68f21d ff1515f11600 call qword ptr [Far+0x3ce338 (00007ff6`ef7fe338)] 00007ff6`ef68f223 8bc8 mov ecx,eax +00078DAD Far.exe!`anonymous namespace'::HistoryConfigCustom::ThreadProc(void) __ptr64+0x49D (configdb.obj): 00007ff6`ef4a8d7c 48894588 mov qword ptr [rbp-78h],rax 00007ff6`ef4a8d80 488b8788000000 mov rax,qword ptr [rdi+88h] 00007ff6`ef4a8d87 48894590 mov qword ptr [rbp-70h],rax 00007ff6`ef4a8d8b 488d4588 lea rax,[rbp-78h] 00007ff6`ef4a8d8f 488945a0 mov qword ptr [rbp-60h],rax 00007ff6`ef4a8d93 48c745a802000000 mov qword ptr [rbp-58h],2 00007ff6`ef4a8d9b 0f2845a0 movaps xmm0,xmmword ptr [rbp-60h] 00007ff6`ef4a8d9f 660f7f45b0 movdqa xmmword ptr [rbp-50h],xmm0 00007ff6`ef4a8da4 488d4db0 lea rcx,[rbp-50h] 00007ff6`ef4a8da8 e843641e00 call Far+0x25f1f0 (00007ff6`ef68f1f0) 00007ff6`ef4a8dad 4883f801 cmp rax,1 +00084DDE Far.exe!os::concurrency::thread::wrapper(void (__cdecl `anonymous namespace'::HistoryConfigCustom::*&& __ptr64)(void) __ptr64,class A0x6002ce20::HistoryConfigCustom * __ptr64 const && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x2E (configdb.obj): 00007ff6`ef4b4db9 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`ef4b4dbe 4c8b4910 mov r9,qword ptr [rcx+10h] 00007ff6`ef4b4dc2 4863510c movsxd rdx,dword ptr [rcx+0Ch] 00007ff6`ef4b4dc6 498b4108 mov rax,qword ptr [r9+8] 00007ff6`ef4b4dca 48630c02 movsxd rcx,dword ptr [rdx+rax] 00007ff6`ef4b4dce 48635308 movsxd rdx,dword ptr [rbx+8] 00007ff6`ef4b4dd2 4903c9 add rcx,r9 00007ff6`ef4b4dd5 4883c208 add rdx,8 00007ff6`ef4b4dd9 4803ca add rcx,rdx 00007ff6`ef4b4ddc ff13 call qword ptr [rbx] 00007ff6`ef4b4dde 90 nop +0038085A Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj): 00007ff6`ef7b0831 7510 jne Far+0x380843 (00007ff6`ef7b0843) 00007ff6`ef7b0833 8d48ff lea ecx,[rax-1] 00007ff6`ef7b0836 e8ed230100 call Far+0x392c28 (00007ff6`ef7c2c28) 00007ff6`ef7b083b 85c0 test eax,eax 00007ff6`ef7b083d 0f94c0 sete al 00007ff6`ef7b0840 884320 mov byte ptr [rbx+20h],al 00007ff6`ef7b0843 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`ef7b084d 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`ef7b0851 488b03 mov rax,qword ptr [rbx] 00007ff6`ef7b0854 ff151ee60400 call qword ptr [Far+0x3cee78 (00007ff6`ef7fee78)] 00007ff6`ef7b085a 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`780fe8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`780fe8c0 4053 push rbx 00007ffc`780fe8c2 4883ec20 sub rsp,20h 00007ffc`780fe8c6 33db xor ebx,ebx 00007ffc`780fe8c8 85c9 test ecx,ecx 00007ffc`780fe8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`780fe8e6) 00007ffc`780fe8cc 498bc8 mov rcx,r8 00007ffc`780fe8cf 488bc2 mov rax,rdx 00007ffc`780fe8d2 e839770500 call KERNEL32!TlsGetValue+0x1b00 (00007ffc`78156010) 00007ffc`780fe8d7 8bc8 mov ecx,eax +0008C53C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`788ec517 488b05c2621400 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x40f0 (00007ffc`78a327e0)] 00007ffc`788ec51e 4885c0 test rax,rax 00007ffc`788ec521 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`788ec547) 00007ffc`788ec523 488d0d5613f8ff lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7886d880)] 00007ffc`788ec52a 4c8bc2 mov r8,rdx 00007ffc`788ec52d 498bd1 mov rdx,r9 00007ffc`788ec530 483bc1 cmp rax,rcx 00007ffc`788ec533 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`788ec53e) 00007ffc`788ec535 33c9 xor ecx,ecx 00007ffc`788ec537 e8e45a0e00 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`789d2020) 00007ffc`788ec53c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`788ec566) ====================================================================== Thread 22512 / 0x57F0 ====================================================================== LastError: 0x00000000 - Operace byla dokončena úspěšně. NTSTATUS: 0xC000000D - Službě nebo funkci byl předán neplatný parametr. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +001658A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +00075F3E ntdll.dll!RtlSetThreadSubProcessTag+0x1AEE +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001E6 RBX = 000002B9AA3B24C0 RCX = 00000000000006F8 RDX = 000002B9AA3B2140 RSI = 00007FFC788D4EA0 RDI = 000002B9A7F49BD0 R8 = 0000000000000010 R9 = 000000C86D4FFB08 R10 = 00000000000006F8 R11 = 00000000000006F8 R12 = 00007FFC78938330 R13 = 0000000000000000 R14 = 000000000000FFFF R15 = 00007FFC788D2C10 RIP = 00007FFC789C58A4 RSP = 000000C86D4FFAA8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +001658A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffc`789c5884 c3 ret 00007ffc`789c5885 cd2e int 2Eh 00007ffc`789c5887 c3 ret 00007ffc`789c5888 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffc`789c5890 4c8bd1 mov r10,rcx 00007ffc`789c5893 b8e6010000 mov eax,1E6h 00007ffc`789c5898 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`789c58a0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffc`789c58a5) 00007ffc`789c58a2 0f05 syscall 00007ffc`789c58a4 c3 ret +00075F3E ntdll.dll!RtlSetThreadSubProcessTag+0x1AEE: 00007ffc`788d5f06 488b03 mov rax,qword ptr [rbx] 00007ffc`788d5f09 4889842488000000 mov qword ptr [rsp+88h],rax 00007ffc`788d5f11 44896c2458 mov dword ptr [rsp+58h],r13d 00007ffc`788d5f16 488d842468020000 lea rax,[rsp+268h] 00007ffc`788d5f1e 4889442420 mov qword ptr [rsp+20h],rax 00007ffc`788d5f23 4c8d4c2458 lea r9,[rsp+58h] 00007ffc`788d5f28 448b442454 mov r8d,dword ptr [rsp+54h] 00007ffc`788d5f2d 488b942488000000 mov rdx,qword ptr [rsp+88h] 00007ffc`788d5f35 488b4f38 mov rcx,qword ptr [rdi+38h] 00007ffc`788d5f39 e852f90e00 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffc`789c5890) 00007ffc`788d5f3e 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`780fe8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`780fe8c0 4053 push rbx 00007ffc`780fe8c2 4883ec20 sub rsp,20h 00007ffc`780fe8c6 33db xor ebx,ebx 00007ffc`780fe8c8 85c9 test ecx,ecx 00007ffc`780fe8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`780fe8e6) 00007ffc`780fe8cc 498bc8 mov rcx,r8 00007ffc`780fe8cf 488bc2 mov rax,rdx 00007ffc`780fe8d2 e839770500 call KERNEL32!TlsGetValue+0x1b00 (00007ffc`78156010) 00007ffc`780fe8d7 8bc8 mov ecx,eax +0008C53C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`788ec517 488b05c2621400 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x40f0 (00007ffc`78a327e0)] 00007ffc`788ec51e 4885c0 test rax,rax 00007ffc`788ec521 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`788ec547) 00007ffc`788ec523 488d0d5613f8ff lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7886d880)] 00007ffc`788ec52a 4c8bc2 mov r8,rdx 00007ffc`788ec52d 498bd1 mov rdx,r9 00007ffc`788ec530 483bc1 cmp rax,rcx 00007ffc`788ec533 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`788ec53e) 00007ffc`788ec535 33c9 xor ecx,ecx 00007ffc`788ec537 e8e45a0e00 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`789d2020) 00007ffc`788ec53c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`788ec566) ====================================================================== Thread 10448 / 0x28D0 ====================================================================== LastError: 0x000036B7 - Požadovaný vyhledávací klíč nebyl nalezen v žádném aktivním aktivačním kontextu. NTSTATUS: 0xC0150008 - Požadovaný vyhledávací klíč nebyl nalezen v žádném aktivním aktivačním kontextu. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +0000AD04 win32u.dll!NtUserMsgWaitForMultipleObjectsEx+0x14 +0000B476 shcore.dll!Ordinal131+0x2186 +0000A88E shcore.dll!Ordinal131+0x159E +00009C47 shcore.dll!Ordinal131+0x957 +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000014D3 RBX = 0000000000007530 RCX = 0000000000000001 RDX = 000000C86D2FFCB0 RSI = 00000000016185D4 RDI = 000002B9AA098220 R8 = 0000000000007530 R9 = 0000000000001CFF R10 = 0000000000000001 R11 = 0000000000000001 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000001 R15 = 0000000000000000 RIP = 00007FFC759FAD04 RSP = 000000C86D2FFC28 RBP = 000000C86D2FFC90 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +0000AD04 win32u.dll!NtUserMsgWaitForMultipleObjectsEx+0x14: 00007ffc`759face4 c3 ret 00007ffc`759face5 cd2e int 2Eh 00007ffc`759face7 c3 ret 00007ffc`759face8 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserMsgWaitForMultipleObjectsEx: 00007ffc`759facf0 4c8bd1 mov r10,rcx 00007ffc`759facf3 b8d3140000 mov eax,14D3h 00007ffc`759facf8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`759fad00 7503 jne win32u!NtUserMsgWaitForMultipleObjectsEx+0x15 (00007ffc`759fad05) 00007ffc`759fad02 0f05 syscall 00007ffc`759fad04 c3 ret +0000B476 shcore.dll!Ordinal131+0x2186: 00007ffc`77e1b444 48894520 mov qword ptr [rbp+20h],rax 00007ffc`77e1b448 e823a10500 call shcore!UnregisterScaleChangeEvent+0x26b0 (00007ffc`77e75570) 00007ffc`77e1b44d 84c0 test al,al 00007ffc`77e1b44f 0f84bb000000 je shcore!Ordinal131+0x2220 (00007ffc`77e1b510) 00007ffc`77e1b455 41b9ff1c0000 mov r9d,1CFFh 00007ffc`77e1b45b c744242006000000 mov dword ptr [rsp+20h],6 00007ffc`77e1b463 448bc3 mov r8d,ebx 00007ffc`77e1b466 488d5520 lea rdx,[rbp+20h] 00007ffc`77e1b46a b901000000 mov ecx,1 00007ffc`77e1b46f 48ff155aed0d00 call qword ptr [shcore!IsProcessInWDAGContainer+0x52ea0 (00007ffc`77efa1d0)] 00007ffc`77e1b476 0f1f440000 nop dword ptr [rax+rax] +0000A88E shcore.dll!Ordinal131+0x159E: 00007ffc`77e1a864 0f8fa8000000 jg shcore!Ordinal131+0x1622 (00007ffc`77e1a912) 00007ffc`77e1a86a 803d840c0d0000 cmp byte ptr [shcore!IsProcessInWDAGContainer+0x441c5 (00007ffc`77eeb4f5)],0 00007ffc`77e1a871 7425 je shcore!Ordinal131+0x15a8 (00007ffc`77e1a898) 00007ffc`77e1a873 418bc6 mov eax,r14d 00007ffc`77e1a876 f00fc1053a1a0d00 lock xadd dword ptr [shcore!IsProcessInWDAGContainer+0x44f88 (00007ffc`77eec2b8)],eax 00007ffc`77e1a87e 4103c6 add eax,r14d 00007ffc`77e1a881 83f80a cmp eax,0Ah 00007ffc`77e1a884 770b ja shcore!Ordinal131+0x15a1 (00007ffc`77e1a891) 00007ffc`77e1a886 488bcb mov rcx,rbx 00007ffc`77e1a889 e86e0b0000 call shcore!Ordinal131+0x210c (00007ffc`77e1b3fc) 00007ffc`77e1a88e 4032ff xor dil,dil +00009C47 shcore.dll!Ordinal131+0x957: 00007ffc`77e19c2c cc int 3 00007ffc`77e19c2d cc int 3 00007ffc`77e19c2e cc int 3 00007ffc`77e19c2f cc int 3 00007ffc`77e19c30 48895c2410 mov qword ptr [rsp+10h],rbx 00007ffc`77e19c35 57 push rdi 00007ffc`77e19c36 4883ec20 sub rsp,20h 00007ffc`77e19c3a 488bf9 mov rdi,rcx 00007ffc`77e19c3d 48894c2430 mov qword ptr [rsp+30h],rcx 00007ffc`77e19c42 e86d0b0000 call shcore!Ordinal131+0x14c4 (00007ffc`77e1a7b4) 00007ffc`77e19c47 488b5f40 mov rbx,qword ptr [rdi+40h] +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`780fe8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`780fe8c0 4053 push rbx 00007ffc`780fe8c2 4883ec20 sub rsp,20h 00007ffc`780fe8c6 33db xor ebx,ebx 00007ffc`780fe8c8 85c9 test ecx,ecx 00007ffc`780fe8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`780fe8e6) 00007ffc`780fe8cc 498bc8 mov rcx,r8 00007ffc`780fe8cf 488bc2 mov rax,rdx 00007ffc`780fe8d2 e839770500 call KERNEL32!TlsGetValue+0x1b00 (00007ffc`78156010) 00007ffc`780fe8d7 8bc8 mov ecx,eax +0008C53C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`788ec517 488b05c2621400 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x40f0 (00007ffc`78a327e0)] 00007ffc`788ec51e 4885c0 test rax,rax 00007ffc`788ec521 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`788ec547) 00007ffc`788ec523 488d0d5613f8ff lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7886d880)] 00007ffc`788ec52a 4c8bc2 mov r8,rdx 00007ffc`788ec52d 498bd1 mov rdx,r9 00007ffc`788ec530 483bc1 cmp rax,rcx 00007ffc`788ec533 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`788ec53e) 00007ffc`788ec535 33c9 xor ecx,ecx 00007ffc`788ec537 e8e45a0e00 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`789d2020) 00007ffc`788ec53c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`788ec566) ====================================================================== Thread 21344 / 0x5360 ====================================================================== LastError: 0x00000000 - Operace byla dokončena úspěšně. NTSTATUS: 0xC000000D - Službě nebo funkci byl předán neplatný parametr. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00001324 win32u.dll!NtUserGetMessage+0x14 +0003F622 USER32.dll!GetMessageW+0x22 +0002D384 ConEmuHk64.dll!SetLoadLibraryCallback+0xD914 +001179A4 dbgeng.DLL! (get the pdb) ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000001004 RBX = 000000C86D1FF928 RCX = 000000C86D1FF928 RDX = 0000000000000000 RSI = 0000000000000000 RDI = 0000000000000000 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 000000C86D1FF928 R11 = 000000C86D1FF928 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFC759F1324 RSP = 000000C86D1FF848 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00001324 win32u.dll!NtUserGetMessage+0x14: 00007ffc`759f1304 c3 ret 00007ffc`759f1305 cd2e int 2Eh 00007ffc`759f1307 c3 ret 00007ffc`759f1308 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserGetMessage: 00007ffc`759f1310 4c8bd1 mov r10,rcx 00007ffc`759f1313 b804100000 mov eax,1004h 00007ffc`759f1318 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`759f1320 7503 jne win32u!NtUserGetMessage+0x15 (00007ffc`759f1325) 00007ffc`759f1322 0f05 syscall 00007ffc`759f1324 c3 ret +0003F622 USER32.dll!GetMessageW+0x22: USER32!GetMessageW: 00007ffc`7868f600 e98f0b4dfd jmp 00007ffc`75b60194 00007ffc`7868f605 50 push rax 00007ffc`7868f606 418bc0 mov eax,r8d 00007ffc`7868f609 488bd9 mov rbx,rcx 00007ffc`7868f60c 410bc1 or eax,r9d 00007ffc`7868f60f a90000feff test eax,0FFFE0000h 00007ffc`7868f614 753b jne USER32!GetMessageW+0x51 (00007ffc`7868f651) 00007ffc`7868f616 48897c2460 mov qword ptr [rsp+60h],rdi 00007ffc`7868f61b 48ff156ec90600 call qword ptr [USER32!gapfnScSendMessage+0x1b50 (00007ffc`786fbf90)] 00007ffc`7868f622 0f1f440000 nop dword ptr [rax+rax] +0002D384 ConEmuHk64.dll!SetLoadLibraryCallback+0xD914: 00007e11`0002d363 488d0dbeffffff lea rcx,[ConEmuHk64!SetLoadLibraryCallback+0xd8b8 (00007e11`0002d328)] 00007e11`0002d36a e8010cffff call ConEmuHk64!GetLoadLibraryW+0x54 (00007e11`0001df70) 00007e11`0002d36f 33ff xor edi,edi 00007e11`0002d371 4885c0 test rax,rax 00007e11`0002d374 7439 je ConEmuHk64!SetLoadLibraryCallback+0xd93f (00007e11`0002d3af) 00007e11`0002d376 448bce mov r9d,esi 00007e11`0002d379 448bc5 mov r8d,ebp 00007e11`0002d37c 498bd6 mov rdx,r14 00007e11`0002d37f 488bcb mov rcx,rbx 00007e11`0002d382 ffd0 call rax 00007e11`0002d384 8bf8 mov edi,eax +001179A4 dbgeng.DLL! (get the pdb): 00007ffb`e892797e 19f6 sbb esi,esi 00007ffb`e8927980 ff488b dec dword ptr [rax-75h] 00007ffb`e8927983 4dd848ff fmul dword ptr [r8-1] 00007ffb`e8927987 15a4353c00 adc eax,3C35A4h 00007ffb`e892798c 0f1f440000 nop dword ptr [rax+rax] 00007ffb`e8927991 4533c9 xor r9d,r9d 00007ffb`e8927994 4533c0 xor r8d,r8d 00007ffb`e8927997 33d2 xor edx,edx 00007ffb`e8927999 488d4dc8 lea rcx,[rbp-38h] 00007ffb`e892799d 48ff156c765d00 call qword ptr [dbgeng!Ordinal453+0x3939d0 (00007ffb`e8eff010)] 00007ffb`e89279a4 0f1f440000 nop dword ptr [rax+rax] ====================================================================== Thread 21160 / 0x52A8 ====================================================================== LastError: 0x00000000 - Operace byla dokončena úspěšně. NTSTATUS: 0xC000000D - Službě nebo funkci byl předán neplatný parametr. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +001658A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +00075F3E ntdll.dll!RtlSetThreadSubProcessTag+0x1AEE +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001E6 RBX = 0000000000000000 RCX = 0000000000000A80 RDX = 000002B9AE6E1CD0 RSI = 00007FFC788D4EA0 RDI = 000002B9ACB5BE70 R8 = 0000000000000010 R9 = 000000C86D3FFBF8 R10 = 0000000000000A80 R11 = 0000000000000A80 R12 = 00007FFC78938330 R13 = 0000000000000000 R14 = 000000000000FFFF R15 = 00007FFC788D2C10 RIP = 00007FFC789C58A4 RSP = 000000C86D3FFB98 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +001658A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffc`789c5884 c3 ret 00007ffc`789c5885 cd2e int 2Eh 00007ffc`789c5887 c3 ret 00007ffc`789c5888 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffc`789c5890 4c8bd1 mov r10,rcx 00007ffc`789c5893 b8e6010000 mov eax,1E6h 00007ffc`789c5898 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`789c58a0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffc`789c58a5) 00007ffc`789c58a2 0f05 syscall 00007ffc`789c58a4 c3 ret +00075F3E ntdll.dll!RtlSetThreadSubProcessTag+0x1AEE: 00007ffc`788d5f06 488b03 mov rax,qword ptr [rbx] 00007ffc`788d5f09 4889842488000000 mov qword ptr [rsp+88h],rax 00007ffc`788d5f11 44896c2458 mov dword ptr [rsp+58h],r13d 00007ffc`788d5f16 488d842468020000 lea rax,[rsp+268h] 00007ffc`788d5f1e 4889442420 mov qword ptr [rsp+20h],rax 00007ffc`788d5f23 4c8d4c2458 lea r9,[rsp+58h] 00007ffc`788d5f28 448b442454 mov r8d,dword ptr [rsp+54h] 00007ffc`788d5f2d 488b942488000000 mov rdx,qword ptr [rsp+88h] 00007ffc`788d5f35 488b4f38 mov rcx,qword ptr [rdi+38h] 00007ffc`788d5f39 e852f90e00 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffc`789c5890) 00007ffc`788d5f3e 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`780fe8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`780fe8c0 4053 push rbx 00007ffc`780fe8c2 4883ec20 sub rsp,20h 00007ffc`780fe8c6 33db xor ebx,ebx 00007ffc`780fe8c8 85c9 test ecx,ecx 00007ffc`780fe8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`780fe8e6) 00007ffc`780fe8cc 498bc8 mov rcx,r8 00007ffc`780fe8cf 488bc2 mov rax,rdx 00007ffc`780fe8d2 e839770500 call KERNEL32!TlsGetValue+0x1b00 (00007ffc`78156010) 00007ffc`780fe8d7 8bc8 mov ecx,eax +0008C53C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`788ec517 488b05c2621400 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x40f0 (00007ffc`78a327e0)] 00007ffc`788ec51e 4885c0 test rax,rax 00007ffc`788ec521 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`788ec547) 00007ffc`788ec523 488d0d5613f8ff lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7886d880)] 00007ffc`788ec52a 4c8bc2 mov r8,rdx 00007ffc`788ec52d 498bd1 mov rdx,r9 00007ffc`788ec530 483bc1 cmp rax,rcx 00007ffc`788ec533 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`788ec53e) 00007ffc`788ec535 33c9 xor ecx,ecx 00007ffc`788ec537 e8e45a0e00 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`789d2020) 00007ffc`788ec53c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`788ec566) ====================================================================== Thread 21056 / 0x5240 ====================================================================== LastError: 0x00000000 - Operace byla dokončena úspěšně. NTSTATUS: 0xC000000D - Službě nebo funkci byl předán neplatný parametr. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00162744 ntdll.dll!NtWaitForMultipleObjects+0x14 +00039333 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123 +0009F1B7 CRYPT32.dll!I_CryptWalkAllLruCacheEntries+0x147 +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +0008C53C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000001 RCX = 0000000000000001 RDX = 000002B9AEAAA190 RSI = 000000C86D5FF800 RDI = 0000000000000001 R8 = 0000000000000001 R9 = 0000000000000000 R10 = 0000000000000001 R11 = 0000000000000001 R12 = 000002B9AEAAA190 R13 = 000000C86C0FB000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFC789C2744 RSP = 000000C86D5FF7B8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00162744 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffc`789c271f 00e9 add cl,ch 00007ffc`789c2721 cb retf 00007ffc`789c2722 b9f8ff6666 mov ecx,6666FFF8h 00007ffc`789c2727 660f1f840000000000 nop word ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffc`789c2730 4c8bd1 mov r10,rcx 00007ffc`789c2733 b85b000000 mov eax,5Bh 00007ffc`789c2738 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`789c2740 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffc`789c2745) 00007ffc`789c2742 0f05 syscall 00007ffc`789c2744 c3 ret +00039333 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123: 00007ffc`75bb930a 488d742440 lea rsi,[rsp+40h] 00007ffc`75bb930f 448b7c2438 mov r15d,dword ptr [rsp+38h] 00007ffc`75bb9314 4533c0 xor r8d,r8d 00007ffc`75bb9317 4585ff test r15d,r15d 00007ffc`75bb931a 410f94c0 sete r8b 00007ffc`75bb931e 4889742420 mov qword ptr [rsp+20h],rsi 00007ffc`75bb9323 450fb6ce movzx r9d,r14b 00007ffc`75bb9327 498bd4 mov rdx,r12 00007ffc`75bb932a 8bcb mov ecx,ebx 00007ffc`75bb932c 48ff1545af2500 call qword ptr [KERNELBASE!TlsGetValue+0xfdb88 (00007ffc`75e14278)] 00007ffc`75bb9333 0f1f440000 nop dword ptr [rax+rax] +0009F1B7 CRYPT32.dll!I_CryptWalkAllLruCacheEntries+0x147: 00007ffc`7621f193 488bd9 mov rbx,rcx 00007ffc`7621f196 48f7d8 neg rax 00007ffc`7621f199 1bff sbb edi,edi 00007ffc`7621f19b f7df neg edi 00007ffc`7621f19d 448b4b30 mov r9d,dword ptr [rbx+30h] 00007ffc`7621f1a1 488d5310 lea rdx,[rbx+10h] 00007ffc`7621f1a5 8364242000 and dword ptr [rsp+20h],0 00007ffc`7621f1aa 8d4f01 lea ecx,[rdi+1] 00007ffc`7621f1ad 4533c0 xor r8d,r8d 00007ffc`7621f1b0 48ff15c9660900 call qword ptr [CRYPT32!CryptMsgSignCTL+0x24dd0 (00007ffc`762b5880)] 00007ffc`7621f1b7 0f1f440000 nop dword ptr [rax+rax] +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`780fe8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`780fe8c0 4053 push rbx 00007ffc`780fe8c2 4883ec20 sub rsp,20h 00007ffc`780fe8c6 33db xor ebx,ebx 00007ffc`780fe8c8 85c9 test ecx,ecx 00007ffc`780fe8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`780fe8e6) 00007ffc`780fe8cc 498bc8 mov rcx,r8 00007ffc`780fe8cf 488bc2 mov rax,rdx 00007ffc`780fe8d2 e839770500 call KERNEL32!TlsGetValue+0x1b00 (00007ffc`78156010) 00007ffc`780fe8d7 8bc8 mov ecx,eax +0008C53C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`788ec517 488b05c2621400 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x40f0 (00007ffc`78a327e0)] 00007ffc`788ec51e 4885c0 test rax,rax 00007ffc`788ec521 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`788ec547) 00007ffc`788ec523 488d0d5613f8ff lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7886d880)] 00007ffc`788ec52a 4c8bc2 mov r8,rdx 00007ffc`788ec52d 498bd1 mov rdx,r9 00007ffc`788ec530 483bc1 cmp rax,rcx 00007ffc`788ec533 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`788ec53e) 00007ffc`788ec535 33c9 xor ecx,ecx 00007ffc`788ec537 e8e45a0e00 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`789d2020) 00007ffc`788ec53c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`788ec566) ====================================================================== Modules ====================================================================== 0x00007FF6EF430000 - 0x00007FF6EF9C2000 | C:\Program Files\Far\Far.exe | File and archive manager | 3.0.6575.0 x64 0x00007FFC78860000 - 0x00007FFC78AC8000 | C:\Windows\SYSTEM32\ntdll.dll | NT Layer DLL | 10.0.26100.6725 (WinBuild.160101.0800) 0x00007FFC780D0000 - 0x00007FFC78199000 | C:\Windows\System32\KERNEL32.DLL | Windows NT BASE API Client DLL | 10.0.26100.6725 (WinBuild.160101.0800) 0x00007FFC75B80000 - 0x00007FFC75F72000 | C:\Windows\System32\KERNELBASE.dll | Windows NT BASE API Client DLL | 10.0.26100.6725 (WinBuild.160101.0800) 0x00007FFC71A30000 - 0x00007FFC71ACF000 | C:\Windows\SYSTEM32\apphelp.dll | Application Compatibility client library | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC76A60000 - 0x00007FFC76B14000 | C:\Windows\System32\ADVAPI32.dll | Advanced Windows 32 Base API | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC78020000 - 0x00007FFC780C9000 | C:\Windows\System32\msvcrt.dll | Windows NT CRT DLL | 7.0.26100.6899 (WinBuild.160101.0800) 0x00007FFC768F0000 - 0x00007FFC76996000 | C:\Windows\System32\sechost.dll | Host for SCM/SDDL/LSA Lookup APIs | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC767D0000 - 0x00007FFC768E8000 | C:\Windows\System32\RPCRT4.dll | Remote Procedure Call Runtime | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC78650000 - 0x00007FFC78815000 | C:\Windows\System32\USER32.dll | Multi-User Windows USER API Client DLL | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC759F0000 - 0x00007FFC75A17000 | C:\Windows\System32\win32u.dll | Win32u | 10.0.26100.6899 (WinBuild.160101.0800) 0x00007FFC78320000 - 0x00007FFC7834B000 | C:\Windows\System32\GDI32.dll | GDI Client DLL | 10.0.26100.6725 (WinBuild.160101.0800) 0x00007FFC76500000 - 0x00007FFC7662D000 | C:\Windows\System32\gdi32full.dll | GDI Client DLL | 10.0.26100.6899 (WinBuild.160101.0800) 0x00007FFC75F80000 - 0x00007FFC76023000 | C:\Windows\System32\msvcp_win.dll | Microsoft® C Runtime Library | 10.0.26100.6899 (WinBuild.160101.0800) 0x00007FFC76030000 - 0x00007FFC7617B000 | C:\Windows\System32\ucrtbase.dll | Microsoft® C Runtime Library | 10.0.26100.6899 (WinBuild.160101.0800) 0x00007FFC76B20000 - 0x00007FFC7726D000 | C:\Windows\System32\SHELL32.dll | Windows Shell Common Dll | 10.0.26100.6899 (WinBuild.160101.0800) 0x00007FFC76300000 - 0x00007FFC7646B000 | C:\Windows\System32\wintypes.dll | Windows Base Types DLL | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC77820000 - 0x00007FFC77B9B000 | C:\Windows\System32\combase.dll | Microsoft COM for Windows | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC76630000 - 0x00007FFC767C8000 | C:\Windows\System32\ole32.dll | Microsoft OLE for Windows | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC781A0000 - 0x00007FFC781A8000 | C:\Windows\System32\PSAPI.DLL | Process Status Helper | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC77310000 - 0x00007FFC77798000 | C:\Windows\System32\SETUPAPI.dll | Windows Setup API | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC77D10000 - 0x00007FFC77E03000 | C:\Windows\System32\COMDLG32.dll | Common Dialogs DLL | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC77E10000 - 0x00007FFC77F02000 | C:\Windows\System32\shcore.dll | SHCORE | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC782B0000 - 0x00007FFC78312000 | C:\Windows\System32\SHLWAPI.dll | Shell Light-weight Utility Library | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC772D0000 - 0x00007FFC772FF000 | C:\Windows\System32\IMM32.dll | Multi-User Windows IMM32 API Client DLL | 10.0.26100.4484 (WinBuild.160101.0800) 0x00007FFC69750000 - 0x00007FFC6976A000 | C:\Windows\SYSTEM32\NETAPI32.dll | Net Win32 API DLL | 10.0.26100.1150 (WinBuild.160101.0800) 0x00007FFC3EDA0000 - 0x00007FFC3EE51000 | C:\Windows\SYSTEM32\WINSPOOL.DRV | Windows Spooler Driver | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC5F3D0000 - 0x00007FFC5F3F1000 | C:\Windows\SYSTEM32\MPR.dll | Multiple Provider Router DLL | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC71FB0000 - 0x00007FFC71FBD000 | C:\Windows\SYSTEM32\Secur32.dll | Security Support Provider Interface | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC614D0000 - 0x00007FFC614DB000 | C:\Windows\SYSTEM32\VERSION.dll | Version Checking and File Installation Libraries | 10.0.26100.1150 (WinBuild.160101.0800) 0x00007FFC74D70000 - 0x00007FFC74D9B000 | C:\Windows\SYSTEM32\USERENV.dll | Userenv | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC59300000 - 0x00007FFC59593000 | C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6899_none_3e0efeeae32e88c1\COMCTL32.dll | User Experience Controls Library | 6.10 (WinBuild.160101.0800) 0x00007FFC2EA00000 - 0x00007FFC2EB26000 | C:\Program Files\Far\sqlite3.dll | SQLite is a software library that implements a self-contained, serverless, zero-configuration, transactional SQL database engine. | 3.50.4 0x00007FFC75590000 - 0x00007FFC755E7000 | C:\Windows\SYSTEM32\cfgmgr32.dll | Configuration Manager DLL | 10.0.26100.4202 (WinBuild.160101.0800) 0x00007FFC73F30000 - 0x00007FFC73F3D000 | C:\Windows\SYSTEM32\NETUTILS.DLL | Net Win32 API Helpers DLL | 10.0.26100.1882 (WinBuild.160101.0800) 0x00007FFC73F10000 - 0x00007FFC73F2B000 | C:\Windows\SYSTEM32\SAMCLI.DLL | Security Accounts Manager Client DLL | 10.0.26100.4768 (WinBuild.160101.0800) 0x00007FFC5AFD0000 - 0x00007FFC5AFF9000 | C:\Windows\SYSTEM32\SRVCLI.DLL | Server Service Client DLL | 10.0.26100.1150 (WinBuild.160101.0800) 0x00007FFC74A20000 - 0x00007FFC74A69000 | C:\Windows\SYSTEM32\SSPICLI.DLL | Security Support Provider Interface | 10.0.26100.6725 (WinBuild.160101.0800) 0x00007FFC2E000000 - 0x00007FFC2E09B000 | C:\Program Files\ESET\ESET Security\ebehmoni.dll | Deep Behavioral Inspection Monitor | 1.0.82.0 0x00007E1100000000 - 0x00007E1100085000 | C:\Program Files\ConEmu\ConEmu\ConEmuHk64.dll | ConEmu injects (x64) | 230724 0x00007FFC74780000 - 0x00007FFC7479B000 | C:\Windows\SYSTEM32\kernel.appcore.dll | AppModel API Host | 10.0.26100.6725 (WinBuild.160101.0800) 0x00007FFC724F0000 - 0x00007FFC7259A000 | C:\Windows\system32\uxtheme.dll | Microsoft UxTheme Library | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC77BB0000 - 0x00007FFC77D0B000 | C:\Windows\System32\MSCTF.dll | MSCTF Server DLL | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC733F0000 - 0x00007FFC73C4D000 | C:\Windows\SYSTEM32\windows.storage.dll | Microsoft WinRT Storage API | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC75910000 - 0x00007FFC75939000 | C:\Windows\SYSTEM32\profapi.dll | User Profile Basic API | 10.0.26100.4768 (WinBuild.160101.0800) 0x00007FFC75A20000 - 0x00007FFC75AB8000 | C:\Windows\System32\bcryptPrimitives.dll | Windows Cryptographic Primitives Library | 10.0.26100.6899 (WinBuild.160101.0800) 0x00007FFC769A0000 - 0x00007FFC76A51000 | C:\Windows\System32\clbcatq.dll | COM+ Configuration Catalog | 2001.12.10941.16384 (WinBuild.160101.0800) 0x00007FFC140E0000 - 0x00007FFC143A0000 | C:\Windows\system32\explorerframe.dll | ExplorerFrame | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC5D9C0000 - 0x00007FFC5E00E000 | C:\Windows\System32\OneCoreUAPCommonProxyStub.dll | OneCoreUAP Common Proxy Stub | 10.0.26100.6725 (WinBuild.160101.0800) 0x00007FFC58D40000 - 0x00007FFC58D9A000 | C:\Program Files\Far\Plugins\!add\ConEmu\ConEmu.x64.dll | ConEmu plugin for FAR manager 1.7x and 2.x (x64) | 230724 0x00007FFC629A0000 - 0x00007FFC629CC000 | C:\Program Files\Far\Plugins\!add\DiskMenu\DiskMenu.dll | Disk menu editor plugin for Far 3.0 | 3.13.4.4040 0x0000000110000000 - 0x000000011004B000 | C:\Program Files\Far\Plugins\!add\EnvMan\EnvMan.dll | Environment Manager Plugin for FAR Manager | 1.7 0x00007FFC77F40000 - 0x00007FFC78017000 | C:\Windows\System32\oleaut32.dll | OLEAUT32.DLL | 10.0.26100.6725 (WinBuild.160101.0800) 0x00007FFC3FD60000 - 0x00007FFC3FDA3000 | C:\Program Files\Far\Plugins\!add\PortaDev\PortaDev.dll | Windows Portable Devices wrapper plugin for Far 3.0 | 3.15.4040.3 0x00007FFC635A0000 - 0x00007FFC6363D000 | C:\Windows\System32\PortableDeviceApi.dll | Windows Portable Device API Components | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC75540000 - 0x00007FFC7556D000 | C:\Windows\SYSTEM32\DEVOBJ.dll | Device Information Set DLL | 10.0.26100.1150 (WinBuild.160101.0800) 0x00007FFC76470000 - 0x00007FFC764EF000 | C:\Windows\System32\WINTRUST.dll | Microsoft Trust Verification APIs | 10.0.26100.6899 (WinBuild.160101.0800) 0x00007FFC76180000 - 0x00007FFC762F7000 | C:\Windows\System32\CRYPT32.dll | Crypto API32 | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC75110000 - 0x00007FFC75123000 | C:\Windows\SYSTEM32\MSASN1.dll | ASN.1 Runtime APIs | 10.0.26100.6899 (WinBuild.160101.0800) 0x00007FFC2CC90000 - 0x00007FFC2CD11000 | C:\Program Files\Far\Plugins\!add\Renewal\Renewal.dll | Autoupdate for Far and plugins plugin for Far 3.0 | 3.25.4040.2 0x00007FFC6C1B0000 - 0x00007FFC6C2CF000 | C:\Windows\SYSTEM32\WINHTTP.dll | Windows HTTP Services | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC61180000 - 0x00007FFC614C9000 | C:\Windows\SYSTEM32\msi.dll | Windows Installer | 5.0.26100.6725 0x00007FFC758E0000 - 0x00007FFC75906000 | C:\Windows\SYSTEM32\bcrypt.dll | Windows Cryptographic Primitives Library | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC59080000 - 0x00007FFC590A3000 | C:\Program Files\Far\Plugins\LuaMacro\LuaMacro.dll | Lua Macros for Far Manager | 3.0.896.0 0x0000000066D80000 - 0x0000000066E00000 | C:\Program Files\Far\lua51.dll | 0x00000715 - V souboru bitové kopie nelze nalézt zadaný typ prostředku. 0x00007FFC2C340000 - 0x00007FFC2C3EE000 | C:\Program Files\Far\luafar3.dll | LuaFar library | 3.0.896.0 0x00007FFC74F10000 - 0x00007FFC74F1C000 | C:\Windows\SYSTEM32\CRYPTBASE.DLL | Base cryptographic API DLL | 10.0.26100.6899 (WinBuild.160101.0800) 0x00007FFC587F0000 - 0x00007FFC58829000 | C:\Program Files\Far\Plugins\TmpPanel\TmpPanel.dll | Temporary Panel for Far Manager | 3.0.121.0 0x00007FFC193B0000 - 0x00007FFC193D2000 | C:\Windows\System32\p9np.dll | Plan 9 Network Provider | 10.0.26100.4768 (WinBuild.160101.0800) 0x00007FFC193A0000 - 0x00007FFC193AD000 | C:\Windows\System32\drprov.dll | Microsoft Remote Desktop Session Host Server Network Provider | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC19370000 - 0x00007FFC19395000 | C:\Windows\System32\ntlanman.dll | Microsoft® Lan Manager | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC19340000 - 0x00007FFC19361000 | C:\Windows\System32\davclnt.dll | Web DAV Client DLL | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC69100000 - 0x00007FFC6911B000 | C:\Windows\System32\wkscli.dll | Workstation Service Client DLL | 10.0.26100.1882 (WinBuild.160101.0800) 0x00007FFC61630000 - 0x00007FFC61643000 | C:\Windows\SYSTEM32\cscapi.dll | Offline Files Win32 API | 10.0.26100.1 (WinBuild.160101.0800) 0x0000000180000000 - 0x0000000180034000 | C:\Program Files\Far\Plugins\!add\json\json.dll | XML Browser Plugin for FAR | 1.30 0x000002B9A9F30000 - 0x000002B9A9F78000 | C:\Program Files\Far\Plugins\!add\XMLDOM\XMLDOM.dll | XML Browser Plugin for FAR | 2.52 0x00007FFBD7750000 - 0x00007FFBD7EDF000 | C:\Program Files\Far\Plugins\NetBox\NetBox.dll | NetBox: SFTP/FTP/FTPS/SCP/WebDAV/S3 client for Far Manager 3.0 | 24.12.2.608 0x00007FFC750B0000 - 0x00007FFC750CB000 | C:\Windows\SYSTEM32\CRYPTSP.dll | Cryptographic Service Provider API | 10.0.26100.6899 (WinBuild.160101.0800) 0x00007FFC746E0000 - 0x00007FFC7471B000 | C:\Windows\system32\rsaenh.dll | Microsoft Enhanced Cryptographic Provider | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC6C890000 - 0x00007FFC6C994000 | C:\Windows\system32\propsys.dll | Microsoft Property System | 7.0.26100.4768 (WinBuild.160101.0800) 0x000002B9AB110000 - 0x000002B9AB184000 | C:\Windows\System32\ws2_32.dll | Windows Socket 2.0 32-Bit DLL | 10.0.26100.2308 (WinBuild.160101.0800) 0x000002B9A9FD0000 - 0x000002B9A9FD3000 | C:\Windows\SYSTEM32\security.dll | Security Support Provider Interface | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC74CD0000 - 0x00007FFC74D3B000 | C:\Windows\system32\mswsock.dll | Poskytovatel služeb Microsoft Windows Sockets 2.0 | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC74000000 - 0x00007FFC74126000 | C:\Windows\SYSTEM32\DNSAPI.dll | DNS Client API DLL | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC73F70000 - 0x00007FFC73FA4000 | C:\Windows\SYSTEM32\IPHLPAPI.DLL | IP Helper API | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC77BA0000 - 0x00007FFC77BAA000 | C:\Windows\System32\NSI.dll | NSI User-mode interface DLL | 10.0.26100.6899 (WinBuild.160101.0800) 0x00007FFC63640000 - 0x00007FFC6364B000 | C:\Windows\System32\rasadhlp.dll | Remote Access AutoDial Helper | 10.0.26100.6584 (WinBuild.160101.0800) 0x00007FFC6CF30000 - 0x00007FFC6CFB6000 | C:\Windows\System32\fwpuclnt.dll | FWP/IPsec User-Mode API | 10.0.26100.3915 (WinBuild.160101.0800) 0x00007FFC755F0000 - 0x00007FFC755FA000 | C:\Windows\SYSTEM32\DPAPI.DLL | Data Protection API | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC562F0000 - 0x00007FFC56329000 | C:\Program Files\Far\Plugins\!add\PictureView\0PictureView.dll | PictureView | 2021.4.19.0 0x00007FFC21C60000 - 0x00007FFC21D6C000 | C:\Windows\SYSTEM32\OPENGL32.dll | OpenGL Client DLL | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC720C0000 - 0x00007FFC720F5000 | C:\Windows\SYSTEM32\WINMM.dll | MCI API DLL | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC56140000 - 0x00007FFC5616D000 | C:\Windows\SYSTEM32\GLU32.dll | OpenGL Utility Library DLL | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC72860000 - 0x00007FFC728A4000 | C:\Windows\SYSTEM32\dxcore.dll | DXCore | 10.0.26100.6725 (WinBuild.160101.0800) 0x00007FFC6D7E0000 - 0x00007FFC6D7E4000 | C:\Program Files\Far\Plugins\!add\PictureView\BMP.pvd | 0x00000715 - V souboru bitové kopie nelze nalézt zadaný typ prostředku. 0x00007FFC6B8E0000 - 0x00007FFC6B8FF000 | C:\Program Files\Far\Plugins\!add\PictureView\BPG.pvd | 0x00000715 - V souboru bitové kopie nelze nalézt zadaný typ prostředku. 0x00007FFC15C10000 - 0x00007FFC15CB2000 | C:\Program Files\Far\Plugins\!add\PictureView\FLIF.pvd | 0x00000715 - V souboru bitové kopie nelze nalézt zadaný typ prostředku. 0x00007FFC6D7D0000 - 0x00007FFC6D7D5000 | C:\Program Files\Far\Plugins\!add\PictureView\ITP.pvd | 0x00000715 - V souboru bitové kopie nelze nalézt zadaný typ prostředku. 0x00007FFC4C140000 - 0x00007FFC4C164000 | C:\Program Files\Far\Plugins\!add\PictureView\JLS.pvd | 0x00000715 - V souboru bitové kopie nelze nalézt zadaný typ prostředku. 0x00007FFC377F0000 - 0x00007FFC37830000 | C:\Program Files\Far\Plugins\!add\PictureView\JpegRec.pvd | 0x00000715 - V souboru bitové kopie nelze nalézt zadaný typ prostředku. 0x00007FFC2C450000 - 0x00007FFC2C4B8000 | C:\Program Files\Far\Plugins\!add\PictureView\TIFF.pvd | 0x00000715 - V souboru bitové kopie nelze nalézt zadaný typ prostředku. 0x00007FFC6B790000 - 0x00007FFC6B7AD000 | C:\Program Files\Far\Plugins\!add\PictureView\WebP.pvd | 0x00000715 - V souboru bitové kopie nelze nalézt zadaný typ prostředku. 0x00007FFC639B0000 - 0x00007FFC639B6000 | C:\Program Files\Far\Plugins\!add\PictureView\WIC.pvd | 0x00000715 - V souboru bitové kopie nelze nalézt zadaný typ prostředku. 0x00007FFC6DE00000 - 0x00007FFC6E030000 | C:\Windows\System32\windowscodecs.dll | Microsoft Windows Codecs Library | 10.0.26100.6899 (WinBuild.160101.0800) 0x00007FFC11D20000 - 0x00007FFC11E12000 | C:\Program Files\Far\Plugins\ArcLite\arclite.dll | Archive support for Far Manager (based on 7-Zip project) | 3.0.352.0 0x000000005EC40000 - 0x000000005EE21000 | C:\Program Files\Far\Plugins\ArcLite\7z.dll | 7z Plugin | 25.00 0x00007FFC2C2E0000 - 0x00007FFC2C33B000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\AudioPlayer.dll | Audio player plugin for Far 3.0 | 3.48.5055.21 0x00007FFC2C230000 - 0x00007FFC2C28C000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\bass.dll | BASS | 2.4.18 0x00007FFC15A30000 - 0x00007FFC15A51000 | C:\Windows\SYSTEM32\MSACM32.dll | Microsoft ACM Audio Filter | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFBF2A40000 - 0x00007FFBF2AC7000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\bassmidi.dll | BASSMIDI | 2.4.15 0x00007FFC639A0000 - 0x00007FFC639AD000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\basswasapi.dll | BASSWASAPI | 2.4.4 0x00007FFC62980000 - 0x00007FFC62991000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\bassmix.dll | BASSmix | 2.4.12 0x00007FFC3A0E0000 - 0x00007FFC3A10B000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\bassasio.dll | BASSASIO | 1.4.2 0x00007FFC638F0000 - 0x00007FFC638FF000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\tags.dll | Tags BASS add-on | 19 0x00007FFBF29A0000 - 0x00007FFBF2A3B000 | C:\Windows\SYSTEM32\msvcp60.dll | Windows NT C++ Runtime Library DLL | 7.0.26100.1 (WinBuild.160101.0800) 0x00007FFC63760000 - 0x00007FFC6376C000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\bassalac.dll | BASSALAC | 2.4.1 0x00007FFC62070000 - 0x00007FFC6208B000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\bassape.dll | BASSAPE | 2.4 0x00007FFC63670000 - 0x00007FFC63680000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\basscd.dll | BASSCD | 2.4.8 0x00007FFC62FD0000 - 0x00007FFC62FD9000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\bassdsd.dll | BASSDSD | 2.4 0x00007FFC562B0000 - 0x00007FFC562C4000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\bassflac.dll | BASSFLAC | 2.4.5 0x00007FFC62B70000 - 0x00007FFC62B7B000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\basshls.dll | BASSHLS | 2.4.4 0x00007FFC38200000 - 0x00007FFC38224000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\bassopus.dll | BASSOPUS | 2.4.3 0x00007FFC62A40000 - 0x00007FFC62A4F000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\basswebm.dll | BASSWEBM | 2.4 0x00007FFC62850000 - 0x00007FFC6285F000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\basswma.dll | BASSWMA | 2.4.5 0x00007FFC37180000 - 0x00007FFC37197000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\basswv.dll | BASSWV | 2.4.7 0x00007FFC35CB0000 - 0x00007FFC35CEE000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\bass_aac.dll | Advanced Audio Coding and MPEG-4 add-on for the BASS library | 2.4.7 0x00007FFC61650000 - 0x00007FFC6165F000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\bass_ac3.dll | Dolby Digital AC-3 add-on for the BASS library | 2.4.0.8 0x00007FFC37160000 - 0x00007FFC37175000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\bass_ape.dll | Monkey's Audio add-on for the BASS library | 2.4.2 0x00007FFC2F590000 - 0x00007FFC2F5A1000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\bass_mpc.dll | Musepack add-on for the BASS library | 2.4.1.2 0x00007FFC2F570000 - 0x00007FFC2F587000 | C:\Program Files\Far\Plugins\!add\AudioPlayer\bass_spx.dll | Speex add-on for the BASS library | 2.4.3 0x00007FFC5E850000 - 0x00007FFC5E8E8000 | C:\Windows\System32\MMDevApi.dll | MMDevice API | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC2F2C0000 - 0x00007FFC2F47B000 | C:\Windows\SYSTEM32\AUDIOSES.DLL | Audio Session | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC72BE0000 - 0x00007FFC72BF4000 | C:\Windows\SYSTEM32\resourcepolicyclient.dll | Resource Policy Client | 10.0.26100.1150 (WinBuild.160101.0800) 0x00007FFC75850000 - 0x00007FFC758AE000 | C:\Windows\SYSTEM32\powrprof.dll | Power Profile Helper DLL | 10.0.26100.4202 (WinBuild.160101.0800) 0x00007FFC75830000 - 0x00007FFC75844000 | C:\Windows\SYSTEM32\UMPDC.dll | User Mode Power Dependency Coordinator | 10.0.26100.1301 (WinBuild.160101.0800) 0x00007FFC6C3C0000 - 0x00007FFC6C3CB000 | C:\Windows\SYSTEM32\avrt.DLL | Multimediální modul runtime v reálném čase | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC2CC40000 - 0x00007FFC2CC8D000 | C:\Program Files\Far\Plugins\!add\JClassInfo\JClassInfo.dll | Java class file viewer and decompiler plugin for Far 3.0 | 3.12.4040.0 0x00000000642C0000 - 0x00000000642DC000 | C:\Program Files\Far\Plugins\!add\EventViewer\ntevent.dll | Event Viewer FAR Plugin for FAR Manager 3+. | 0.6 build 2 Release 0x00007FFC17DA0000 - 0x00007FFC17DE6000 | C:\Program Files\Far\Plugins\!add\RegBrowser\Registry.dll | 0x00000715 - V souboru bitové kopie nelze nalézt zadaný typ prostředku. 0x00007FFBF2910000 - 0x00007FFBF299D000 | C:\Windows\SYSTEM32\ACLUI.dll | Security Descriptor Editor | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC60C10000 - 0x00007FFC60C3B000 | C:\Windows\SYSTEM32\NTDSAPI.dll | Active Directory Domain Services API | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC63DC0000 - 0x00007FFC63E04000 | C:\Windows\SYSTEM32\XmlLite.dll | Microsoft XmlLite Library | 10.0.26100.6725 (WinBuild.160101.0800) 0x00007FFC21C20000 - 0x00007FFC21C5F000 | C:\Program Files\Far\Plugins\!add\SQLiteDB\SQLiteDB.dll | SQLite database editor plugin for Far 3.0 | 3.38.6299.0 0x00007FFC218B0000 - 0x00007FFC21A2B000 | C:\Windows\System32\Windows.System.Launcher.dll | Windows.System.Launcher | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC53ED0000 - 0x00007FFC53EEA000 | C:\Windows\SYSTEM32\windows.staterepositorycore.dll | Windows StateRepository API Core | 10.0.26100.6899 (WinBuild.160101.0800) 0x00007FFC5E6F0000 - 0x00007FFC5E719000 | C:\Windows\SYSTEM32\edputil.dll | Nástroj EDP | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC22680000 - 0x00007FFC22744000 | C:\Windows\System32\Windows.StateRepositoryPS.dll | Windows StateRepository Proxy/Stub Server | 10.0.26100.6899 (WinBuild.160101.0800) 0x00007FFC5B3B0000 - 0x00007FFC5B590000 | C:\Windows\SYSTEM32\urlmon.dll | OLE32 Extensions for Win32 | 11.00.26100.2308 (WinBuild.160101.0800) 0x00007FFC5B0E0000 - 0x00007FFC5B3A5000 | C:\Windows\SYSTEM32\iertutil.dll | Nástroj run-time pro aplikaci Internet Explorer | 11.00.26100.2308 (WinBuild.160101.0800) 0x00007FFC60C60000 - 0x00007FFC60C77000 | C:\Windows\SYSTEM32\virtdisk.dll | Virtual Disk API DLL | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC74FB0000 - 0x00007FFC75015000 | C:\Windows\SYSTEM32\Wldp.dll | Windows Lockdown Policy | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC72FC0000 - 0x00007FFC73202000 | C:\Windows\SYSTEM32\dbghelp.DLL | Windows Image Helper | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC5B870000 - 0x00007FFC5B8AC000 | C:\Windows\SYSTEM32\dbgcore.DLL | Windows Core Debugging Helpers | 10.0.26100.6725 (WinBuild.160101.0800) 0x00007FFBE8810000 - 0x00007FFBE8F2C000 | C:\Windows\SYSTEM32\dbgeng.DLL | Windows Symbolic Debugger Engine | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFBF1A30000 - 0x00007FFBF1B49000 | C:\Windows\SYSTEM32\dbgmodel.dll | Windows Debugger Data Model | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC77F10000 - 0x00007FFC77F30000 | C:\Windows\System32\imagehlp.dll | Windows NT Image Helper | 10.0.26100.4202 (WinBuild.160101.0800) 0x00007FFC74D40000 - 0x00007FFC74D67000 | C:\Windows\SYSTEM32\gpapi.dll | Group Policy Client API | 10.0.26100.2308 (WinBuild.160101.0800) 0x00007FFC636B0000 - 0x00007FFC636EB000 | C:\Windows\SYSTEM32\cryptnet.dll | Crypto Network Related API | 10.0.26100.3624 (WinBuild.160101.0800) 0x00007FFC72640000 - 0x00007FFC7264F000 | C:\Windows\SYSTEM32\WINNSI.DLL | Network Store Information RPC interface | 10.0.26100.6899 (WinBuild.160101.0800) ====================================================================== Environment ====================================================================== FARADMINMODE=1 FARHOME=C:\Program Files\Far FARLANG=English FARLOCALPROFILE=C:\Users\anonymize\AppData\Local\Far Manager\Profile FARPROFILE=C:\Users\anonymize\AppData\Roaming\Far Manager\Profile