====================================================================== Summary ====================================================================== Exception: 0xC0000005 - STATUS_ACCESS_VIOLATION Details: Memory at [00007FFACF6AAE70 ! (get the pdb)] could not be executed errno: 0x00000000 - No error LastError: 0x00000057 - The parameter is incorrect. NTSTATUS: 0xC000000D - An invalid parameter was passed to a service or function. Address: 00007FFACF6AAE70 ! (get the pdb) Location: unhandled_exception_filter_impl, exception_handler.cpp(2212) Module: C:\Program Files\Far Manager\Far.exe Plugin: N/A ====================================================================== System information ====================================================================== Far: 3.0.6644.0 x64 (1a4340d) Compiler: Microsoft Visual C++, version 19.41.33923.0 Library: Microsoft STL, version 14.3.202404 PE time: 2026-02-12 01:10:04.000 File time: 2026-02-11 23:10:34.000 Time: 2026-03-12 15:13:32.402 Local: 2026-03-12 17:13:32.402 +0200, Фінляндія (зима) Uptime: 00:00:02 OS: Windows NT Workstation 10.0.19045, 0x100/0x30 (Windows 10 Pro, version 22H2, OS build 19045.7058) Locale: uk-UA | LCID=00000422 (Lang=0422 (Primary=022 Sub=01) Sort=0 SortVersion=0) | ANSI=1251 OEM=866 Host: C:\Windows\System32\conhost.exe 10.0.19041.320 (WinBuild.160101.0800) Parent: C:\Windows\explorer.exe 10.0.19041.4522 (WinBuild.160101.0800) Command: "C:\Program Files\Far Manager\Far.exe" Elevated: No (Limited) Memory: 14.1 G out of 27.9 G free (50%); 8.86 M used by the process ====================================================================== Exception ====================================================================== ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- 00007FFACF6AAE70 ! (get the pdb) +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00007FFACF6AAE70 RBX = 0000000000000000 RCX = 000001DFD46815C0 RDX = 00007FFACF6AAE70 RSI = 0000000000000000 RDI = 0000000000000000 R8 = 000001DFD46815C0 R9 = 00007FFACF6AAE70 R10 = 0000000000000000 R11 = 0000000000000000 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFACF6AAE70 RSP = 0000000EDDAFFAB8 RBP = 0000000000000000 EFL = 00010246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- 00007FFACF6AAE70 ! (get the pdb): No prior disassembly possible 00007ffa`cf6aae70 ?? ??? 00007ffa`cf6aae71 ?? ??? 00007ffa`cf6aae72 ?? ??? 00007ffa`cf6aae73 ?? ??? 00007ffa`cf6aae74 ?? ??? 00007ffa`cf6aae75 ?? ??? 00007ffa`cf6aae76 ?? ??? 00007ffa`cf6aae77 ?? ??? 00007ffa`cf6aae78 ?? ??? 00007ffa`cf6aae79 ?? ??? +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`7b50735d cc int 3 00007ffb`7b50735e cc int 3 00007ffb`7b50735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`7b507360 4883ec28 sub rsp,28h 00007ffb`7b507364 85c9 test ecx,ecx 00007ffb`7b507366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383) 00007ffb`7b507368 498bc8 mov rcx,r8 00007ffb`7b50736b 488bc2 mov rax,rdx 00007ffb`7b50736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)] 00007ffb`7b507374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`7bdbcc72 ec in al,dx 00007ffb`7bdbcc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1) 00007ffb`7bdbcc75 8bc9 mov ecx,ecx 00007ffb`7bdbcc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)] 00007ffb`7bdbcc7e 4885c0 test rax,rax 00007ffb`7bdbcc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93) 00007ffb`7bdbcc83 4c8bc2 mov r8,rdx 00007ffb`7bdbcc86 488bd1 mov rdx,rcx 00007ffb`7bdbcc89 33c9 xor ecx,ecx 00007ffb`7bdbcc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)] 00007ffb`7bdbcc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3) ====================================================================== Exception handler thread ====================================================================== ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +0012E692 Far.exe!collect_information(class exception_context const & __ptr64,struct source_location const & __ptr64,class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,struct error_state_ex const & __ptr64,class std::span)+0x1902 (exception_handler.obj) +00130DA5 Far.exe!handle_generic_exception(class exception_context const & __ptr64,struct source_location const & __ptr64,class Plugin const * __ptr64 const,class std::basic_string_view >,class std::basic_string_view >,struct error_state_ex const & __ptr64,class std::span)+0x955 (exception_handler.obj) +0013217E Far.exe!handle_seh_exception(class exception_context const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)+0x30E (exception_handler.obj) +00132EA3 Far.exe!detail::seh_filter(struct _EXCEPTION_POINTERS const * __ptr64,class Plugin const * __ptr64,struct source_location const & __ptr64)+0x173 (exception_handler.obj) +001326F0 Far.exe!unhandled_exception_filter_impl(struct _EXCEPTION_POINTERS * __ptr64 const)+0x30 (exception_handler.obj) +0012C7E7 KERNELBASE.dll!UnhandledExceptionFilter+0x1E7 +000A5958 ntdll.dll!memset+0x1218 +0008CE76 ntdll.dll!_C_specific_handler+0x96 +000A29DF ntdll.dll!_chkstk+0x11F +00052554 ntdll.dll!RtlRaiseException+0x484 +000A14EE ntdll.dll!KiUserExceptionDispatcher+0x2E 00007FFACF6AAE70 ! (get the pdb) ====================================================================== Thread 22368 / 0x5760 (Main Thread) ====================================================================== LastError: 0x00000012 - There are no more files. NTSTATUS: 0x80000006 - {No More Files} No more files were found which match the file specification. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14 +00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0 +00050C0E KERNELBASE.dll!WaitForMultipleObjects+0xE +0026A966 Far.exe!os::detail::multi_wait(class std::span,bool,class std::optional > >)+0x56 (platform.obj) +0020FBAA Far.exe!GetInputRecordImpl(struct _INPUT_RECORD * __ptr64,bool,bool)+0x43A (keyboard.obj) +002106F9 Far.exe!GetInputRecord(struct _INPUT_RECORD * __ptr64,bool,bool)+0x29 (keyboard.obj) +0024208A Far.exe!Manager::ProcessMainLoop(void) __ptr64+0x2A (manager.obj) +00242031 Far.exe!Manager::EnterMainLoop(void) __ptr64+0xC1 (manager.obj) +00239231 Far.exe!MainProcess(class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,int,int)+0x1621 (main.obj) +0023DC2C Far.exe!`mainImpl(class std::span)'::`2'::::operator()(void)const __ptr64+0xEC (main.obj) +0023E802 Far.exe!`function_ref::function_ref)'::`2'::,class `mainImpl(class std::span)'::`2'::,class `mainImpl(class std::span)'::`2':: >(class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: >(class `cpp_try)'::`2'::,class `mainImpl(class std::span)'::`2'::,class `mainImpl(class std::span)'::`2':: >(class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,class `mainImpl(class std::span)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: && __ptr64) __ptr64'::`1'::::(__int64)+0x12 (main.obj) +00132CA6 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +0023D6F6 Far.exe!mainImpl(class std::span)+0xE16 (main.obj) +0023E119 Far.exe!`wmain_seh(void)'::`2'::::operator()(void)const __ptr64+0x19 (main.obj) +0023E882 Far.exe!`function_ref::function_ref,class `wmain_seh(void)'::`2'::,class `wmain_seh(void)'::`2':: >(class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: >(class `cpp_try,class `wmain_seh(void)'::`2'::,class `wmain_seh(void)'::`2':: >(class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,class `wmain_seh(void)'::`2':: const & __ptr64,struct source_location const & __ptr64)'::`7':: && __ptr64) __ptr64'::`1'::::(__int64)+0x12 (main.obj) +00132CA6 Far.exe!detail::cpp_try(class function_ref,class function_ref,class function_ref,struct source_location const & __ptr64)+0x36 (exception_handler.obj) +0023E04A Far.exe!wmain_seh(void)+0x3AA (main.obj) +0023E90C Far.exe!`function_ref::function_ref,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64)'::`3':: >(class `seh_try,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2'::,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `seh_try_with_ui,class `main(void)'::`2':: >(class `main(void)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64,class Plugin const * __ptr64 const,struct source_location const & __ptr64)'::`2':: const & __ptr64,class `main(void)'::`2':: const & __ptr64)'::`3':: && __ptr64) __ptr64'::`1'::::(__int64)+0x4C (main.obj) +00132CD8 Far.exe!detail::seh_try(class function_ref,class function_ref,class function_ref)+0x18 (exception_handler.obj) +0023E298 Far.exe!main+0xC8 (main.obj) +00375D00 Far.exe!__scrt_common_main_seh(void)+0x10C (LIBCMT:exe_main.obj) +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000002 RCX = 0000000000000002 RDX = 0000000EDCD8E680 RSI = 0000000000000000 RDI = 0000000000000002 R8 = 000001DFD3547E60 R9 = 00000000000000A0 R10 = 0000000001A22000 R11 = 000001DFD3547E60 R12 = 0000000000006A89 R13 = 0000000EDCD8E680 R14 = 0000000EDCD8DD30 R15 = 0000000000000000 RIP = 00007FFB7BE0E164 RSP = 0000000EDCD8DCD8 RBP = 0000000EDCD8E110 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffb`7be0e13d 0000 add byte ptr [rax],al 00007ffb`7be0e13f 00e9 add cl,ch 00007ffb`7be0e141 6b8efdff666666 imul ecx,dword ptr [rsi+6666FFFDh],66h 00007ffb`7be0e148 0f1f840000000000 nop dword ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffb`7be0e150 4c8bd1 mov r10,rcx 00007ffb`7be0e153 b85b000000 mov eax,5Bh 00007ffb`7be0e158 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`7be0e160 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffb`7be0e165) 00007ffb`7be0e162 0f05 syscall 00007ffb`7be0e164 c3 ret +00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0: 00007ffb`79940ce7 4c8d742450 lea r14,[rsp+50h] 00007ffb`79940cec 448b7c2444 mov r15d,dword ptr [rsp+44h] 00007ffb`79940cf1 4533c0 xor r8d,r8d 00007ffb`79940cf4 4585ff test r15d,r15d 00007ffb`79940cf7 410f94c0 sete r8b 00007ffb`79940cfb 4c89742420 mov qword ptr [rsp+20h],r14 00007ffb`79940d00 440fb6ce movzx r9d,sil 00007ffb`79940d04 498bd5 mov rdx,r13 00007ffb`79940d07 8bcb mov ecx,ebx 00007ffb`79940d09 48ff1570391900 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb8080 (00007ffb`79ad4680)] 00007ffb`79940d10 0f1f440000 nop dword ptr [rax+rax] +00050C0E KERNELBASE.dll!WaitForMultipleObjects+0xE: 00007ffb`79940bfa cc int 3 00007ffb`79940bfb cc int 3 00007ffb`79940bfc cc int 3 00007ffb`79940bfd cc int 3 00007ffb`79940bfe cc int 3 00007ffb`79940bff cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffb`79940c00 4883ec38 sub rsp,38h 00007ffb`79940c04 8364242000 and dword ptr [rsp+20h],0 00007ffb`79940c09 e812000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffb`79940c20) 00007ffb`79940c0e 4883c438 add rsp,38h +0026A966 Far.exe!os::detail::multi_wait(class std::span,bool,class std::optional > >)+0x56 (platform.obj): 00007ff6`0699a942 45387908 cmp byte ptr [r9+8],r15b 00007ff6`0699a946 7405 je Far+0x26a94d (00007ff6`0699a94d) 00007ff6`0699a948 4d8b09 mov r9,qword ptr [r9] 00007ff6`0699a94b eb06 jmp Far+0x26a953 (00007ff6`0699a953) 00007ff6`0699a94d 41b9ffffffff mov r9d,0FFFFFFFFh 00007ff6`0699a953 4c8b32 mov r14,qword ptr [rdx] 00007ff6`0699a956 450fb6c0 movzx r8d,r8b 00007ff6`0699a95a 498bd6 mov rdx,r14 00007ff6`0699a95d 8b4f08 mov ecx,dword ptr [rdi+8] 00007ff6`0699a960 ff15d2591700 call qword ptr [Far+0x3e0338 (00007ff6`06b10338)] 00007ff6`0699a966 488b7f08 mov rdi,qword ptr [rdi+8] +0020FBAA Far.exe!GetInputRecordImpl(struct _INPUT_RECORD * __ptr64,bool,bool)+0x43A (keyboard.obj): 00007ff6`0693fb74 48c745b802000000 mov qword ptr [rbp-48h],2 00007ff6`0693fb7c 0f2845a0 movaps xmm0,xmmword ptr [rbp-60h] 00007ff6`0693fb80 660f7f442440 movdqa xmmword ptr [rsp+40h],xmm0 00007ff6`0693fb86 0f284db0 movaps xmm1,xmmword ptr [rbp-50h] 00007ff6`0693fb8a 660f7f8da0000000 movdqa xmmword ptr [rbp+0A0h],xmm1 00007ff6`0693fb92 4c8d4c2440 lea r9,[rsp+40h] 00007ff6`0693fb97 4533c0 xor r8d,r8d 00007ff6`0693fb9a 488d95a0000000 lea rdx,[rbp+0A0h] 00007ff6`0693fba1 488d4d50 lea rcx,[rbp+50h] 00007ff6`0693fba5 e866ad0500 call Far+0x26a910 (00007ff6`0699a910) 00007ff6`0693fbaa 0f284d50 movaps xmm1,xmmword ptr [rbp+50h] +002106F9 Far.exe!GetInputRecord(struct _INPUT_RECORD * __ptr64,bool,bool)+0x29 (keyboard.obj): 00007ff6`069406d3 4883ec78 sub rsp,78h 00007ff6`069406d7 488b05628b2a00 mov rax,qword ptr [Far+0x4b9240 (00007ff6`06be9240)] 00007ff6`069406de 4833c4 xor rax,rsp 00007ff6`069406e1 4889442450 mov qword ptr [rsp+50h],rax 00007ff6`069406e6 0f57c0 xorps xmm0,xmm0 00007ff6`069406e9 33c0 xor eax,eax 00007ff6`069406eb 0f1101 movups xmmword ptr [rcx],xmm0 00007ff6`069406ee 894110 mov dword ptr [rcx+10h],eax 00007ff6`069406f1 488be9 mov rbp,rcx 00007ff6`069406f4 e877f0ffff call Far+0x20f770 (00007ff6`0693f770) 00007ff6`069406f9 8bf0 mov esi,eax +0024208A Far.exe!Manager::ProcessMainLoop(void) __ptr64+0x2A (manager.obj): 00007ff6`06972060 4053 push rbx 00007ff6`06972062 4881ec90000000 sub rsp,90h 00007ff6`06972069 488b05d0712700 mov rax,qword ptr [Far+0x4b9240 (00007ff6`06be9240)] 00007ff6`06972070 4833c4 xor rax,rsp 00007ff6`06972073 4889442478 mov qword ptr [rsp+78h],rax 00007ff6`06972078 488bd9 mov rbx,rcx 00007ff6`0697207b 4533c0 xor r8d,r8d 00007ff6`0697207e 488d4c2460 lea rcx,[rsp+60h] 00007ff6`06972083 33d2 xor edx,edx 00007ff6`06972085 e846e6fcff call Far+0x2106d0 (00007ff6`069406d0) 00007ff6`0697208a 807b2000 cmp byte ptr [rbx+20h],0 +00242031 Far.exe!Manager::EnterMainLoop(void) __ptr64+0xC1 (manager.obj): 00007ff6`06972010 4084ed test bpl,bpl 00007ff6`06972013 742e je Far+0x242043 (00007ff6`06972043) 00007ff6`06972015 488b4308 mov rax,qword ptr [rbx+8] 00007ff6`06972019 482b03 sub rax,qword ptr [rbx] 00007ff6`0697201c 4883f810 cmp rax,10h 00007ff6`06972020 7507 jne Far+0x242029 (00007ff6`06972029) 00007ff6`06972022 48837b5000 cmp qword ptr [rbx+50h],0 00007ff6`06972027 741a je Far+0x242043 (00007ff6`06972043) 00007ff6`06972029 488bcb mov rcx,rbx 00007ff6`0697202c e82f000000 call Far+0x242060 (00007ff6`06972060) 00007ff6`06972031 488bcb mov rcx,rbx +00239231 Far.exe!MainProcess(class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,class std::basic_string_view >,int,int)+0x1621 (main.obj): 00007ff6`06969209 ff10 call qword ptr [rax] 00007ff6`0696920b f00fc1770c lock xadd dword ptr [rdi+0Ch],esi 00007ff6`06969210 83fe01 cmp esi,1 00007ff6`06969213 7509 jne Far+0x23921e (00007ff6`0696921e) 00007ff6`06969215 488b07 mov rax,qword ptr [rdi] 00007ff6`06969218 488bcf mov rcx,rdi 00007ff6`0696921b ff5008 call qword ptr [rax+8] 00007ff6`0696921e 488b0de30e2c00 mov rcx,qword ptr [Far+0x4fa108 (00007ff6`06c2a108)] 00007ff6`06969225 488b8940010000 mov rcx,qword ptr [rcx+140h] 00007ff6`0696922c e83f8d0000 call Far+0x241f70 (00007ff6`06971f70) 00007ff6`06969231 e8eaf30f00 call Far+0x338620 (00007ff6`06a68620) +0023DC2C Far.exe!`mainImpl(class std::span)'::`2'::::operator()(void)const __ptr64+0xEC (main.obj): 00007ff6`0696dbef 660f7f442470 movdqa xmmword ptr [rsp+70h],xmm0 00007ff6`0696dbf5 0f288c2480000000 movaps xmm1,xmmword ptr [rsp+80h] 00007ff6`0696dbfd 660f7f8c2480000000 movdqa xmmword ptr [rsp+80h],xmm1 00007ff6`0696dc06 44894c2428 mov dword ptr [rsp+28h],r9d 00007ff6`0696dc0b 4489542420 mov dword ptr [rsp+20h],r10d 00007ff6`0696dc10 4c8d4c2450 lea r9,[rsp+50h] 00007ff6`0696dc15 4c8d442460 lea r8,[rsp+60h] 00007ff6`0696dc1a 488d542470 lea rdx,[rsp+70h] 00007ff6`0696dc1f 488d8c2480000000 lea rcx,[rsp+80h] 00007ff6`0696dc27 e8e49fffff call Far+0x237c10 (00007ff6`06967c10) 00007ff6`0696dc2c eb05 jmp Far+0x23dc33 (00007ff6`0696dc33) ====================================================================== Thread 24912 / 0x6150 ====================================================================== LastError: 0x00000000 - The operation completed successfully. NTSTATUS: 0x00000000 - STATUS_SUCCESS ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 000001DFD1A09D50 RCX = 0000000000000088 RDX = 000001DFD1A099D0 RSI = 000001DFD1A05B50 RDI = 000001DFD1A09D50 R8 = 0000000EDD0FEF20 R9 = 00000000000000FF R10 = 000000000000006C R11 = 0000000EDD0FED20 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFB7BE110A4 RSP = 0000000EDD0FF7B8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffb`7be11084 c3 ret 00007ffb`7be11085 cd2e int 2Eh 00007ffb`7be11087 c3 ret 00007ffb`7be11088 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffb`7be11090 4c8bd1 mov r10,rcx 00007ffb`7be11093 b8d5010000 mov eax,1D5h 00007ffb`7be11098 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`7be110a0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffb`7be110a5) 00007ffb`7be110a2 0f05 syscall 00007ffb`7be110a4 c3 ret +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffb`7bdbd3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffb`7bdbd3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffb`7bdbd3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffb`7bdbd3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffb`7bdbd3e6 488d842448020000 lea rax,[rsp+248h] 00007ffb`7bdbd3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffb`7bdbd3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffb`7bdbd3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffb`7bdbd3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffb`7bdbd402 e8893c0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffb`7be11090) 00007ffb`7bdbd407 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`7b50735d cc int 3 00007ffb`7b50735e cc int 3 00007ffb`7b50735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`7b507360 4883ec28 sub rsp,28h 00007ffb`7b507364 85c9 test ecx,ecx 00007ffb`7b507366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383) 00007ffb`7b507368 498bc8 mov rcx,r8 00007ffb`7b50736b 488bc2 mov rax,rdx 00007ffb`7b50736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)] 00007ffb`7b507374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`7bdbcc72 ec in al,dx 00007ffb`7bdbcc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1) 00007ffb`7bdbcc75 8bc9 mov ecx,ecx 00007ffb`7bdbcc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)] 00007ffb`7bdbcc7e 4885c0 test rax,rax 00007ffb`7bdbcc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93) 00007ffb`7bdbcc83 4c8bc2 mov r8,rdx 00007ffb`7bdbcc86 488bd1 mov rdx,rcx 00007ffb`7bdbcc89 33c9 xor ecx,ecx 00007ffb`7bdbcc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)] 00007ffb`7bdbcc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3) ====================================================================== Thread 18560 / 0x4880 ====================================================================== LastError: 0x00000000 - The operation completed successfully. NTSTATUS: 0x00000000 - STATUS_SUCCESS ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 000001DFD1A0D8F0 RCX = 0000000000000088 RDX = 000001DFD1A0D570 RSI = 000001DFD1A05B50 RDI = 000001DFD1A0D8F0 R8 = 000001DFD50EB044 R9 = 00000000FFFFFFFF R10 = 000001DFD50EB044 R11 = 0000000000000004 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFB7BE110A4 RSP = 0000000EDD1FF588 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffb`7be11084 c3 ret 00007ffb`7be11085 cd2e int 2Eh 00007ffb`7be11087 c3 ret 00007ffb`7be11088 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffb`7be11090 4c8bd1 mov r10,rcx 00007ffb`7be11093 b8d5010000 mov eax,1D5h 00007ffb`7be11098 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`7be110a0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffb`7be110a5) 00007ffb`7be110a2 0f05 syscall 00007ffb`7be110a4 c3 ret +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffb`7bdbd3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffb`7bdbd3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffb`7bdbd3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffb`7bdbd3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffb`7bdbd3e6 488d842448020000 lea rax,[rsp+248h] 00007ffb`7bdbd3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffb`7bdbd3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffb`7bdbd3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffb`7bdbd3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffb`7bdbd402 e8893c0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffb`7be11090) 00007ffb`7bdbd407 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`7b50735d cc int 3 00007ffb`7b50735e cc int 3 00007ffb`7b50735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`7b507360 4883ec28 sub rsp,28h 00007ffb`7b507364 85c9 test ecx,ecx 00007ffb`7b507366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383) 00007ffb`7b507368 498bc8 mov rcx,r8 00007ffb`7b50736b 488bc2 mov rax,rdx 00007ffb`7b50736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)] 00007ffb`7b507374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`7bdbcc72 ec in al,dx 00007ffb`7bdbcc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1) 00007ffb`7bdbcc75 8bc9 mov ecx,ecx 00007ffb`7bdbcc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)] 00007ffb`7bdbcc7e 4885c0 test rax,rax 00007ffb`7bdbcc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93) 00007ffb`7bdbcc83 4c8bc2 mov r8,rdx 00007ffb`7bdbcc86 488bd1 mov rdx,rcx 00007ffb`7bdbcc89 33c9 xor ecx,ecx 00007ffb`7bdbcc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)] 00007ffb`7bdbcc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3) ====================================================================== Thread 5968 / 0x1750 ====================================================================== LastError: 0x00000000 - The operation completed successfully. NTSTATUS: 0x00000000 - STATUS_SUCCESS ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 000001DFD1A0DD30 RCX = 0000000000000088 RDX = 000001DFD1A0D9B0 RSI = 000001DFD1A05B50 RDI = 000001DFD1A0DD30 R8 = 0000000000000008 R9 = 0000000000000004 R10 = 0000000000000000 R11 = 00000000FFFFFFFF R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFB7BE110A4 RSP = 0000000EDD2FFAA8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffb`7be11084 c3 ret 00007ffb`7be11085 cd2e int 2Eh 00007ffb`7be11087 c3 ret 00007ffb`7be11088 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffb`7be11090 4c8bd1 mov r10,rcx 00007ffb`7be11093 b8d5010000 mov eax,1D5h 00007ffb`7be11098 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`7be110a0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffb`7be110a5) 00007ffb`7be110a2 0f05 syscall 00007ffb`7be110a4 c3 ret +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffb`7bdbd3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffb`7bdbd3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffb`7bdbd3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffb`7bdbd3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffb`7bdbd3e6 488d842448020000 lea rax,[rsp+248h] 00007ffb`7bdbd3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffb`7bdbd3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffb`7bdbd3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffb`7bdbd3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffb`7bdbd402 e8893c0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffb`7be11090) 00007ffb`7bdbd407 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`7b50735d cc int 3 00007ffb`7b50735e cc int 3 00007ffb`7b50735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`7b507360 4883ec28 sub rsp,28h 00007ffb`7b507364 85c9 test ecx,ecx 00007ffb`7b507366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383) 00007ffb`7b507368 498bc8 mov rcx,r8 00007ffb`7b50736b 488bc2 mov rax,rdx 00007ffb`7b50736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)] 00007ffb`7b507374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`7bdbcc72 ec in al,dx 00007ffb`7bdbcc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1) 00007ffb`7bdbcc75 8bc9 mov ecx,ecx 00007ffb`7bdbcc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)] 00007ffb`7bdbcc7e 4885c0 test rax,rax 00007ffb`7bdbcc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93) 00007ffb`7bdbcc83 4c8bc2 mov r8,rdx 00007ffb`7bdbcc86 488bd1 mov rdx,rcx 00007ffb`7bdbcc89 33c9 xor ecx,ecx 00007ffb`7bdbcc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)] 00007ffb`7bdbcc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3) ====================================================================== Thread 18180 / 0x4704 (Window messages processor) ====================================================================== LastError: 0x00000000 - The operation completed successfully. NTSTATUS: 0xC0000047 - An attempt was made to release a semaphore such that its maximum count would have been exceeded. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00001104 win32u.dll!NtUserGetMessage+0x14 +0002210E USER32.dll!GetMessageW+0x2E +0036EAF2 Far.exe!wm_listener::WindowThreadRoutine(class os::concurrency::event const & __ptr64) __ptr64+0x572 (wm_listener.obj) +0036F69B Far.exe!os::concurrency::thread::wrapper >(void (__cdecl wm_listener::*&& __ptr64)(class os::concurrency::event const & __ptr64) __ptr64,class wm_listener * __ptr64 && __ptr64,class std::reference_wrapper && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x1B (wm_listener.obj) +00390B6E Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj) +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000001006 RBX = 0000000EDD3FE600 RCX = 0000000EDD3FE600 RDX = 0000000000000000 RSI = 0000000EDCD8EBD0 RDI = 000001DFD1A7D350 R8 = 0000000EDD3FE3C8 R9 = 0000000EDD3FE5E0 R10 = 0000000000000000 R11 = 0000000000000246 R12 = 00007FF60673A610 R13 = 0000000000000000 R14 = 00007FF606B7F290 R15 = 00007FF60673DF50 RIP = 00007FFB793F1104 RSP = 0000000EDD3FE478 RBP = 0000000EDD3FE5E0 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00001104 win32u.dll!NtUserGetMessage+0x14: 00007ffb`793f10e4 c3 ret 00007ffb`793f10e5 cd2e int 2Eh 00007ffb`793f10e7 c3 ret 00007ffb`793f10e8 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserGetMessage: 00007ffb`793f10f0 4c8bd1 mov r10,rcx 00007ffb`793f10f3 b806100000 mov eax,1006h 00007ffb`793f10f8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`793f1100 7503 jne win32u!NtUserGetMessage+0x15 (00007ffb`793f1105) 00007ffb`793f1102 0f05 syscall 00007ffb`793f1104 c3 ret +0002210E USER32.dll!GetMessageW+0x2E: 00007ffb`7b1f20e2 4883ec50 sub rsp,50h 00007ffb`7b1f20e6 418bc1 mov eax,r9d 00007ffb`7b1f20e9 488bd9 mov rbx,rcx 00007ffb`7b1f20ec 458bc8 mov r9d,r8d 00007ffb`7b1f20ef 440bc8 or r9d,eax 00007ffb`7b1f20f2 41f7c10000feff test r9d,0FFFE0000h 00007ffb`7b1f20f9 0f85b11d0200 jne USER32!SetWindowsHookExAW+0xd980 (00007ffb`7b213eb0) 00007ffb`7b1f20ff 448bc8 mov r9d,eax 00007ffb`7b1f2102 48897c2460 mov qword ptr [rsp+60h],rdi 00007ffb`7b1f2107 48ff1502ea0600 call qword ptr [USER32!gapfnScSendMessage+0x11b0 (00007ffb`7b260b10)] 00007ffb`7b1f210e 0f1f440000 nop dword ptr [rax+rax] +0036EAF2 Far.exe!wm_listener::WindowThreadRoutine(class os::concurrency::event const & __ptr64) __ptr64+0x572 (wm_listener.obj): 00007ff6`06a9eac3 4c8d35c6070e00 lea r14,[Far+0x44f290 (00007ff6`06b7f290)] 00007ff6`06a9eaca 4c8d3d7ff4c9ff lea r15,[Far+0xdf50 (00007ff6`0673df50)] 00007ff6`06a9ead1 4c8d2538bbc9ff lea r12,[Far+0xa610 (00007ff6`0673a610)] 00007ff6`06a9ead8 84c0 test al,al 00007ff6`06a9eada 0f8532020000 jne Far+0x36ed12 (00007ff6`06a9ed12) 00007ff6`06a9eae0 4533c9 xor r9d,r9d 00007ff6`06a9eae3 4533c0 xor r8d,r8d 00007ff6`06a9eae6 33d2 xor edx,edx 00007ff6`06a9eae8 488d4d20 lea rcx,[rbp+20h] 00007ff6`06a9eaec ff15a6200700 call qword ptr [Far+0x3e0b98 (00007ff6`06b10b98)] 00007ff6`06a9eaf2 85c0 test eax,eax +0036F69B Far.exe!os::concurrency::thread::wrapper >(void (__cdecl wm_listener::*&& __ptr64)(class os::concurrency::event const & __ptr64) __ptr64,class wm_listener * __ptr64 && __ptr64,class std::reference_wrapper && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x1B (wm_listener.obj): 00007ff6`06a9f67e 5e pop rsi 00007ff6`06a9f67f c3 ret 00007ff6`06a9f680 4053 push rbx 00007ff6`06a9f682 4883ec20 sub rsp,20h 00007ff6`06a9f686 488bd9 mov rbx,rcx 00007ff6`06a9f689 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`06a9f68e 488b01 mov rax,qword ptr [rcx] 00007ff6`06a9f691 488b5108 mov rdx,qword ptr [rcx+8] 00007ff6`06a9f695 488b4910 mov rcx,qword ptr [rcx+10h] 00007ff6`06a9f699 ffd0 call rax 00007ff6`06a9f69b 90 nop +00390B6E Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj): 00007ff6`06ac0b45 7510 jne Far+0x390b57 (00007ff6`06ac0b57) 00007ff6`06ac0b47 8d48ff lea ecx,[rax-1] 00007ff6`06ac0b4a e8d1200100 call Far+0x3a2c20 (00007ff6`06ad2c20) 00007ff6`06ac0b4f 85c0 test eax,eax 00007ff6`06ac0b51 0f94c0 sete al 00007ff6`06ac0b54 884320 mov byte ptr [rbx+20h],al 00007ff6`06ac0b57 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`06ac0b61 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`06ac0b65 488b03 mov rax,qword ptr [rbx] 00007ff6`06ac0b68 ff1512030500 call qword ptr [Far+0x3e0e80 (00007ff6`06b10e80)] 00007ff6`06ac0b6e 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`7b50735d cc int 3 00007ffb`7b50735e cc int 3 00007ffb`7b50735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`7b507360 4883ec28 sub rsp,28h 00007ffb`7b507364 85c9 test ecx,ecx 00007ffb`7b507366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383) 00007ffb`7b507368 498bc8 mov rcx,r8 00007ffb`7b50736b 488bc2 mov rax,rdx 00007ffb`7b50736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)] 00007ffb`7b507374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`7bdbcc72 ec in al,dx 00007ffb`7bdbcc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1) 00007ffb`7bdbcc75 8bc9 mov ecx,ecx 00007ffb`7bdbcc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)] 00007ffb`7bdbcc7e 4885c0 test rax,rax 00007ffb`7bdbcc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93) 00007ffb`7bdbcc83 4c8bc2 mov r8,rdx 00007ffb`7bdbcc86 488bd1 mov rdx,rcx 00007ffb`7bdbcc89 33c9 xor ecx,ecx 00007ffb`7bdbcc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)] 00007ffb`7bdbcc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3) ====================================================================== Thread 16568 / 0x40B8 (FS watcher) ====================================================================== LastError: 0x00000057 - The parameter is incorrect. NTSTATUS: 0xC000000D - An invalid parameter was passed to a service or function. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14 +00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0 +00050C0E KERNELBASE.dll!WaitForMultipleObjects+0xE +0026A966 Far.exe!os::detail::multi_wait(class std::span,bool,class std::optional > >)+0x56 (platform.obj) +001A2F70 Far.exe!background_watcher::process(void) __ptr64+0x2B0 (filesystemwatcher.obj) +001A5104 Far.exe!os::concurrency::thread::wrapper(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x14 (findfile.obj) +00390B6E Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj) +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000003 RCX = 0000000000000003 RDX = 000001DFD1AF2BE0 RSI = 0000000000000000 RDI = 0000000000000003 R8 = 0000000000000000 R9 = 0000000EDD4FF970 R10 = 9E0C2E5B32D12870 R11 = 0000000000000000 R12 = 00000000FFFFFFFF R13 = 000001DFD1AF2BE0 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFB7BE0E164 RSP = 0000000EDD4FEB08 RBP = 0000000EDD4FEF40 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffb`7be0e13d 0000 add byte ptr [rax],al 00007ffb`7be0e13f 00e9 add cl,ch 00007ffb`7be0e141 6b8efdff666666 imul ecx,dword ptr [rsi+6666FFFDh],66h 00007ffb`7be0e148 0f1f840000000000 nop dword ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffb`7be0e150 4c8bd1 mov r10,rcx 00007ffb`7be0e153 b85b000000 mov eax,5Bh 00007ffb`7be0e158 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`7be0e160 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffb`7be0e165) 00007ffb`7be0e162 0f05 syscall 00007ffb`7be0e164 c3 ret +00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0: 00007ffb`79940ce7 4c8d742450 lea r14,[rsp+50h] 00007ffb`79940cec 448b7c2444 mov r15d,dword ptr [rsp+44h] 00007ffb`79940cf1 4533c0 xor r8d,r8d 00007ffb`79940cf4 4585ff test r15d,r15d 00007ffb`79940cf7 410f94c0 sete r8b 00007ffb`79940cfb 4c89742420 mov qword ptr [rsp+20h],r14 00007ffb`79940d00 440fb6ce movzx r9d,sil 00007ffb`79940d04 498bd5 mov rdx,r13 00007ffb`79940d07 8bcb mov ecx,ebx 00007ffb`79940d09 48ff1570391900 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb8080 (00007ffb`79ad4680)] 00007ffb`79940d10 0f1f440000 nop dword ptr [rax+rax] +00050C0E KERNELBASE.dll!WaitForMultipleObjects+0xE: 00007ffb`79940bfa cc int 3 00007ffb`79940bfb cc int 3 00007ffb`79940bfc cc int 3 00007ffb`79940bfd cc int 3 00007ffb`79940bfe cc int 3 00007ffb`79940bff cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffb`79940c00 4883ec38 sub rsp,38h 00007ffb`79940c04 8364242000 and dword ptr [rsp+20h],0 00007ffb`79940c09 e812000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffb`79940c20) 00007ffb`79940c0e 4883c438 add rsp,38h +0026A966 Far.exe!os::detail::multi_wait(class std::span,bool,class std::optional > >)+0x56 (platform.obj): 00007ff6`0699a942 45387908 cmp byte ptr [r9+8],r15b 00007ff6`0699a946 7405 je Far+0x26a94d (00007ff6`0699a94d) 00007ff6`0699a948 4d8b09 mov r9,qword ptr [r9] 00007ff6`0699a94b eb06 jmp Far+0x26a953 (00007ff6`0699a953) 00007ff6`0699a94d 41b9ffffffff mov r9d,0FFFFFFFFh 00007ff6`0699a953 4c8b32 mov r14,qword ptr [rdx] 00007ff6`0699a956 450fb6c0 movzx r8d,r8b 00007ff6`0699a95a 498bd6 mov rdx,r14 00007ff6`0699a95d 8b4f08 mov ecx,dword ptr [rdi+8] 00007ff6`0699a960 ff15d2591700 call qword ptr [Far+0x3e0338 (00007ff6`06b10338)] 00007ff6`0699a966 488b7f08 mov rdi,qword ptr [rdi+8] +001A2F70 Far.exe!background_watcher::process(void) __ptr64+0x2B0 (filesystemwatcher.obj): 00007ff6`068d2f44 48894dd8 mov qword ptr [rbp-28h],rcx 00007ff6`068d2f48 0f2845f0 movaps xmm0,xmmword ptr [rbp-10h] 00007ff6`068d2f4c 660f7f4580 movdqa xmmword ptr [rbp-80h],xmm0 00007ff6`068d2f51 0f284dd0 movaps xmm1,xmmword ptr [rbp-30h] 00007ff6`068d2f55 660f7f4c2450 movdqa xmmword ptr [rsp+50h],xmm1 00007ff6`068d2f5b 4c8d4d80 lea r9,[rbp-80h] 00007ff6`068d2f5f 4533c0 xor r8d,r8d 00007ff6`068d2f62 488d542450 lea rdx,[rsp+50h] 00007ff6`068d2f67 488d4da0 lea rcx,[rbp-60h] 00007ff6`068d2f6b e8a0790c00 call Far+0x26a910 (00007ff6`0699a910) 00007ff6`068d2f70 4c8b38 mov r15,qword ptr [rax] +001A5104 Far.exe!os::concurrency::thread::wrapper(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x14 (findfile.obj): 00007ff6`068d50ec cc int 3 00007ff6`068d50ed cc int 3 00007ff6`068d50ee cc int 3 00007ff6`068d50ef cc int 3 00007ff6`068d50f0 4053 push rbx 00007ff6`068d50f2 4883ec20 sub rsp,20h 00007ff6`068d50f6 488bd9 mov rbx,rcx 00007ff6`068d50f9 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`068d50fe 488b4908 mov rcx,qword ptr [rcx+8] 00007ff6`068d5102 ff13 call qword ptr [rbx] 00007ff6`068d5104 90 nop +00390B6E Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj): 00007ff6`06ac0b45 7510 jne Far+0x390b57 (00007ff6`06ac0b57) 00007ff6`06ac0b47 8d48ff lea ecx,[rax-1] 00007ff6`06ac0b4a e8d1200100 call Far+0x3a2c20 (00007ff6`06ad2c20) 00007ff6`06ac0b4f 85c0 test eax,eax 00007ff6`06ac0b51 0f94c0 sete al 00007ff6`06ac0b54 884320 mov byte ptr [rbx+20h],al 00007ff6`06ac0b57 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`06ac0b61 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`06ac0b65 488b03 mov rax,qword ptr [rbx] 00007ff6`06ac0b68 ff1512030500 call qword ptr [Far+0x3e0e80 (00007ff6`06b10e80)] 00007ff6`06ac0b6e 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`7b50735d cc int 3 00007ffb`7b50735e cc int 3 00007ffb`7b50735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`7b507360 4883ec28 sub rsp,28h 00007ffb`7b507364 85c9 test ecx,ecx 00007ffb`7b507366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383) 00007ffb`7b507368 498bc8 mov rcx,r8 00007ffb`7b50736b 488bc2 mov rax,rdx 00007ffb`7b50736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)] 00007ffb`7b507374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`7bdbcc72 ec in al,dx 00007ffb`7bdbcc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1) 00007ffb`7bdbcc75 8bc9 mov ecx,ecx 00007ffb`7bdbcc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)] 00007ffb`7bdbcc7e 4885c0 test rax,rax 00007ffb`7bdbcc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93) 00007ffb`7bdbcc83 4c8bc2 mov r8,rdx 00007ffb`7bdbcc86 488bd1 mov rdx,rcx 00007ffb`7bdbcc89 33c9 xor ecx,ecx 00007ffb`7bdbcc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)] 00007ffb`7bdbcc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3) ====================================================================== Thread 17136 / 0x42F0 (Taskbar processor) ====================================================================== LastError: 0x00000000 - The operation completed successfully. NTSTATUS: 0xC0000034 - Object Name not found. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14 +00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0 +00050C0E KERNELBASE.dll!WaitForMultipleObjects+0xE +0026A966 Far.exe!os::detail::multi_wait(class std::span,bool,class std::optional > >)+0x56 (platform.obj) +0032DE70 Far.exe!taskbar_impl::handler(void)const __ptr64+0x360 (taskbar.obj) +001A5104 Far.exe!os::concurrency::thread::wrapper(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x14 (findfile.obj) +00390B6E Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj) +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000003 RCX = 0000000000000003 RDX = 0000000EDD5FECC0 RSI = 0000000000000000 RDI = 0000000000000003 R8 = 00000000000042F0 R9 = 0000000EDD5FDD38 R10 = 0000000000000000 R11 = 00007FFB7A6C0A80 R12 = 00000000FFFFFFFF R13 = 0000000EDD5FECC0 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFB7BE0E164 RSP = 0000000EDD5FE278 RBP = 0000000EDD5FE6B0 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffb`7be0e13d 0000 add byte ptr [rax],al 00007ffb`7be0e13f 00e9 add cl,ch 00007ffb`7be0e141 6b8efdff666666 imul ecx,dword ptr [rsi+6666FFFDh],66h 00007ffb`7be0e148 0f1f840000000000 nop dword ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffb`7be0e150 4c8bd1 mov r10,rcx 00007ffb`7be0e153 b85b000000 mov eax,5Bh 00007ffb`7be0e158 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`7be0e160 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffb`7be0e165) 00007ffb`7be0e162 0f05 syscall 00007ffb`7be0e164 c3 ret +00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0: 00007ffb`79940ce7 4c8d742450 lea r14,[rsp+50h] 00007ffb`79940cec 448b7c2444 mov r15d,dword ptr [rsp+44h] 00007ffb`79940cf1 4533c0 xor r8d,r8d 00007ffb`79940cf4 4585ff test r15d,r15d 00007ffb`79940cf7 410f94c0 sete r8b 00007ffb`79940cfb 4c89742420 mov qword ptr [rsp+20h],r14 00007ffb`79940d00 440fb6ce movzx r9d,sil 00007ffb`79940d04 498bd5 mov rdx,r13 00007ffb`79940d07 8bcb mov ecx,ebx 00007ffb`79940d09 48ff1570391900 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb8080 (00007ffb`79ad4680)] 00007ffb`79940d10 0f1f440000 nop dword ptr [rax+rax] +00050C0E KERNELBASE.dll!WaitForMultipleObjects+0xE: 00007ffb`79940bfa cc int 3 00007ffb`79940bfb cc int 3 00007ffb`79940bfc cc int 3 00007ffb`79940bfd cc int 3 00007ffb`79940bfe cc int 3 00007ffb`79940bff cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffb`79940c00 4883ec38 sub rsp,38h 00007ffb`79940c04 8364242000 and dword ptr [rsp+20h],0 00007ffb`79940c09 e812000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffb`79940c20) 00007ffb`79940c0e 4883c438 add rsp,38h +0026A966 Far.exe!os::detail::multi_wait(class std::span,bool,class std::optional > >)+0x56 (platform.obj): 00007ff6`0699a942 45387908 cmp byte ptr [r9+8],r15b 00007ff6`0699a946 7405 je Far+0x26a94d (00007ff6`0699a94d) 00007ff6`0699a948 4d8b09 mov r9,qword ptr [r9] 00007ff6`0699a94b eb06 jmp Far+0x26a953 (00007ff6`0699a953) 00007ff6`0699a94d 41b9ffffffff mov r9d,0FFFFFFFFh 00007ff6`0699a953 4c8b32 mov r14,qword ptr [rdx] 00007ff6`0699a956 450fb6c0 movzx r8d,r8b 00007ff6`0699a95a 498bd6 mov rdx,r14 00007ff6`0699a95d 8b4f08 mov ecx,dword ptr [rdi+8] 00007ff6`0699a960 ff15d2591700 call qword ptr [Far+0x3e0338 (00007ff6`06b10338)] 00007ff6`0699a966 488b7f08 mov rdi,qword ptr [rdi+8] +0032DE70 Far.exe!taskbar_impl::handler(void)const __ptr64+0x360 (taskbar.obj): 00007ff6`06a5de44 48894540 mov qword ptr [rbp+40h],rax 00007ff6`06a5de48 c6450800 mov byte ptr [rbp+8],0 00007ff6`06a5de4c 0f284500 movaps xmm0,xmmword ptr [rbp] 00007ff6`06a5de50 660f7f442470 movdqa xmmword ptr [rsp+70h],xmm0 00007ff6`06a5de56 660f7f7550 movdqa xmmword ptr [rbp+50h],xmm6 00007ff6`06a5de5b 4c8d4c2470 lea r9,[rsp+70h] 00007ff6`06a5de60 4533c0 xor r8d,r8d 00007ff6`06a5de63 488d5550 lea rdx,[rbp+50h] 00007ff6`06a5de67 488d4dc8 lea rcx,[rbp-38h] 00007ff6`06a5de6b e8a0caf3ff call Far+0x26a910 (00007ff6`0699a910) 00007ff6`06a5de70 488b08 mov rcx,qword ptr [rax] +001A5104 Far.exe!os::concurrency::thread::wrapper(void (__cdecl background_searcher::*&& __ptr64)(void) __ptr64,class background_searcher * __ptr64 && __ptr64) __ptr64'::`2':: >(void * __ptr64)+0x14 (findfile.obj): 00007ff6`068d50ec cc int 3 00007ff6`068d50ed cc int 3 00007ff6`068d50ee cc int 3 00007ff6`068d50ef cc int 3 00007ff6`068d50f0 4053 push rbx 00007ff6`068d50f2 4883ec20 sub rsp,20h 00007ff6`068d50f6 488bd9 mov rbx,rcx 00007ff6`068d50f9 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`068d50fe 488b4908 mov rcx,qword ptr [rcx+8] 00007ff6`068d5102 ff13 call qword ptr [rbx] 00007ff6`068d5104 90 nop +00390B6E Far.exe!thread_start(void * __ptr64 const)+0x5A (libucrt:thread.obj): 00007ff6`06ac0b45 7510 jne Far+0x390b57 (00007ff6`06ac0b57) 00007ff6`06ac0b47 8d48ff lea ecx,[rax-1] 00007ff6`06ac0b4a e8d1200100 call Far+0x3a2c20 (00007ff6`06ad2c20) 00007ff6`06ac0b4f 85c0 test eax,eax 00007ff6`06ac0b51 0f94c0 sete al 00007ff6`06ac0b54 884320 mov byte ptr [rbx+20h],al 00007ff6`06ac0b57 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`06ac0b61 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`06ac0b65 488b03 mov rax,qword ptr [rbx] 00007ff6`06ac0b68 ff1512030500 call qword ptr [Far+0x3e0e80 (00007ff6`06b10e80)] 00007ff6`06ac0b6e 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`7b50735d cc int 3 00007ffb`7b50735e cc int 3 00007ffb`7b50735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`7b507360 4883ec28 sub rsp,28h 00007ffb`7b507364 85c9 test ecx,ecx 00007ffb`7b507366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383) 00007ffb`7b507368 498bc8 mov rcx,r8 00007ffb`7b50736b 488bc2 mov rax,rdx 00007ffb`7b50736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)] 00007ffb`7b507374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`7bdbcc72 ec in al,dx 00007ffb`7bdbcc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1) 00007ffb`7bdbcc75 8bc9 mov ecx,ecx 00007ffb`7bdbcc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)] 00007ffb`7bdbcc7e 4885c0 test rax,rax 00007ffb`7bdbcc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93) 00007ffb`7bdbcc83 4c8bc2 mov r8,rdx 00007ffb`7bdbcc86 488bd1 mov rdx,rcx 00007ffb`7bdbcc89 33c9 xor ecx,ecx 00007ffb`7bdbcc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)] 00007ffb`7bdbcc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3) ====================================================================== Thread 5984 / 0x1760 ====================================================================== LastError: 0x00000000 - The operation completed successfully. NTSTATUS: 0xC000000D - An invalid parameter was passed to a service or function. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14 +00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0 +000D08A6 combase.dll!CoRevokeInitializeSpy+0xE16 +000D0720 combase.dll!CoRevokeInitializeSpy+0xC90 +000D0530 combase.dll!CoRevokeInitializeSpy+0xAA0 +000D04B9 combase.dll!CoRevokeInitializeSpy+0xA29 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000001 RCX = 0000000000000001 RDX = 0000000EDD6FFA00 RSI = 0000000000000000 RDI = 0000000000000001 R8 = 000001DFD1AF5190 R9 = 00007FFB7B690490 R10 = 0000000000000000 R11 = 0000000000000000 R12 = 00000000FFFFFFFF R13 = 0000000EDD6FFA00 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFB7BE0E164 RSP = 0000000EDD6FF6B8 RBP = 00000000000003A0 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffb`7be0e13d 0000 add byte ptr [rax],al 00007ffb`7be0e13f 00e9 add cl,ch 00007ffb`7be0e141 6b8efdff666666 imul ecx,dword ptr [rsi+6666FFFDh],66h 00007ffb`7be0e148 0f1f840000000000 nop dword ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffb`7be0e150 4c8bd1 mov r10,rcx 00007ffb`7be0e153 b85b000000 mov eax,5Bh 00007ffb`7be0e158 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`7be0e160 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffb`7be0e165) 00007ffb`7be0e162 0f05 syscall 00007ffb`7be0e164 c3 ret +00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0: 00007ffb`79940ce7 4c8d742450 lea r14,[rsp+50h] 00007ffb`79940cec 448b7c2444 mov r15d,dword ptr [rsp+44h] 00007ffb`79940cf1 4533c0 xor r8d,r8d 00007ffb`79940cf4 4585ff test r15d,r15d 00007ffb`79940cf7 410f94c0 sete r8b 00007ffb`79940cfb 4c89742420 mov qword ptr [rsp+20h],r14 00007ffb`79940d00 440fb6ce movzx r9d,sil 00007ffb`79940d04 498bd5 mov rdx,r13 00007ffb`79940d07 8bcb mov ecx,ebx 00007ffb`79940d09 48ff1570391900 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb8080 (00007ffb`79ad4680)] 00007ffb`79940d10 0f1f440000 nop dword ptr [rax+rax] +000D08A6 combase.dll!CoRevokeInitializeSpy+0xE16: 00007ffb`7b69087c 85ff test edi,edi 00007ffb`7b69087e 7559 jne combase!CoRevokeInitializeSpy+0xe49 (00007ffb`7b6908d9) 00007ffb`7b690880 8b9424b8020000 mov edx,dword ptr [rsp+2B8h] 00007ffb`7b690887 8d4f01 lea ecx,[rdi+1] 00007ffb`7b69088a 89542420 mov dword ptr [rsp+20h],edx 00007ffb`7b69088e 4183c9ff or r9d,0FFFFFFFFh 00007ffb`7b690892 488d542450 lea rdx,[rsp+50h] 00007ffb`7b690897 48896cfc50 mov qword ptr [rsp+rdi*8+50h],rbp 00007ffb`7b69089c 4533c0 xor r8d,r8d 00007ffb`7b69089f 48ff15cac41a00 call qword ptr [combase!Ordinal79+0x61160 (00007ffb`7b83cd70)] 00007ffb`7b6908a6 0f1f440000 nop dword ptr [rax+rax] +000D0720 combase.dll!CoRevokeInitializeSpy+0xC90: 00007ffb`7b6906f0 448b0df1242300 mov r9d,dword ptr [combase!Ordinal183+0x51b90 (00007ffb`7b8c2be8)] 00007ffb`7b6906f7 488d442450 lea rax,[rsp+50h] 00007ffb`7b6906fc 8364245000 and dword ptr [rsp+50h],0 00007ffb`7b690701 4533c0 xor r8d,r8d 00007ffb`7b690704 4889442430 mov qword ptr [rsp+30h],rax 00007ffb`7b690709 33d2 xor edx,edx 00007ffb`7b69070b 8364242800 and dword ptr [rsp+28h],0 00007ffb`7b690710 488bcb mov rcx,rbx 00007ffb`7b690713 c7442420a00f0000 mov dword ptr [rsp+20h],0FA0h 00007ffb`7b69071b e8e0000000 call combase!CoRevokeInitializeSpy+0xd70 (00007ffb`7b690800) 00007ffb`7b690720 85c0 test eax,eax +000D0530 combase.dll!CoRevokeInitializeSpy+0xAA0: 00007ffb`7b6904fc 44397108 cmp dword ptr [rcx+8],r14d 00007ffb`7b690500 0f8538010000 jne combase!CoRevokeInitializeSpy+0xbae (00007ffb`7b69063e) 00007ffb`7b690506 65488b042530000000 mov rax,qword ptr gs:[30h] 00007ffb`7b69050f 488b8058170000 mov rax,qword ptr [rax+1758h] 00007ffb`7b690516 4885c0 test rax,rax 00007ffb`7b690519 7407 je combase!CoRevokeInitializeSpy+0xa92 (00007ffb`7b690522) 00007ffb`7b69051b 4489b038010000 mov dword ptr [rax+138h],r14d 00007ffb`7b690522 488b4b18 mov rcx,qword ptr [rbx+18h] 00007ffb`7b690526 488b4310 mov rax,qword ptr [rbx+10h] 00007ffb`7b69052a ff1568d01a00 call qword ptr [combase!Ordinal79+0x61988 (00007ffb`7b83d598)] 00007ffb`7b690530 48ff15a9c51a00 call qword ptr [combase!Ordinal79+0x60ed0 (00007ffb`7b83cae0)] +000D04B9 combase.dll!CoRevokeInitializeSpy+0xA29: 00007ffb`7b690490 48895c2408 mov qword ptr [rsp+8],rbx 00007ffb`7b690495 57 push rdi 00007ffb`7b690496 4883ec20 sub rsp,20h 00007ffb`7b69049a 488bf9 mov rdi,rcx 00007ffb`7b69049d 48ff152cc61a00 call qword ptr [combase!Ordinal79+0x60ec0 (00007ffb`7b83cad0)] 00007ffb`7b6904a4 0f1f440000 nop dword ptr [rax+rax] 00007ffb`7b6904a9 894728 mov dword ptr [rdi+28h],eax 00007ffb`7b6904ac e847040000 call combase!CoRevokeInitializeSpy+0xe68 (00007ffb`7b6908f8) 00007ffb`7b6904b1 488bcf mov rcx,rdi 00007ffb`7b6904b4 e82b000000 call combase!CoRevokeInitializeSpy+0xa54 (00007ffb`7b6904e4) 00007ffb`7b6904b9 488b5f30 mov rbx,qword ptr [rdi+30h] +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`7b50735d cc int 3 00007ffb`7b50735e cc int 3 00007ffb`7b50735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`7b507360 4883ec28 sub rsp,28h 00007ffb`7b507364 85c9 test ecx,ecx 00007ffb`7b507366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383) 00007ffb`7b507368 498bc8 mov rcx,r8 00007ffb`7b50736b 488bc2 mov rax,rdx 00007ffb`7b50736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)] 00007ffb`7b507374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`7bdbcc72 ec in al,dx 00007ffb`7bdbcc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1) 00007ffb`7bdbcc75 8bc9 mov ecx,ecx 00007ffb`7bdbcc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)] 00007ffb`7bdbcc7e 4885c0 test rax,rax 00007ffb`7bdbcc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93) 00007ffb`7bdbcc83 4c8bc2 mov r8,rdx 00007ffb`7bdbcc86 488bd1 mov rdx,rcx 00007ffb`7bdbcc89 33c9 xor ecx,ecx 00007ffb`7bdbcc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)] 00007ffb`7bdbcc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3) ====================================================================== Thread 25192 / 0x6268 ====================================================================== LastError: 0x00000000 - The operation completed successfully. NTSTATUS: 0xC000000D - An invalid parameter was passed to a service or function. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 000001DFD4446710 RCX = 0000000000000014 RDX = 000001DFD4446390 RSI = 000001DFD1A02340 RDI = 000001DFD4446710 R8 = 0000000000000000 R9 = 1100000000000000 R10 = CFF7FFFF7FFF7DFC R11 = 5555555555555555 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFB7BE110A4 RSP = 0000000EDD7FF988 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffb`7be11084 c3 ret 00007ffb`7be11085 cd2e int 2Eh 00007ffb`7be11087 c3 ret 00007ffb`7be11088 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffb`7be11090 4c8bd1 mov r10,rcx 00007ffb`7be11093 b8d5010000 mov eax,1D5h 00007ffb`7be11098 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`7be110a0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffb`7be110a5) 00007ffb`7be110a2 0f05 syscall 00007ffb`7be110a4 c3 ret +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffb`7bdbd3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffb`7bdbd3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffb`7bdbd3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffb`7bdbd3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffb`7bdbd3e6 488d842448020000 lea rax,[rsp+248h] 00007ffb`7bdbd3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffb`7bdbd3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffb`7bdbd3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffb`7bdbd3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffb`7bdbd402 e8893c0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffb`7be11090) 00007ffb`7bdbd407 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`7b50735d cc int 3 00007ffb`7b50735e cc int 3 00007ffb`7b50735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`7b507360 4883ec28 sub rsp,28h 00007ffb`7b507364 85c9 test ecx,ecx 00007ffb`7b507366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383) 00007ffb`7b507368 498bc8 mov rcx,r8 00007ffb`7b50736b 488bc2 mov rax,rdx 00007ffb`7b50736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)] 00007ffb`7b507374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`7bdbcc72 ec in al,dx 00007ffb`7bdbcc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1) 00007ffb`7bdbcc75 8bc9 mov ecx,ecx 00007ffb`7bdbcc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)] 00007ffb`7bdbcc7e 4885c0 test rax,rax 00007ffb`7bdbcc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93) 00007ffb`7bdbcc83 4c8bc2 mov r8,rdx 00007ffb`7bdbcc86 488bd1 mov rdx,rcx 00007ffb`7bdbcc89 33c9 xor ecx,ecx 00007ffb`7bdbcc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)] 00007ffb`7bdbcc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3) ====================================================================== Thread 25012 / 0x61B4 ====================================================================== LastError: 0x00000057 - The parameter is incorrect. NTSTATUS: 0xC000000D - An invalid parameter was passed to a service or function. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 0000000000000000 RCX = 0000000000000014 RDX = 000001DFD44485B0 RSI = 000001DFD1A02340 RDI = 0000000000000000 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 0000000000000000 R11 = 0000000000000000 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFB7BE110A4 RSP = 0000000EDD8FF6C8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffb`7be11084 c3 ret 00007ffb`7be11085 cd2e int 2Eh 00007ffb`7be11087 c3 ret 00007ffb`7be11088 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffb`7be11090 4c8bd1 mov r10,rcx 00007ffb`7be11093 b8d5010000 mov eax,1D5h 00007ffb`7be11098 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`7be110a0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffb`7be110a5) 00007ffb`7be110a2 0f05 syscall 00007ffb`7be110a4 c3 ret +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffb`7bdbd3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffb`7bdbd3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffb`7bdbd3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffb`7bdbd3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffb`7bdbd3e6 488d842448020000 lea rax,[rsp+248h] 00007ffb`7bdbd3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffb`7bdbd3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffb`7bdbd3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffb`7bdbd3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffb`7bdbd402 e8893c0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffb`7be11090) 00007ffb`7bdbd407 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`7b50735d cc int 3 00007ffb`7b50735e cc int 3 00007ffb`7b50735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`7b507360 4883ec28 sub rsp,28h 00007ffb`7b507364 85c9 test ecx,ecx 00007ffb`7b507366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383) 00007ffb`7b507368 498bc8 mov rcx,r8 00007ffb`7b50736b 488bc2 mov rax,rdx 00007ffb`7b50736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)] 00007ffb`7b507374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`7bdbcc72 ec in al,dx 00007ffb`7bdbcc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1) 00007ffb`7bdbcc75 8bc9 mov ecx,ecx 00007ffb`7bdbcc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)] 00007ffb`7bdbcc7e 4885c0 test rax,rax 00007ffb`7bdbcc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93) 00007ffb`7bdbcc83 4c8bc2 mov r8,rdx 00007ffb`7bdbcc86 488bd1 mov rdx,rcx 00007ffb`7bdbcc89 33c9 xor ecx,ecx 00007ffb`7bdbcc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)] 00007ffb`7bdbcc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3) ====================================================================== Thread 4276 / 0x10B4 ====================================================================== LastError: 0x000003F0 - An attempt was made to reference a token that does not exist. NTSTATUS: 0xC000007C - An attempt was made to reference a token that doesn't exist. This is typically done by referencing the token associated with a thread when the thread is not impersonating a client. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00001104 win32u.dll!NtUserGetMessage+0x14 +0002210E USER32.dll!GetMessageW+0x2E +000AFC38 combase.dll!Ordinal69+0xC28 +000AFB70 combase.dll!Ordinal69+0xB60 +000D0530 combase.dll!CoRevokeInitializeSpy+0xAA0 +000D04B9 combase.dll!CoRevokeInitializeSpy+0xA29 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000001006 RBX = 0000000EDD9FFBB0 RCX = 0000000EDD9FFBB0 RDX = 0000000000000000 RSI = 00000000018B0BC8 RDI = 0000000000000000 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 0000000000000000 R11 = 0000000EDD9FE2D0 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000001000 R15 = 0000000000000000 RIP = 00007FFB793F1104 RSP = 0000000EDD9FFB08 RBP = 00000000000003AC EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00001104 win32u.dll!NtUserGetMessage+0x14: 00007ffb`793f10e4 c3 ret 00007ffb`793f10e5 cd2e int 2Eh 00007ffb`793f10e7 c3 ret 00007ffb`793f10e8 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserGetMessage: 00007ffb`793f10f0 4c8bd1 mov r10,rcx 00007ffb`793f10f3 b806100000 mov eax,1006h 00007ffb`793f10f8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`793f1100 7503 jne win32u!NtUserGetMessage+0x15 (00007ffb`793f1105) 00007ffb`793f1102 0f05 syscall 00007ffb`793f1104 c3 ret +0002210E USER32.dll!GetMessageW+0x2E: 00007ffb`7b1f20e2 4883ec50 sub rsp,50h 00007ffb`7b1f20e6 418bc1 mov eax,r9d 00007ffb`7b1f20e9 488bd9 mov rbx,rcx 00007ffb`7b1f20ec 458bc8 mov r9d,r8d 00007ffb`7b1f20ef 440bc8 or r9d,eax 00007ffb`7b1f20f2 41f7c10000feff test r9d,0FFFE0000h 00007ffb`7b1f20f9 0f85b11d0200 jne USER32!SetWindowsHookExAW+0xd980 (00007ffb`7b213eb0) 00007ffb`7b1f20ff 448bc8 mov r9d,eax 00007ffb`7b1f2102 48897c2460 mov qword ptr [rsp+60h],rdi 00007ffb`7b1f2107 48ff1502ea0600 call qword ptr [USER32!gapfnScSendMessage+0x11b0 (00007ffb`7b260b10)] 00007ffb`7b1f210e 0f1f440000 nop dword ptr [rax+rax] +000AFC38 combase.dll!Ordinal69+0xC28: 00007ffb`7b66fc07 488bb1c0000000 mov rsi,qword ptr [rcx+0C0h] 00007ffb`7b66fc0e 488bce mov rcx,rsi 00007ffb`7b66fc11 48ff1588092800 call qword ptr [combase!Ordinal183+0x7f548 (00007ffb`7b8f05a0)] 00007ffb`7b66fc18 0f1f440000 nop dword ptr [rax+rax] 00007ffb`7b66fc1d 4889056c312500 mov qword ptr [combase!Ordinal183+0x51d38 (00007ffb`7b8c2d90)],rax 00007ffb`7b66fc24 4533c9 xor r9d,r9d 00007ffb`7b66fc27 488d4c2440 lea rcx,[rsp+40h] 00007ffb`7b66fc2c 4533c0 xor r8d,r8d 00007ffb`7b66fc2f 33d2 xor edx,edx 00007ffb`7b66fc31 48ff1550092800 call qword ptr [combase!Ordinal183+0x7f530 (00007ffb`7b8f0588)] 00007ffb`7b66fc38 0f1f440000 nop dword ptr [rax+rax] +000AFB70 combase.dll!Ordinal69+0xB60: 00007ffb`7b66fb4c 488bcd mov rcx,rbp 00007ffb`7b66fb4f 894658 mov dword ptr [rsi+58h],eax 00007ffb`7b66fb52 48ff152fd21c00 call qword ptr [combase!Ordinal79+0x61178 (00007ffb`7b83cd88)] 00007ffb`7b66fb59 0f1f440000 nop dword ptr [rax+rax] 00007ffb`7b66fb5e 8b4630 mov eax,dword ptr [rsi+30h] 00007ffb`7b66fb61 83e01f and eax,1Fh 00007ffb`7b66fb64 ffc8 dec eax 00007ffb`7b66fb66 83f801 cmp eax,1 00007ffb`7b66fb69 7705 ja combase!Ordinal69+0xb60 (00007ffb`7b66fb70) 00007ffb`7b66fb6b e864000000 call combase!Ordinal69+0xbc4 (00007ffb`7b66fbd4) 00007ffb`7b66fb70 488b442440 mov rax,qword ptr [rsp+40h] +000D0530 combase.dll!CoRevokeInitializeSpy+0xAA0: 00007ffb`7b6904fc 44397108 cmp dword ptr [rcx+8],r14d 00007ffb`7b690500 0f8538010000 jne combase!CoRevokeInitializeSpy+0xbae (00007ffb`7b69063e) 00007ffb`7b690506 65488b042530000000 mov rax,qword ptr gs:[30h] 00007ffb`7b69050f 488b8058170000 mov rax,qword ptr [rax+1758h] 00007ffb`7b690516 4885c0 test rax,rax 00007ffb`7b690519 7407 je combase!CoRevokeInitializeSpy+0xa92 (00007ffb`7b690522) 00007ffb`7b69051b 4489b038010000 mov dword ptr [rax+138h],r14d 00007ffb`7b690522 488b4b18 mov rcx,qword ptr [rbx+18h] 00007ffb`7b690526 488b4310 mov rax,qword ptr [rbx+10h] 00007ffb`7b69052a ff1568d01a00 call qword ptr [combase!Ordinal79+0x61988 (00007ffb`7b83d598)] 00007ffb`7b690530 48ff15a9c51a00 call qword ptr [combase!Ordinal79+0x60ed0 (00007ffb`7b83cae0)] +000D04B9 combase.dll!CoRevokeInitializeSpy+0xA29: 00007ffb`7b690490 48895c2408 mov qword ptr [rsp+8],rbx 00007ffb`7b690495 57 push rdi 00007ffb`7b690496 4883ec20 sub rsp,20h 00007ffb`7b69049a 488bf9 mov rdi,rcx 00007ffb`7b69049d 48ff152cc61a00 call qword ptr [combase!Ordinal79+0x60ec0 (00007ffb`7b83cad0)] 00007ffb`7b6904a4 0f1f440000 nop dword ptr [rax+rax] 00007ffb`7b6904a9 894728 mov dword ptr [rdi+28h],eax 00007ffb`7b6904ac e847040000 call combase!CoRevokeInitializeSpy+0xe68 (00007ffb`7b6908f8) 00007ffb`7b6904b1 488bcf mov rcx,rdi 00007ffb`7b6904b4 e82b000000 call combase!CoRevokeInitializeSpy+0xa54 (00007ffb`7b6904e4) 00007ffb`7b6904b9 488b5f30 mov rbx,qword ptr [rdi+30h] +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`7b50735d cc int 3 00007ffb`7b50735e cc int 3 00007ffb`7b50735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`7b507360 4883ec28 sub rsp,28h 00007ffb`7b507364 85c9 test ecx,ecx 00007ffb`7b507366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383) 00007ffb`7b507368 498bc8 mov rcx,r8 00007ffb`7b50736b 488bc2 mov rax,rdx 00007ffb`7b50736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)] 00007ffb`7b507374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`7bdbcc72 ec in al,dx 00007ffb`7bdbcc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1) 00007ffb`7bdbcc75 8bc9 mov ecx,ecx 00007ffb`7bdbcc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)] 00007ffb`7bdbcc7e 4885c0 test rax,rax 00007ffb`7bdbcc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93) 00007ffb`7bdbcc83 4c8bc2 mov r8,rdx 00007ffb`7bdbcc86 488bd1 mov rdx,rcx 00007ffb`7bdbcc89 33c9 xor ecx,ecx 00007ffb`7bdbcc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)] 00007ffb`7bdbcc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3) ====================================================================== Thread 8040 / 0x1F68 ====================================================================== LastError: 0x00000057 - The parameter is incorrect. NTSTATUS: 0xC000000D - An invalid parameter was passed to a service or function. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747 +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14 +0004CC91 ntdll.dll!RtlUserThreadStart+0x21 ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001D5 RBX = 0000000000000000 RCX = 000000000000051C RDX = 000001DFD4596970 RSI = 000001DFD44BEB80 RDI = 0000000000000000 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 0000000000000000 R11 = 0000000000000000 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFB7BE110A4 RSP = 0000000EDDBFF9D8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000A10A4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffb`7be11084 c3 ret 00007ffb`7be11085 cd2e int 2Eh 00007ffb`7be11087 c3 ret 00007ffb`7be11088 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffb`7be11090 4c8bd1 mov r10,rcx 00007ffb`7be11093 b8d5010000 mov eax,1D5h 00007ffb`7be11098 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`7be110a0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffb`7be110a5) 00007ffb`7be110a2 0f05 syscall 00007ffb`7be110a4 c3 ret +0004D407 ntdll.dll!TpReleaseCleanupGroupMembers+0x747: 00007ffb`7bdbd3d0 4889442468 mov qword ptr [rsp+68h],rax 00007ffb`7bdbd3d5 44896c2448 mov dword ptr [rsp+48h],r13d 00007ffb`7bdbd3da 488b4e38 mov rcx,qword ptr [rsi+38h] 00007ffb`7bdbd3de 48898c24c8000000 mov qword ptr [rsp+0C8h],rcx 00007ffb`7bdbd3e6 488d842448020000 lea rax,[rsp+248h] 00007ffb`7bdbd3ee 4889442420 mov qword ptr [rsp+20h],rax 00007ffb`7bdbd3f3 4c8d4c2448 lea r9,[rsp+48h] 00007ffb`7bdbd3f8 448b442444 mov r8d,dword ptr [rsp+44h] 00007ffb`7bdbd3fd 488b542468 mov rdx,qword ptr [rsp+68h] 00007ffb`7bdbd402 e8893c0500 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffb`7be11090) 00007ffb`7bdbd407 8bc8 mov ecx,eax +00017374 KERNEL32.DLL!BaseThreadInitThunk+0x14: 00007ffb`7b50735d cc int 3 00007ffb`7b50735e cc int 3 00007ffb`7b50735f cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffb`7b507360 4883ec28 sub rsp,28h 00007ffb`7b507364 85c9 test ecx,ecx 00007ffb`7b507366 751b jne KERNEL32!BaseThreadInitThunk+0x23 (00007ffb`7b507383) 00007ffb`7b507368 498bc8 mov rcx,r8 00007ffb`7b50736b 488bc2 mov rax,rdx 00007ffb`7b50736e ff15d4f20600 call qword ptr [KERNEL32!QuirkIsEnabledForPackage2Worker+0x13c88 (00007ffb`7b576648)] 00007ffb`7b507374 8bc8 mov ecx,eax +0004CC91 ntdll.dll!RtlUserThreadStart+0x21: 00007ffb`7bdbcc72 ec in al,dx 00007ffb`7bdbcc73 784c js ntdll!TpReleaseCleanupGroupMembers+0x1 (00007ffb`7bdbccc1) 00007ffb`7bdbcc75 8bc9 mov ecx,ecx 00007ffb`7bdbcc77 488b0572f31100 mov rax,qword ptr [ntdll!NlsAnsiCodePage+0x2824 (00007ffb`7bedbff0)] 00007ffb`7bdbcc7e 4885c0 test rax,rax 00007ffb`7bdbcc81 7410 je ntdll!RtlUserThreadStart+0x23 (00007ffb`7bdbcc93) 00007ffb`7bdbcc83 4c8bc2 mov r8,rdx 00007ffb`7bdbcc86 488bd1 mov rdx,rcx 00007ffb`7bdbcc89 33c9 xor ecx,ecx 00007ffb`7bdbcc8b ff156f831300 call qword ptr [ntdll!KiUserInvertedFunctionTable+0x3b00 (00007ffb`7bef5000)] 00007ffb`7bdbcc91 eb20 jmp ntdll!RtlUserThreadStart+0x43 (00007ffb`7bdbccb3) ====================================================================== Thread 24492 / 0x5FAC ====================================================================== LastError: 0x00000057 - The parameter is incorrect. NTSTATUS: 0xC000000D - An invalid parameter was passed to a service or function. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14 +00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0 +0004B7B7 CRYPT32.dll! (get the pdb) ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000001 RCX = 0000000000000001 RDX = 000001DFD511FAB0 RSI = 0000000000000000 RDI = 0000000000000001 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 0000000000000000 R11 = 0000000000000000 R12 = 0000000000003A98 R13 = 000001DFD511FAB0 R14 = 0000000EDDCFF620 R15 = 0000000000000000 RIP = 00007FFB7BE0E164 RSP = 0000000EDDCFF5C8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +0009E164 ntdll.dll!NtWaitForMultipleObjects+0x14: 00007ffb`7be0e13d 0000 add byte ptr [rax],al 00007ffb`7be0e13f 00e9 add cl,ch 00007ffb`7be0e141 6b8efdff666666 imul ecx,dword ptr [rsi+6666FFFDh],66h 00007ffb`7be0e148 0f1f840000000000 nop dword ptr [rax+rax] ntdll!NtWaitForMultipleObjects: 00007ffb`7be0e150 4c8bd1 mov r10,rcx 00007ffb`7be0e153 b85b000000 mov eax,5Bh 00007ffb`7be0e158 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffb`7be0e160 7503 jne ntdll!NtWaitForMultipleObjects+0x15 (00007ffb`7be0e165) 00007ffb`7be0e162 0f05 syscall 00007ffb`7be0e164 c3 ret +00050D10 KERNELBASE.dll!WaitForMultipleObjectsEx+0xF0: 00007ffb`79940ce7 4c8d742450 lea r14,[rsp+50h] 00007ffb`79940cec 448b7c2444 mov r15d,dword ptr [rsp+44h] 00007ffb`79940cf1 4533c0 xor r8d,r8d 00007ffb`79940cf4 4585ff test r15d,r15d 00007ffb`79940cf7 410f94c0 sete r8b 00007ffb`79940cfb 4c89742420 mov qword ptr [rsp+20h],r14 00007ffb`79940d00 440fb6ce movzx r9d,sil 00007ffb`79940d04 498bd5 mov rdx,r13 00007ffb`79940d07 8bcb mov ecx,ebx 00007ffb`79940d09 48ff1570391900 call qword ptr [KERNELBASE!UnhandledExceptionFilter+0xb8080 (00007ffb`79ad4680)] 00007ffb`79940d10 0f1f440000 nop dword ptr [rax+rax] +0004B7B7 CRYPT32.dll! (get the pdb): 00007ffb`79c3b793 488bd9 mov rbx,rcx 00007ffb`79c3b796 48f7d8 neg rax 00007ffb`79c3b799 1bff sbb edi,edi 00007ffb`79c3b79b f7df neg edi 00007ffb`79c3b79d 448b4b30 mov r9d,dword ptr [rbx+30h] 00007ffb`79c3b7a1 488d5310 lea rdx,[rbx+10h] 00007ffb`79c3b7a5 8364242000 and dword ptr [rsp+20h],0 00007ffb`79c3b7aa 8d4f01 lea ecx,[rdi+1] 00007ffb`79c3b7ad 4533c0 xor r8d,r8d 00007ffb`79c3b7b0 48ff15f1ee0c00 call qword ptr [00007ffb`79d0a6a8] 00007ffb`79c3b7b7 0f1f440000 nop dword ptr [rax+rax] ====================================================================== Modules ====================================================================== 0x00007FF606730000 - 0x00007FF606CD9000 | C:\Program Files\Far Manager\Far.exe | File and archive manager | 3.0.6644.0 x64 0x00007FFB7BD70000 - 0x00007FFB7BF68000 | C:\WINDOWS\SYSTEM32\ntdll.dll | NT Layer DLL | 10.0.19041.4842 (WinBuild.160101.0800) 0x00007FFB7B4F0000 - 0x00007FFB7B5B2000 | C:\WINDOWS\System32\KERNEL32.DLL | Windows NT BASE API Client DLL | 10.0.19041.6807 (WinBuild.160101.0800) 0x00007FFB798F0000 - 0x00007FFB79BE7000 | C:\WINDOWS\System32\KERNELBASE.dll | Windows NT BASE API Client DLL | 10.0.19041.6807 (WinBuild.160101.0800) 0x00007FFB7B430000 - 0x00007FFB7B4E1000 | C:\WINDOWS\System32\ADVAPI32.dll | Advanced Windows 32 Base API | 10.0.19041.320 (WinBuild.160101.0800) 0x00007FFB7BC60000 - 0x00007FFB7BCFE000 | C:\WINDOWS\System32\msvcrt.dll | Windows NT CRT DLL | 7.0.19041.6809 (WinBuild.160101.0800) 0x00007FFB7AF20000 - 0x00007FFB7AFBF000 | C:\WINDOWS\System32\sechost.dll | Host for SCM/SDDL/LSA Lookup APIs | 10.0.19041.320 (WinBuild.160101.0800) 0x00007FFB7A6B0000 - 0x00007FFB7A7D6000 | C:\WINDOWS\System32\RPCRT4.dll | Remote Procedure Call Runtime | 10.0.19041.6807 (WinBuild.160101.0800) 0x00007FFB79D50000 - 0x00007FFB79D77000 | C:\WINDOWS\System32\bcrypt.dll | Windows Cryptographic Primitives Library | 10.0.19041.320 (WinBuild.160101.0800) 0x00007FFB7B1D0000 - 0x00007FFB7B36D000 | C:\WINDOWS\System32\USER32.dll | Бібліотека DLL клієнта багатокористувацького API Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFB793F0000 - 0x00007FFB79412000 | C:\WINDOWS\System32\win32u.dll | Win32u | 10.0.19041.7058 (WinBuild.160101.0800) 0x00007FFB7BD00000 - 0x00007FFB7BD2B000 | C:\WINDOWS\System32\GDI32.dll | GDI Client DLL | 10.0.19041.7058 (WinBuild.160101.0800) 0x00007FFB79420000 - 0x00007FFB7953A000 | C:\WINDOWS\System32\gdi32full.dll | GDI Client DLL | 10.0.19041.7058 (WinBuild.160101.0800) 0x00007FFB79850000 - 0x00007FFB798ED000 | C:\WINDOWS\System32\msvcp_win.dll | Microsoft® C Runtime Library | 10.0.19041.6809 (WinBuild.160101.0800) 0x00007FFB79540000 - 0x00007FFB79640000 | C:\WINDOWS\System32\ucrtbase.dll | Microsoft® C Runtime Library | 10.0.19041.6809 (WinBuild.160101.0800) 0x00007FFB79ED0000 - 0x00007FFB7A641000 | C:\WINDOWS\System32\SHELL32.dll | Загальна бібліотека Dll оболонки Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFB7ADF0000 - 0x00007FFB7AF1B000 | C:\WINDOWS\System32\ole32.dll | Microsoft OLE for Windows | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFB7B5C0000 - 0x00007FFB7B913000 | C:\WINDOWS\System32\combase.dll | Microsoft COM for Windows | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFB7ADE0000 - 0x00007FFB7ADE8000 | C:\WINDOWS\System32\PSAPI.DLL | Process Status Helper | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFB7A7E0000 - 0x00007FFB7AC50000 | C:\WINDOWS\System32\SETUPAPI.dll | API програми інсталяції Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFB796C0000 - 0x00007FFB7970E000 | C:\WINDOWS\System32\cfgmgr32.dll | Configuration Manager DLL | 10.0.19041.3996 (WinBuild.160101.0800) 0x00007FFB7AD00000 - 0x00007FFB7ADDA000 | C:\WINDOWS\System32\COMDLG32.dll | Common Dialogs DLL | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFB7BA10000 - 0x00007FFB7BABD000 | C:\WINDOWS\System32\shcore.dll | SHCORE | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFB7B170000 - 0x00007FFB7B1CB000 | C:\WINDOWS\System32\SHLWAPI.dll | Бібліотека спрощеної утиліти оболонки | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFB7B400000 - 0x00007FFB7B42F000 | C:\WINDOWS\System32\IMM32.dll | Multi-User Windows IMM32 API Client DLL | 10.0.19041.6157 (WinBuild.160101.0800) 0x00007FFB5DF40000 - 0x00007FFB5DFE4000 | C:\WINDOWS\SYSTEM32\WINSPOOL.DRV | Драйвер спулера Windows | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFB61050000 - 0x00007FFB61069000 | C:\WINDOWS\SYSTEM32\NETAPI32.dll | Net Win32 API DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFB61030000 - 0x00007FFB6104D000 | C:\WINDOWS\SYSTEM32\MPR.dll | Бібліотека DLL маршрутизатора постачальниками | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFB5FDB0000 - 0x00007FFB5FDBC000 | C:\WINDOWS\SYSTEM32\Secur32.dll | Security Support Provider Interface | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFB792A0000 - 0x00007FFB792CE000 | C:\WINDOWS\SYSTEM32\USERENV.dll | Userenv | 10.0.19041.320 (WinBuild.160101.0800) 0x00007FFB760B0000 - 0x00007FFB760BA000 | C:\WINDOWS\SYSTEM32\VERSION.dll | Version Checking and File Installation Libraries | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFB58530000 - 0x00007FFB587CB000 | C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6926_none_60b5a53971f8f7e6\COMCTL32.dll | Бібліотека елементів керування для роботи користувача | 6.10 (WinBuild.160101.0800) 0x00007FFAE11F0000 - 0x00007FFAE1317000 | C:\Program Files\Far Manager\sqlite3.dll | SQLite is a software library that implements a self-contained, serverless, zero-configuration, transactional SQL database engine. | 3.51.2 0x00007FFB78820000 - 0x00007FFB7882C000 | C:\WINDOWS\SYSTEM32\NETUTILS.DLL | Net Win32 API Helpers DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFB64D90000 - 0x00007FFB64DA9000 | C:\WINDOWS\SYSTEM32\SAMCLI.DLL | Security Accounts Manager Client DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFB69E00000 - 0x00007FFB69E28000 | C:\WINDOWS\SYSTEM32\SRVCLI.DLL | Server Service Client DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFB792D0000 - 0x00007FFB79302000 | C:\WINDOWS\SYSTEM32\SSPICLI.DLL | Security Support Provider Interface | 10.0.19041.6807 (WinBuild.160101.0800) 0x00007FFB77290000 - 0x00007FFB772A2000 | C:\WINDOWS\SYSTEM32\kernel.appcore.dll | AppModel API Host | 10.0.19041.3758 (WinBuild.160101.0800) 0x00007FFB76D00000 - 0x00007FFB76D9E000 | C:\WINDOWS\system32\uxtheme.dll | Бібліотека UxTheme Microsoft | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFB7BB40000 - 0x00007FFB7BC55000 | C:\WINDOWS\System32\MSCTF.dll | Бібліотека DLL сервера MSCTF | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFB79D80000 - 0x00007FFB79E4D000 | C:\WINDOWS\System32\OLEAUT32.dll | OLEAUT32.DLL | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFB77490000 - 0x00007FFB77C36000 | C:\WINDOWS\SYSTEM32\windows.storage.dll | Інтерфейс API сховища Microsoft WinRT | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFB78E20000 - 0x00007FFB78E4B000 | C:\WINDOWS\SYSTEM32\Wldp.dll | Windows Lockdown Policy | 10.0.19041.320 (WinBuild.160101.0800) 0x00007FFB79320000 - 0x00007FFB79344000 | C:\WINDOWS\SYSTEM32\profapi.dll | User Profile Basic API | 10.0.19041.6033 (WinBuild.160101.0800) 0x00007FFB797C0000 - 0x00007FFB79842000 | C:\WINDOWS\System32\bcryptPrimitives.dll | Windows Cryptographic Primitives Library | 10.0.19041.6809 (WinBuild.160101.0800) 0x00007FFB7AC50000 - 0x00007FFB7ACF9000 | C:\WINDOWS\System32\clbcatq.dll | COM+ Configuration Catalog | 2001.12.10941.16384 (WinBuild.160101.0800) 0x00007FFB47060000 - 0x00007FFB472B8000 | C:\WINDOWS\system32\explorerframe.dll | ExplorerFrame | 10.0.19041.4842 (WinBuild.160101.0800) 0x00007FFB74E30000 - 0x00007FFB753F0000 | C:\WINDOWS\system32\d2d1.dll | Microsoft D2D Library | 10.0.19041.320 (WinBuild.160101.0800) 0x00007FFB718C0000 - 0x00007FFB72094000 | C:\Windows\System32\OneCoreUAPCommonProxyStub.dll | OneCoreUAP Common Proxy Stub | 10.0.19041.5915 (WinBuild.160101.0800) 0x00007FFB59FC0000 - 0x00007FFB59FE3000 | C:\Program Files\Far Manager\Plugins\LuaMacro\LuaMacro.dll | Lua Macros for Far Manager | 3.0.915.0 0x0000000066D80000 - 0x0000000066E00000 | C:\Program Files\Far Manager\lua51.dll | 0x00000715 - The specified resource type cannot be found in the image file. 0x00007FFB47BA0000 - 0x00007FFB47C4F000 | C:\Program Files\Far Manager\luafar3.dll | LuaFar library | 3.0.915.0 0x00007FFB78D90000 - 0x00007FFB78D9C000 | C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL | Base cryptographic API DLL | 10.0.19041.6809 (WinBuild.160101.0800) 0x00007FFB729F0000 - 0x00007FFB72BF1000 | C:\WINDOWS\SYSTEM32\dbghelp.DLL | Windows Image Helper | 10.0.19041.5848 (WinBuild.160101.0800) 0x00007FFB72900000 - 0x00007FFB72934000 | C:\WINDOWS\SYSTEM32\dbgcore.DLL | Windows Core Debugging Helpers | 10.0.19041.5794 (WinBuild.160101.0800) 0x00007FFB556A0000 - 0x00007FFB55D27000 | C:\WINDOWS\SYSTEM32\dbgeng.DLL | Windows Symbolic Debugger Engine | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFB74420000 - 0x00007FFB74456000 | C:\WINDOWS\SYSTEM32\XmlLite.dll | Microsoft XmlLite Library | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFB700B0000 - 0x00007FFB70164000 | C:\WINDOWS\SYSTEM32\dbgmodel.dll | Windows Debugger Data Model | 10.0.19041.3636 (WinBuild.160101.0800) 0x00007FFB79640000 - 0x00007FFB796B3000 | C:\WINDOWS\System32\wintrust.dll | Microsoft Trust Verification APIs | 10.0.19041.6456 (WinBuild.160101.0800) 0x00007FFB79BF0000 - 0x00007FFB79D4D000 | C:\WINDOWS\System32\CRYPT32.dll | Crypto API32 | 10.0.19041.4522 (WinBuild.160101.0800) 0x00007FFB78FB0000 - 0x00007FFB78FC2000 | C:\WINDOWS\SYSTEM32\MSASN1.dll | ASN.1 Runtime APIs | 10.0.19041.6809 (WinBuild.160101.0800) 0x00007FFB78D70000 - 0x00007FFB78D88000 | C:\WINDOWS\SYSTEM32\CRYPTSP.dll | Cryptographic Service Provider API | 10.0.19041.6809 (WinBuild.160101.0800) 0x00007FFB78400000 - 0x00007FFB78438000 | C:\WINDOWS\system32\rsaenh.dll | Microsoft Enhanced Cryptographic Provider | 10.0.19041.320 (WinBuild.160101.0800) 0x00007FFB79EB0000 - 0x00007FFB79ECD000 | C:\WINDOWS\System32\imagehlp.dll | Windows NT Image Helper | 10.0.19041.3636 (WinBuild.160101.0800) ====================================================================== Environment ====================================================================== FARHOME=C:\Program Files\Far Manager FARLANG=Russian FARLOCALPROFILE=C:\Users\AnViKo\AppData\Local\Far Manager\Profile FARPROFILE=C:\Users\AnViKo\AppData\Roaming\Far Manager\Profile