====================================================================== Summary ====================================================================== Exception: 0xE06D7363 - C++ exception (class std::bad_alloc) Details: bad allocation errno: 0x0000000C - Not enough space LastError: 0x00000008 - Недостаточно ресурсов памяти для обработки этой команды. NTSTATUS: 0xC0000017 - {Недостаточно квот} Недостаточно квот на виртуальную память или файл подкачки для завершения требуемой операции. Address: +000C66CA KERNELBASE.dll!RaiseException+0x8A Location: mainImpl, main.cpp(933) Module: C:\Program Files\Far Manager\Far.exe Plugin: N/A ====================================================================== System information ====================================================================== Far: 3.0.6446.0 x64 (b55e405) Compiler: Microsoft Visual C++, version 19.41.33923.0 Library: Microsoft STL, version 14.3.202404 PE time: 2025-03-01 16:50:49.000 File time: 2025-03-01 13:50:50.000 Time: 2025-09-30 06:38:07.744 Local: 2025-09-30 11:38:07.744 +0500, RTZ 4 (зима) Uptime: 132:01:56 OS: Windows NT Workstation 10.0.26100, 0x100/0x30 (Windows 10 Pro, version 24H2, OS build 26100.6584) Locale: ru-RU | LCID=00000419 (Lang=0419 (Primary=019 Sub=01) Sort=0 SortVersion=0) | ANSI=1251 OEM=866 Host: C:\Windows\System32\conhost.exe 10.0.26100.6713 (WinBuild.160101.0800) Parent: C:\Windows\explorer.exe 10.0.26100.6713 (WinBuild.160101.0800) Command: "C:\Program Files\Far Manager\Far.exe" Elevated: Yes (Full) Memory: 17.6 G out of 23.8 G free (73%); 23.7 M used by the process ====================================================================== Exception ====================================================================== ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +000C66CA KERNELBASE.dll!RaiseException+0x8A +003514DF Far.exe! (get the pdb) +0034A73F Far.exe! (get the pdb) +0034EF01 Far.exe! (get the pdb) +0000480A Far.exe! (get the pdb) +002E460B Far.exe! (get the pdb) +002E4207 Far.exe! (get the pdb) +001FAED3 Far.exe! (get the pdb) +001FBBA9 Far.exe! (get the pdb) +0022B9E6 Far.exe! (get the pdb) +0022B981 Far.exe! (get the pdb) +00223115 Far.exe! (get the pdb) +00228153 Far.exe! (get the pdb) +00125C36 Far.exe! (get the pdb) +002270C6 Far.exe! (get the pdb) +002279E9 Far.exe! (get the pdb) +002281D2 Far.exe! (get the pdb) +00125C36 Far.exe! (get the pdb) +0022791A Far.exe! (get the pdb) +0022825C Far.exe! (get the pdb) +00125C68 Far.exe! (get the pdb) +00227B68 Far.exe! (get the pdb) +0034F8F0 Far.exe! (get the pdb) +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +00008D9C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000001F904B94040 RBX = 0000001C870FE328 RCX = 0050021000000001 RDX = 000000020003001F RSI = 0000000000000001 RDI = 00000000E06D7363 R8 = 00007FFC6F09F34B R9 = 0000000000000008 R10 = 00001000FFFF9A89 R11 = 000001F904000014 R12 = 000001F9080F48E0 R13 = 000001F9080F48F0 R14 = 0000000000000082 R15 = 0000000000000007 RIP = 00007FFC6F0766CA RSP = 0000001C870FE200 RBP = 0000000000000004 EFL = 00000206 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +000C66CA KERNELBASE.dll!RaiseException+0x8A: 00007ffc`6f07669b 41b80f000000 mov r8d,0Fh 00007ffc`6f0766a1 488d4c2440 lea rcx,[rsp+40h] 00007ffc`6f0766a6 413be8 cmp ebp,r8d 00007ffc`6f0766a9 488bd3 mov rdx,rbx 00007ffc`6f0766ac 440f46c5 cmovbe r8d,ebp 00007ffc`6f0766b0 4489442438 mov dword ptr [rsp+38h],r8d 00007ffc`6f0766b5 49c1e003 shl r8,3 00007ffc`6f0766b9 e8c9290d00 call KERNELBASE!TerminateProcessOnMemoryExhaustion+0x6797 (00007ffc`6f149087) 00007ffc`6f0766be 488d4c2420 lea rcx,[rsp+20h] 00007ffc`6f0766c3 48ff1576021d00 call qword ptr [KERNELBASE!TlsGetValue+0xfd840 (00007ffc`6f246940)] 00007ffc`6f0766ca 0f1f440000 nop dword ptr [rax+rax] +003514DF Far.exe! (get the pdb): 00007ff6`e25614ad bf00409901 mov edi,1994000h 00007ff6`e25614b2 ba01000000 mov edx,1 00007ff6`e25614b7 48897c2428 mov qword ptr [rsp+28h],rdi 00007ff6`e25614bc 4c8d4c2428 lea r9,[rsp+28h] 00007ff6`e25614c1 4889742430 mov qword ptr [rsp+30h],rsi 00007ff6`e25614c6 b963736de0 mov ecx,0E06D7363h 00007ff6`e25614cb 48895c2438 mov qword ptr [rsp+38h],rbx 00007ff6`e25614d0 4889442440 mov qword ptr [rsp+40h],rax 00007ff6`e25614d5 448d4203 lea r8d,[rdx+3] 00007ff6`e25614d9 ff15d95d0600 call qword ptr [Far+0x3b72b8 (00007ff6`e25c72b8)] 00007ff6`e25614df 488b5c2470 mov rbx,qword ptr [rsp+70h] +0034A73F Far.exe! (get the pdb): 00007ff6`e255a710 488d0529e40600 lea rax,[Far+0x3b8b40 (00007ff6`e25c8b40)] 00007ff6`e255a717 c3 ret 00007ff6`e255a718 488d05b1e30600 lea rax,[Far+0x3b8ad0 (00007ff6`e25c8ad0)] 00007ff6`e255a71f c3 ret 00007ff6`e255a720 4883ec48 sub rsp,48h 00007ff6`e255a724 488d4c2420 lea rcx,[rsp+20h] 00007ff6`e255a729 e8f2abccff call Far+0x15320 (00007ff6`e2225320) 00007ff6`e255a72e 488d15fbac1100 lea rdx,[Far+0x465430 (00007ff6`e2675430)] 00007ff6`e255a735 488d4c2420 lea rcx,[rsp+20h] 00007ff6`e255a73a e8096d0000 call Far+0x351448 (00007ff6`e2561448) 00007ff6`e255a73f cc int 3 +0034EF01 Far.exe! (get the pdb): 00007ff6`e255eee3 488bcb mov rcx,rbx 00007ff6`e255eee6 e855e70000 call Far+0x35d640 (00007ff6`e256d640) 00007ff6`e255eeeb 4885c0 test rax,rax 00007ff6`e255eeee 74e7 je Far+0x34eed7 (00007ff6`e255eed7) 00007ff6`e255eef0 4883c420 add rsp,20h 00007ff6`e255eef4 5b pop rbx 00007ff6`e255eef5 c3 ret 00007ff6`e255eef6 4883fbff cmp rbx,0FFFFFFFFFFFFFFFFh 00007ff6`e255eefa 7406 je Far+0x34ef02 (00007ff6`e255ef02) 00007ff6`e255eefc e81fb8ffff call Far+0x34a720 (00007ff6`e255a720) 00007ff6`e255ef01 cc int 3 +0000480A Far.exe! (get the pdb): 00007ff6`e22147e9 33c0 xor eax,eax 00007ff6`e22147eb 4883c428 add rsp,28h 00007ff6`e22147ef c3 ret 00007ff6`e22147f0 4881f900100000 cmp rcx,1000h 00007ff6`e22147f7 722a jb Far+0x4823 (00007ff6`e2214823) 00007ff6`e22147f9 488d4127 lea rax,[rcx+27h] 00007ff6`e22147fd 483bc1 cmp rax,rcx 00007ff6`e2214800 762a jbe Far+0x482c (00007ff6`e221482c) 00007ff6`e2214802 488bc8 mov rcx,rax 00007ff6`e2214805 e8c2a63400 call Far+0x34eecc (00007ff6`e255eecc) 00007ff6`e221480a 488bc8 mov rcx,rax +002E460B Far.exe! (get the pdb): 00007ff6`e24f45d8 48c744243000000000 mov qword ptr [rsp+30h],0 00007ff6`e24f45e1 f30f7f442420 movdqu xmmword ptr [rsp+20h],xmm0 00007ff6`e24f45e7 4885db test rbx,rbx 00007ff6`e24f45ea 7454 je Far+0x2e4640 (00007ff6`e24f4640) 00007ff6`e24f45ec 48b8ffffffffffffff07 mov rax,7FFFFFFFFFFFFFFh 00007ff6`e24f45f6 483bd8 cmp rbx,rax 00007ff6`e24f45f9 0f87c7000000 ja Far+0x2e46c6 (00007ff6`e24f46c6) 00007ff6`e24f45ff 48c1e305 shl rbx,5 00007ff6`e24f4603 488bcb mov rcx,rbx 00007ff6`e24f4606 e8d501d2ff call Far+0x47e0 (00007ff6`e22147e0) 00007ff6`e24f460b 488b17 mov rdx,qword ptr [rdi] +002E4207 Far.exe! (get the pdb): 00007ff6`e24f41e0 e86b06f1ff call Far+0x1f4850 (00007ff6`e2404850) 00007ff6`e24f41e5 4d8bec mov r13,r12 00007ff6`e24f41e8 4d3be5 cmp r12,r13 00007ff6`e24f41eb 746b je Far+0x2e4258 (00007ff6`e24f4258) 00007ff6`e24f41ed 4c8b55af mov r10,qword ptr [rbp-51h] 00007ff6`e24f41f1 498d7a68 lea rdi,[r10+68h] 00007ff6`e24f41f5 498d9a98000000 lea rbx,[r10+98h] 00007ff6`e24f41fc 488bd7 mov rdx,rdi 00007ff6`e24f41ff 488bcb mov rcx,rbx 00007ff6`e24f4202 e8a9030000 call Far+0x2e45b0 (00007ff6`e24f45b0) 00007ff6`e24f4207 4d2bec sub r13,r12 +001FAED3 Far.exe! (get the pdb): 00007ff6`e240ae98 0f85a7020000 jne Far+0x1fb145 (00007ff6`e240b145) 00007ff6`e240ae9e 488d55d0 lea rdx,[rbp-30h] 00007ff6`e240aea2 e8f9d2e8ff call Far+0x881a0 (00007ff6`e22981a0) 00007ff6`e240aea7 c605daf22a0000 mov byte ptr [Far+0x4aa188 (00007ff6`e26ba188)],0 00007ff6`e240aeae 6644893576022700 mov word ptr [Far+0x46b12c (00007ff6`e267b12c)],r14w 00007ff6`e240aeb6 e9d5feffff jmp Far+0x1fad90 (00007ff6`e240ad90) 00007ff6`e240aebb 488b05eef22a00 mov rax,qword ptr [Far+0x4aa1b0 (00007ff6`e26ba1b0)] 00007ff6`e240aec2 ba07000000 mov edx,7 00007ff6`e240aec7 488b8848010000 mov rcx,qword ptr [rax+148h] 00007ff6`e240aece e8ad8b0e00 call Far+0x2e3a80 (00007ff6`e24f3a80) 00007ff6`e240aed3 488b0dd6f22a00 mov rcx,qword ptr [Far+0x4aa1b0 (00007ff6`e26ba1b0)] +001FBBA9 Far.exe! (get the pdb): 00007ff6`e240bb83 4883ec78 sub rsp,78h 00007ff6`e240bb87 488b05b2e62600 mov rax,qword ptr [Far+0x46a240 (00007ff6`e267a240)] 00007ff6`e240bb8e 4833c4 xor rax,rsp 00007ff6`e240bb91 4889442450 mov qword ptr [rsp+50h],rax 00007ff6`e240bb96 0f57c0 xorps xmm0,xmm0 00007ff6`e240bb99 33c0 xor eax,eax 00007ff6`e240bb9b 0f1101 movups xmmword ptr [rcx],xmm0 00007ff6`e240bb9e 894110 mov dword ptr [rcx+10h],eax 00007ff6`e240bba1 488be9 mov rbp,rcx 00007ff6`e240bba4 e887f0ffff call Far+0x1fac30 (00007ff6`e240ac30) 00007ff6`e240bba9 8bf0 mov esi,eax +0022B9E6 Far.exe! (get the pdb): 00007ff6`e243b9bc 4156 push r14 00007ff6`e243b9be 4881ec80000000 sub rsp,80h 00007ff6`e243b9c5 488b0574e82300 mov rax,qword ptr [Far+0x46a240 (00007ff6`e267a240)] 00007ff6`e243b9cc 4833c4 xor rax,rsp 00007ff6`e243b9cf 4889442478 mov qword ptr [rsp+78h],rax 00007ff6`e243b9d4 488bf1 mov rsi,rcx 00007ff6`e243b9d7 4533c0 xor r8d,r8d 00007ff6`e243b9da 33d2 xor edx,edx 00007ff6`e243b9dc 488d4c2460 lea rcx,[rsp+60h] 00007ff6`e243b9e1 e89a01fdff call Far+0x1fbb80 (00007ff6`e240bb80) 00007ff6`e243b9e6 448bc0 mov r8d,eax ====================================================================== Exception handler thread ====================================================================== ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +001217FD Far.exe! (get the pdb) +00123D5E Far.exe! (get the pdb) +00124CFC Far.exe! (get the pdb) +00124E2E Far.exe! (get the pdb) +00124E8E Far.exe! (get the pdb) +0022752F Far.exe! (get the pdb) +0022753D Far.exe! (get the pdb) +00228689 Far.exe! (get the pdb) +00228057 Far.exe! (get the pdb) +0022806F Far.exe! (get the pdb) +003A22E2 Far.exe! (get the pdb) +0035CCD0 Far.exe! (get the pdb) +00353B8A Far.exe! (get the pdb) +00122CC6 ntdll.dll!RtlCaptureContext2+0x4A6 +00125C36 Far.exe! (get the pdb) +002270C6 Far.exe! (get the pdb) +002279E9 Far.exe! (get the pdb) +002281D2 Far.exe! (get the pdb) +00125C36 Far.exe! (get the pdb) +0022791A Far.exe! (get the pdb) +0022825C Far.exe! (get the pdb) +00125C68 Far.exe! (get the pdb) +00227B68 Far.exe! (get the pdb) +0034F8F0 Far.exe! (get the pdb) +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +00008D9C ntdll.dll!RtlUserThreadStart+0x2C ====================================================================== Thread 18484 / 0x4834 (Window messages processor) ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC0000047 - Попытка освобождения семафора, при котором было бы превышено его максимальное значение счетчика. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00001324 win32u.dll!NtUserGetMessage+0x14 +0003FAD2 USER32.dll!GetMessageW+0x22 +00348B42 Far.exe! (get the pdb) +0034943B Far.exe! (get the pdb) +0036A556 Far.exe! (get the pdb) +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +00008D9C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000001004 RBX = 0000001C874FEB30 RCX = 0000001C874FEB30 RDX = 0000000000000000 RSI = 000001F90417FDB0 RDI = 00007FF6E2612FC8 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 0000001C874FEB30 R11 = 0000001C874FEB30 R12 = 00007FF6E221A5A0 R13 = 0000000000000000 R14 = 0000001C870FE9B0 R15 = 00007FF6E2613290 RIP = 00007FFC6E831324 RSP = 0000001C874FE9D8 RBP = 0000001C874FEB40 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00001324 win32u.dll!NtUserGetMessage+0x14: 00007ffc`6e831304 c3 ret 00007ffc`6e831305 cd2e int 2Eh 00007ffc`6e831307 c3 ret 00007ffc`6e831308 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserGetMessage: 00007ffc`6e831310 4c8bd1 mov r10,rcx 00007ffc`6e831313 b804100000 mov eax,1004h 00007ffc`6e831318 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`6e831320 7503 jne win32u!NtUserGetMessage+0x15 (00007ffc`6e831325) 00007ffc`6e831322 0f05 syscall 00007ffc`6e831324 c3 ret +0003FAD2 USER32.dll!GetMessageW+0x22: USER32!GetMessageW: 00007ffc`6f89fab0 4053 push rbx 00007ffc`6f89fab2 4883ec50 sub rsp,50h 00007ffc`6f89fab6 418bc0 mov eax,r8d 00007ffc`6f89fab9 488bd9 mov rbx,rcx 00007ffc`6f89fabc 410bc1 or eax,r9d 00007ffc`6f89fabf a90000feff test eax,0FFFE0000h 00007ffc`6f89fac4 753b jne USER32!GetMessageW+0x51 (00007ffc`6f89fb01) 00007ffc`6f89fac6 48897c2460 mov qword ptr [rsp+60h],rdi 00007ffc`6f89facb 48ff159eb40600 call qword ptr [USER32!gapfnScSendMessage+0x1b30 (00007ffc`6f90af70)] 00007ffc`6f89fad2 0f1f440000 nop dword ptr [rax+rax] +00348B42 Far.exe! (get the pdb): 00007ff6`e2558b1a 488bce mov rcx,rsi 00007ff6`e2558b1d e88ed8dbff call Far+0x1063b0 (00007ff6`e23163b0) 00007ff6`e2558b22 84c0 test al,al 00007ff6`e2558b24 0f85b6010000 jne Far+0x348ce0 (00007ff6`e2558ce0) 00007ff6`e2558b2a 660f1f440000 nop word ptr [rax+rax] 00007ff6`e2558b30 4533c9 xor r9d,r9d 00007ff6`e2558b33 4533c0 xor r8d,r8d 00007ff6`e2558b36 33d2 xor edx,edx 00007ff6`e2558b38 488d4df0 lea rcx,[rbp-10h] 00007ff6`e2558b3c ff156eef0600 call qword ptr [Far+0x3b7ab0 (00007ff6`e25c7ab0)] 00007ff6`e2558b42 85c0 test eax,eax +0034943B Far.exe! (get the pdb): 00007ff6`e255941e 5e pop rsi 00007ff6`e255941f c3 ret 00007ff6`e2559420 4053 push rbx 00007ff6`e2559422 4883ec20 sub rsp,20h 00007ff6`e2559426 488bd9 mov rbx,rcx 00007ff6`e2559429 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`e255942e 488b01 mov rax,qword ptr [rcx] 00007ff6`e2559431 488b5108 mov rdx,qword ptr [rcx+8] 00007ff6`e2559435 488b4910 mov rcx,qword ptr [rcx+10h] 00007ff6`e2559439 ffd0 call rax 00007ff6`e255943b 90 nop +0036A556 Far.exe! (get the pdb): 00007ff6`e257a52d 7510 jne Far+0x36a53f (00007ff6`e257a53f) 00007ff6`e257a52f 8d48ff lea ecx,[rax-1] 00007ff6`e257a532 e8f1230100 call Far+0x37c928 (00007ff6`e258c928) 00007ff6`e257a537 85c0 test eax,eax 00007ff6`e257a539 0f94c0 sete al 00007ff6`e257a53c 884320 mov byte ptr [rbx+20h],al 00007ff6`e257a53f 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`e257a549 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`e257a54d 488b03 mov rax,qword ptr [rbx] 00007ff6`e257a550 ff1522d90400 call qword ptr [Far+0x3b7e78 (00007ff6`e25c7e78)] 00007ff6`e257a556 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`6f55e8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`6f55e8c0 4053 push rbx 00007ffc`6f55e8c2 4883ec20 sub rsp,20h 00007ffc`6f55e8c6 33db xor ebx,ebx 00007ffc`6f55e8c8 85c9 test ecx,ecx 00007ffc`6f55e8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`6f55e8e6) 00007ffc`6f55e8cc 498bc8 mov rcx,r8 00007ffc`6f55e8cf 488bc2 mov rax,rdx 00007ffc`6f55e8d2 e839770500 call KERNEL32!TlsGetValue+0x1b80 (00007ffc`6f5b6010) 00007ffc`6f55e8d7 8bc8 mov ecx,eax +00008D9C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`716a8d77 488b0582ba1c00 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x4100 (00007ffc`71874800)] 00007ffc`716a8d7e 4885c0 test rax,rax 00007ffc`716a8d81 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`716a8da7) 00007ffc`716a8d83 488d0d76320700 lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7171c000)] 00007ffc`716a8d8a 4c8bc2 mov r8,rdx 00007ffc`716a8d8d 498bd1 mov rdx,r9 00007ffc`716a8d90 483bc1 cmp rax,rcx 00007ffc`716a8d93 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`716a8d9e) 00007ffc`716a8d95 33c9 xor ecx,ecx 00007ffc`716a8d97 e884b21600 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`71814020) 00007ffc`716a8d9c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`716a8dc6) ====================================================================== Thread 21292 / 0x532C (FS watcher) ====================================================================== LastError: 0x000003FE - Запрос на уведомление об изменениях завершается, но данные не были возвращены в буфер вызывающей процедуры. Теперь эта процедура нуждается в перечислении файлов для поиска изменений. NTSTATUS: 0x0000010C - Запрос на уведомление об изменении завершается, но сведения не возвращаются в буфер вызвавшей процедуры. Для обнаружения изменений теперь необходимо произвести перечисление списка файлов. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00163D84 ntdll.dll!ZwWaitForMultipleObjects+0x14 +0001F233 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123 +0001F101 KERNELBASE.dll!WaitForMultipleObjects+0x11 +00257563 Far.exe! (get the pdb) +00193665 Far.exe! (get the pdb) +00194F74 Far.exe! (get the pdb) +0036A556 Far.exe! (get the pdb) +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +00008D9C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000003 RCX = 0000000000000003 RDX = 000001F904AC07E0 RSI = 0000000000000000 RDI = 0000000000000003 R8 = 0000000000000001 R9 = 0000000000000000 R10 = 0000000000000003 R11 = 0000000000000003 R12 = 000001F904AC07E0 R13 = 0000001C86F1F000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFC71803D84 RSP = 0000001C875FF188 RBP = 0000001C875FF6D0 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00163D84 ntdll.dll!ZwWaitForMultipleObjects+0x14: 00007ffc`71803d62 ae scas byte ptr [rdi] 00007ffc`71803d63 f8 clc 00007ffc`71803d64 ff6666 jmp qword ptr [rsi+66h] 00007ffc`71803d67 660f1f840000000000 nop word ptr [rax+rax] ntdll!ZwWaitForMultipleObjects: 00007ffc`71803d70 4c8bd1 mov r10,rcx 00007ffc`71803d73 b85b000000 mov eax,5Bh 00007ffc`71803d78 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`71803d80 7503 jne ntdll!ZwWaitForMultipleObjects+0x15 (00007ffc`71803d85) 00007ffc`71803d82 0f05 syscall 00007ffc`71803d84 c3 ret +0001F233 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123: 00007ffc`6efcf20a 488d742440 lea rsi,[rsp+40h] 00007ffc`6efcf20f 448b7c2438 mov r15d,dword ptr [rsp+38h] 00007ffc`6efcf214 4533c0 xor r8d,r8d 00007ffc`6efcf217 4585ff test r15d,r15d 00007ffc`6efcf21a 410f94c0 sete r8b 00007ffc`6efcf21e 4889742420 mov qword ptr [rsp+20h],rsi 00007ffc`6efcf223 450fb6ce movzx r9d,r14b 00007ffc`6efcf227 498bd4 mov rdx,r12 00007ffc`6efcf22a 8bcb mov ecx,ebx 00007ffc`6efcf22c 48ff15a5792700 call qword ptr [KERNELBASE!TlsGetValue+0xfdad8 (00007ffc`6f246bd8)] 00007ffc`6efcf233 0f1f440000 nop dword ptr [rax+rax] +0001F101 KERNELBASE.dll!WaitForMultipleObjects+0x11: 00007ffc`6efcf0ea cc int 3 00007ffc`6efcf0eb cc int 3 00007ffc`6efcf0ec cc int 3 00007ffc`6efcf0ed cc int 3 00007ffc`6efcf0ee cc int 3 00007ffc`6efcf0ef cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffc`6efcf0f0 4883ec38 sub rsp,38h 00007ffc`6efcf0f4 c744242000000000 mov dword ptr [rsp+20h],0 00007ffc`6efcf0fc e80f000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffc`6efcf110) 00007ffc`6efcf101 4883c438 add rsp,38h +00257563 Far.exe! (get the pdb): 00007ff6`e2467532 4881ec00010000 sub rsp,100h 00007ff6`e2467539 488b05002d2100 mov rax,qword ptr [Far+0x46a240 (00007ff6`e267a240)] 00007ff6`e2467540 4833c4 xor rax,rsp 00007ff6`e2467543 48898424f0000000 mov qword ptr [rsp+0F0h],rax 00007ff6`e246754b 488b5908 mov rbx,qword ptr [rcx+8] 00007ff6`e246754f 41b9ffffffff mov r9d,0FFFFFFFFh 00007ff6`e2467555 4533c0 xor r8d,r8d 00007ff6`e2467558 488b11 mov rdx,qword ptr [rcx] 00007ff6`e246755b 8bcb mov ecx,ebx 00007ff6`e246755d ff15d5fd1500 call qword ptr [Far+0x3b7338 (00007ff6`e25c7338)] 00007ff6`e2467563 8bc8 mov ecx,eax +00193665 Far.exe! (get the pdb): 00007ff6`e23a363a 488b4c2438 mov rcx,qword ptr [rsp+38h] 00007ff6`e23a363f 488b442430 mov rax,qword ptr [rsp+30h] 00007ff6`e23a3644 482bc8 sub rcx,rax 00007ff6`e23a3647 48c1f903 sar rcx,3 00007ff6`e23a364b 488945c0 mov qword ptr [rbp-40h],rax 00007ff6`e23a364f 48894dc8 mov qword ptr [rbp-38h],rcx 00007ff6`e23a3653 0f2845c0 movaps xmm0,xmmword ptr [rbp-40h] 00007ff6`e23a3657 660f7f4580 movdqa xmmword ptr [rbp-80h],xmm0 00007ff6`e23a365c 488d4d80 lea rcx,[rbp-80h] 00007ff6`e23a3660 e8cb3e0c00 call Far+0x257530 (00007ff6`e2467530) 00007ff6`e23a3665 4c8bf8 mov r15,rax +00194F74 Far.exe! (get the pdb): 00007ff6`e23a4f59 4883c430 add rsp,30h 00007ff6`e23a4f5d 5b pop rbx 00007ff6`e23a4f5e c3 ret 00007ff6`e23a4f5f cc int 3 00007ff6`e23a4f60 4053 push rbx 00007ff6`e23a4f62 4883ec20 sub rsp,20h 00007ff6`e23a4f66 488bd9 mov rbx,rcx 00007ff6`e23a4f69 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`e23a4f6e 488b4908 mov rcx,qword ptr [rcx+8] 00007ff6`e23a4f72 ff13 call qword ptr [rbx] 00007ff6`e23a4f74 90 nop +0036A556 Far.exe! (get the pdb): 00007ff6`e257a52d 7510 jne Far+0x36a53f (00007ff6`e257a53f) 00007ff6`e257a52f 8d48ff lea ecx,[rax-1] 00007ff6`e257a532 e8f1230100 call Far+0x37c928 (00007ff6`e258c928) 00007ff6`e257a537 85c0 test eax,eax 00007ff6`e257a539 0f94c0 sete al 00007ff6`e257a53c 884320 mov byte ptr [rbx+20h],al 00007ff6`e257a53f 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`e257a549 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`e257a54d 488b03 mov rax,qword ptr [rbx] 00007ff6`e257a550 ff1522d90400 call qword ptr [Far+0x3b7e78 (00007ff6`e25c7e78)] 00007ff6`e257a556 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`6f55e8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`6f55e8c0 4053 push rbx 00007ffc`6f55e8c2 4883ec20 sub rsp,20h 00007ffc`6f55e8c6 33db xor ebx,ebx 00007ffc`6f55e8c8 85c9 test ecx,ecx 00007ffc`6f55e8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`6f55e8e6) 00007ffc`6f55e8cc 498bc8 mov rcx,r8 00007ffc`6f55e8cf 488bc2 mov rax,rdx 00007ffc`6f55e8d2 e839770500 call KERNEL32!TlsGetValue+0x1b80 (00007ffc`6f5b6010) 00007ffc`6f55e8d7 8bc8 mov ecx,eax +00008D9C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`716a8d77 488b0582ba1c00 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x4100 (00007ffc`71874800)] 00007ffc`716a8d7e 4885c0 test rax,rax 00007ffc`716a8d81 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`716a8da7) 00007ffc`716a8d83 488d0d76320700 lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7171c000)] 00007ffc`716a8d8a 4c8bc2 mov r8,rdx 00007ffc`716a8d8d 498bd1 mov rdx,r9 00007ffc`716a8d90 483bc1 cmp rax,rcx 00007ffc`716a8d93 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`716a8d9e) 00007ffc`716a8d95 33c9 xor ecx,ecx 00007ffc`716a8d97 e884b21600 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`71814020) 00007ffc`716a8d9c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`716a8dc6) ====================================================================== Thread 16052 / 0x3EB4 (Taskbar processor) ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC0000034 - Объект с указанным именем не найден. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00163D84 ntdll.dll!ZwWaitForMultipleObjects+0x14 +0001F233 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123 +0001F101 KERNELBASE.dll!WaitForMultipleObjects+0x11 +00257563 Far.exe! (get the pdb) +00312596 Far.exe! (get the pdb) +00194F74 Far.exe! (get the pdb) +0036A556 Far.exe! (get the pdb) +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +00008D9C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000003 RCX = 0000000000000003 RDX = 0000001C876FF770 RSI = 0000000000000000 RDI = 0000000000000003 R8 = 0000000000000001 R9 = 0000000000000000 R10 = 0000000000000003 R11 = 0000000000000003 R12 = 0000001C876FF770 R13 = 0000001C86F1F000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFC71803D84 RSP = 0000001C876FF2E8 RBP = 0000001C876FF7C9 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00163D84 ntdll.dll!ZwWaitForMultipleObjects+0x14: 00007ffc`71803d62 ae scas byte ptr [rdi] 00007ffc`71803d63 f8 clc 00007ffc`71803d64 ff6666 jmp qword ptr [rsi+66h] 00007ffc`71803d67 660f1f840000000000 nop word ptr [rax+rax] ntdll!ZwWaitForMultipleObjects: 00007ffc`71803d70 4c8bd1 mov r10,rcx 00007ffc`71803d73 b85b000000 mov eax,5Bh 00007ffc`71803d78 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`71803d80 7503 jne ntdll!ZwWaitForMultipleObjects+0x15 (00007ffc`71803d85) 00007ffc`71803d82 0f05 syscall 00007ffc`71803d84 c3 ret +0001F233 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123: 00007ffc`6efcf20a 488d742440 lea rsi,[rsp+40h] 00007ffc`6efcf20f 448b7c2438 mov r15d,dword ptr [rsp+38h] 00007ffc`6efcf214 4533c0 xor r8d,r8d 00007ffc`6efcf217 4585ff test r15d,r15d 00007ffc`6efcf21a 410f94c0 sete r8b 00007ffc`6efcf21e 4889742420 mov qword ptr [rsp+20h],rsi 00007ffc`6efcf223 450fb6ce movzx r9d,r14b 00007ffc`6efcf227 498bd4 mov rdx,r12 00007ffc`6efcf22a 8bcb mov ecx,ebx 00007ffc`6efcf22c 48ff15a5792700 call qword ptr [KERNELBASE!TlsGetValue+0xfdad8 (00007ffc`6f246bd8)] 00007ffc`6efcf233 0f1f440000 nop dword ptr [rax+rax] +0001F101 KERNELBASE.dll!WaitForMultipleObjects+0x11: 00007ffc`6efcf0ea cc int 3 00007ffc`6efcf0eb cc int 3 00007ffc`6efcf0ec cc int 3 00007ffc`6efcf0ed cc int 3 00007ffc`6efcf0ee cc int 3 00007ffc`6efcf0ef cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffc`6efcf0f0 4883ec38 sub rsp,38h 00007ffc`6efcf0f4 c744242000000000 mov dword ptr [rsp+20h],0 00007ffc`6efcf0fc e80f000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffc`6efcf110) 00007ffc`6efcf101 4883c438 add rsp,38h +00257563 Far.exe! (get the pdb): 00007ff6`e2467532 4881ec00010000 sub rsp,100h 00007ff6`e2467539 488b05002d2100 mov rax,qword ptr [Far+0x46a240 (00007ff6`e267a240)] 00007ff6`e2467540 4833c4 xor rax,rsp 00007ff6`e2467543 48898424f0000000 mov qword ptr [rsp+0F0h],rax 00007ff6`e246754b 488b5908 mov rbx,qword ptr [rcx+8] 00007ff6`e246754f 41b9ffffffff mov r9d,0FFFFFFFFh 00007ff6`e2467555 4533c0 xor r8d,r8d 00007ff6`e2467558 488b11 mov rdx,qword ptr [rcx] 00007ff6`e246755b 8bcb mov ecx,ebx 00007ff6`e246755d ff15d5fd1500 call qword ptr [Far+0x3b7338 (00007ff6`e25c7338)] 00007ff6`e2467563 8bc8 mov ecx,eax +00312596 Far.exe! (get the pdb): 00007ff6`e252256a 660f1f440000 nop word ptr [rax+rax] 00007ff6`e2522570 498b4718 mov rax,qword ptr [r15+18h] 00007ff6`e2522574 488945a7 mov qword ptr [rbp-59h],rax 00007ff6`e2522578 498b4720 mov rax,qword ptr [r15+20h] 00007ff6`e252257c 488945af mov qword ptr [rbp-51h],rax 00007ff6`e2522580 498b4728 mov rax,qword ptr [r15+28h] 00007ff6`e2522584 488945b7 mov qword ptr [rbp-49h],rax 00007ff6`e2522588 660f7f75c7 movdqa xmmword ptr [rbp-39h],xmm6 00007ff6`e252258d 488d4dc7 lea rcx,[rbp-39h] 00007ff6`e2522591 e89a4ff4ff call Far+0x257530 (00007ff6`e2467530) 00007ff6`e2522596 4885c0 test rax,rax +00194F74 Far.exe! (get the pdb): 00007ff6`e23a4f59 4883c430 add rsp,30h 00007ff6`e23a4f5d 5b pop rbx 00007ff6`e23a4f5e c3 ret 00007ff6`e23a4f5f cc int 3 00007ff6`e23a4f60 4053 push rbx 00007ff6`e23a4f62 4883ec20 sub rsp,20h 00007ff6`e23a4f66 488bd9 mov rbx,rcx 00007ff6`e23a4f69 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`e23a4f6e 488b4908 mov rcx,qword ptr [rcx+8] 00007ff6`e23a4f72 ff13 call qword ptr [rbx] 00007ff6`e23a4f74 90 nop +0036A556 Far.exe! (get the pdb): 00007ff6`e257a52d 7510 jne Far+0x36a53f (00007ff6`e257a53f) 00007ff6`e257a52f 8d48ff lea ecx,[rax-1] 00007ff6`e257a532 e8f1230100 call Far+0x37c928 (00007ff6`e258c928) 00007ff6`e257a537 85c0 test eax,eax 00007ff6`e257a539 0f94c0 sete al 00007ff6`e257a53c 884320 mov byte ptr [rbx+20h],al 00007ff6`e257a53f 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`e257a549 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`e257a54d 488b03 mov rax,qword ptr [rbx] 00007ff6`e257a550 ff1522d90400 call qword ptr [Far+0x3b7e78 (00007ff6`e25c7e78)] 00007ff6`e257a556 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`6f55e8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`6f55e8c0 4053 push rbx 00007ffc`6f55e8c2 4883ec20 sub rsp,20h 00007ffc`6f55e8c6 33db xor ebx,ebx 00007ffc`6f55e8c8 85c9 test ecx,ecx 00007ffc`6f55e8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`6f55e8e6) 00007ffc`6f55e8cc 498bc8 mov rcx,r8 00007ffc`6f55e8cf 488bc2 mov rax,rdx 00007ffc`6f55e8d2 e839770500 call KERNEL32!TlsGetValue+0x1b80 (00007ffc`6f5b6010) 00007ffc`6f55e8d7 8bc8 mov ecx,eax +00008D9C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`716a8d77 488b0582ba1c00 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x4100 (00007ffc`71874800)] 00007ffc`716a8d7e 4885c0 test rax,rax 00007ffc`716a8d81 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`716a8da7) 00007ffc`716a8d83 488d0d76320700 lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7171c000)] 00007ffc`716a8d8a 4c8bc2 mov r8,rdx 00007ffc`716a8d8d 498bd1 mov rdx,r9 00007ffc`716a8d90 483bc1 cmp rax,rcx 00007ffc`716a8d93 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`716a8d9e) 00007ffc`716a8d95 33c9 xor ecx,ecx 00007ffc`716a8d97 e884b21600 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`71814020) 00007ffc`716a8d9c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`716a8dc6) ====================================================================== Thread 17696 / 0x4520 ====================================================================== LastError: 0x000003F0 - Попытка ссылки на несуществующий токен. NTSTATUS: 0xC000007C - Попытка ссылки на несуществующий токен. Как правило, это происходит при ссылке на токен, связанный с потоком команд, не олицетворяющим клиента. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00001324 win32u.dll!NtUserGetMessage+0x14 +0003FAD2 USER32.dll!GetMessageW+0x22 +0012BB5E combase.dll!CoGetMarshalSizeMax+0x71E +000A388F combase.dll!CoDisconnectObject+0x74F +0012CE91 combase.dll!RoParameterizedTypeExtraGetTypeSignature+0x231 +0012CD49 combase.dll!RoParameterizedTypeExtraGetTypeSignature+0xE9 +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +00008D9C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000001004 RBX = 0000001C87AFFDF0 RCX = 0000001C87AFFDF0 RDX = 0000000000000000 RSI = 00000000006607F8 RDI = 00007FFC7147D890 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 0000001C87AFFDF0 R11 = 0000001C87AFFDF0 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000001 RIP = 00007FFC6E831324 RSP = 0000001C87AFFD58 RBP = 0000000000001000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00001324 win32u.dll!NtUserGetMessage+0x14: 00007ffc`6e831304 c3 ret 00007ffc`6e831305 cd2e int 2Eh 00007ffc`6e831307 c3 ret 00007ffc`6e831308 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserGetMessage: 00007ffc`6e831310 4c8bd1 mov r10,rcx 00007ffc`6e831313 b804100000 mov eax,1004h 00007ffc`6e831318 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`6e831320 7503 jne win32u!NtUserGetMessage+0x15 (00007ffc`6e831325) 00007ffc`6e831322 0f05 syscall 00007ffc`6e831324 c3 ret +0003FAD2 USER32.dll!GetMessageW+0x22: USER32!GetMessageW: 00007ffc`6f89fab0 4053 push rbx 00007ffc`6f89fab2 4883ec50 sub rsp,50h 00007ffc`6f89fab6 418bc0 mov eax,r8d 00007ffc`6f89fab9 488bd9 mov rbx,rcx 00007ffc`6f89fabc 410bc1 or eax,r9d 00007ffc`6f89fabf a90000feff test eax,0FFFE0000h 00007ffc`6f89fac4 753b jne USER32!GetMessageW+0x51 (00007ffc`6f89fb01) 00007ffc`6f89fac6 48897c2460 mov qword ptr [rsp+60h],rdi 00007ffc`6f89facb 48ff159eb40600 call qword ptr [USER32!gapfnScSendMessage+0x1b30 (00007ffc`6f90af70)] 00007ffc`6f89fad2 0f1f440000 nop dword ptr [rax+rax] +0012BB5E combase.dll!CoGetMarshalSizeMax+0x71E: 00007ffc`7127bb31 0f57c0 xorps xmm0,xmm0 00007ffc`7127bb34 488905bd2c2000 mov qword ptr [combase!Ordinal183+0x5dc20 (00007ffc`7147e7f8)],rax 00007ffc`7127bb3b 0f11442430 movups xmmword ptr [rsp+30h],xmm0 00007ffc`7127bb40 0f11442440 movups xmmword ptr [rsp+40h],xmm0 00007ffc`7127bb45 0f11442450 movups xmmword ptr [rsp+50h],xmm0 00007ffc`7127bb4a 4533c9 xor r9d,r9d 00007ffc`7127bb4d 488d4c2430 lea rcx,[rsp+30h] 00007ffc`7127bb52 4533c0 xor r8d,r8d 00007ffc`7127bb55 33d2 xor edx,edx 00007ffc`7127bb57 48ff158ada2200 call qword ptr [combase!Ordinal183+0x88a10 (00007ffc`714a95e8)] 00007ffc`7127bb5e 0f1f440000 nop dword ptr [rax+rax] +000A388F combase.dll!CoDisconnectObject+0x74F: 00007ffc`711f3867 894758 mov dword ptr [rdi+58h],eax 00007ffc`711f386a 48ff155f7f2000 call qword ptr [combase!ObjectStublessClient32+0x6c120 (00007ffc`713fb7d0)] 00007ffc`711f3871 0f1f440000 nop dword ptr [rax+rax] 00007ffc`711f3876 8b4730 mov eax,dword ptr [rdi+30h] 00007ffc`711f3879 83e01f and eax,1Fh 00007ffc`711f387c 83e801 sub eax,1 00007ffc`711f387f 7409 je combase!CoDisconnectObject+0x74a (00007ffc`711f388a) 00007ffc`711f3881 83f801 cmp eax,1 00007ffc`711f3884 0f8573ffffff jne combase!CoDisconnectObject+0x6bd (00007ffc`711f37fd) 00007ffc`711f388a e859820800 call combase!CoGetMarshalSizeMax+0x6a8 (00007ffc`7127bae8) 00007ffc`711f388f e969ffffff jmp combase!CoDisconnectObject+0x6bd (00007ffc`711f37fd) +0012CE91 combase.dll!RoParameterizedTypeExtraGetTypeSignature+0x231: 00007ffc`7127ce5e 0f8533010000 jne combase!RoParameterizedTypeExtraGetTypeSignature+0x337 (00007ffc`7127cf97) 00007ffc`7127ce64 458d7e01 lea r15d,[r14+1] 00007ffc`7127ce68 65488b042530000000 mov rax,qword ptr gs:[30h] 00007ffc`7127ce71 488b8058170000 mov rax,qword ptr [rax+1758h] 00007ffc`7127ce78 4885c0 test rax,rax 00007ffc`7127ce7b 7407 je combase!RoParameterizedTypeExtraGetTypeSignature+0x224 (00007ffc`7127ce84) 00007ffc`7127ce7d 4489b038010000 mov dword ptr [rax+138h],r14d 00007ffc`7127ce84 488b4b18 mov rcx,qword ptr [rbx+18h] 00007ffc`7127ce88 488b4310 mov rax,qword ptr [rbx+10h] 00007ffc`7127ce8c e87fa11300 call combase!ObjectStublessClient32+0x27960 (00007ffc`713b7010) 00007ffc`7127ce91 48ff1520e61700 call qword ptr [combase!ObjectStublessClient32+0x6be08 (00007ffc`713fb4b8)] +0012CD49 combase.dll!RoParameterizedTypeExtraGetTypeSignature+0xE9: 00007ffc`7127cd20 48895c2408 mov qword ptr [rsp+8],rbx 00007ffc`7127cd25 57 push rdi 00007ffc`7127cd26 4883ec20 sub rsp,20h 00007ffc`7127cd2a 488bf9 mov rdi,rcx 00007ffc`7127cd2d 48ff15bce71700 call qword ptr [combase!ObjectStublessClient32+0x6be40 (00007ffc`713fb4f0)] 00007ffc`7127cd34 0f1f440000 nop dword ptr [rax+rax] 00007ffc`7127cd39 894728 mov dword ptr [rdi+28h],eax 00007ffc`7127cd3c e833000000 call combase!RoParameterizedTypeExtraGetTypeSignature+0x114 (00007ffc`7127cd74) 00007ffc`7127cd41 488bcf mov rcx,rdi 00007ffc`7127cd44 e8fb000000 call combase!RoParameterizedTypeExtraGetTypeSignature+0x1e4 (00007ffc`7127ce44) 00007ffc`7127cd49 488b5f30 mov rbx,qword ptr [rdi+30h] +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`6f55e8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`6f55e8c0 4053 push rbx 00007ffc`6f55e8c2 4883ec20 sub rsp,20h 00007ffc`6f55e8c6 33db xor ebx,ebx 00007ffc`6f55e8c8 85c9 test ecx,ecx 00007ffc`6f55e8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`6f55e8e6) 00007ffc`6f55e8cc 498bc8 mov rcx,r8 00007ffc`6f55e8cf 488bc2 mov rax,rdx 00007ffc`6f55e8d2 e839770500 call KERNEL32!TlsGetValue+0x1b80 (00007ffc`6f5b6010) 00007ffc`6f55e8d7 8bc8 mov ecx,eax +00008D9C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`716a8d77 488b0582ba1c00 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x4100 (00007ffc`71874800)] 00007ffc`716a8d7e 4885c0 test rax,rax 00007ffc`716a8d81 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`716a8da7) 00007ffc`716a8d83 488d0d76320700 lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7171c000)] 00007ffc`716a8d8a 4c8bc2 mov r8,rdx 00007ffc`716a8d8d 498bd1 mov rdx,r9 00007ffc`716a8d90 483bc1 cmp rax,rcx 00007ffc`716a8d93 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`716a8d9e) 00007ffc`716a8d95 33c9 xor ecx,ecx 00007ffc`716a8d97 e884b21600 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`71814020) 00007ffc`716a8d9c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`716a8dc6) ====================================================================== Thread 14540 / 0x38CC (Async history config) ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00163D84 ntdll.dll!ZwWaitForMultipleObjects+0x14 +0001F233 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123 +0001F101 KERNELBASE.dll!WaitForMultipleObjects+0x11 +00257563 Far.exe! (get the pdb) +0007676D Far.exe! (get the pdb) +000828FE Far.exe! (get the pdb) +0036A556 Far.exe! (get the pdb) +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +00008D9C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000002 RCX = 0000000000000002 RDX = 0000001C87BFF968 RSI = 0000000000000000 RDI = 0000000000000002 R8 = 0000000000000001 R9 = 0000000000000000 R10 = 0000000000000002 R11 = 0000000000000002 R12 = 0000001C87BFF968 R13 = 0000001C86F1F000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFC71803D84 RSP = 0000001C87BFF498 RBP = 0000001C87BFF9E0 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00163D84 ntdll.dll!ZwWaitForMultipleObjects+0x14: 00007ffc`71803d62 ae scas byte ptr [rdi] 00007ffc`71803d63 f8 clc 00007ffc`71803d64 ff6666 jmp qword ptr [rsi+66h] 00007ffc`71803d67 660f1f840000000000 nop word ptr [rax+rax] ntdll!ZwWaitForMultipleObjects: 00007ffc`71803d70 4c8bd1 mov r10,rcx 00007ffc`71803d73 b85b000000 mov eax,5Bh 00007ffc`71803d78 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`71803d80 7503 jne ntdll!ZwWaitForMultipleObjects+0x15 (00007ffc`71803d85) 00007ffc`71803d82 0f05 syscall 00007ffc`71803d84 c3 ret +0001F233 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123: 00007ffc`6efcf20a 488d742440 lea rsi,[rsp+40h] 00007ffc`6efcf20f 448b7c2438 mov r15d,dword ptr [rsp+38h] 00007ffc`6efcf214 4533c0 xor r8d,r8d 00007ffc`6efcf217 4585ff test r15d,r15d 00007ffc`6efcf21a 410f94c0 sete r8b 00007ffc`6efcf21e 4889742420 mov qword ptr [rsp+20h],rsi 00007ffc`6efcf223 450fb6ce movzx r9d,r14b 00007ffc`6efcf227 498bd4 mov rdx,r12 00007ffc`6efcf22a 8bcb mov ecx,ebx 00007ffc`6efcf22c 48ff15a5792700 call qword ptr [KERNELBASE!TlsGetValue+0xfdad8 (00007ffc`6f246bd8)] 00007ffc`6efcf233 0f1f440000 nop dword ptr [rax+rax] +0001F101 KERNELBASE.dll!WaitForMultipleObjects+0x11: 00007ffc`6efcf0ea cc int 3 00007ffc`6efcf0eb cc int 3 00007ffc`6efcf0ec cc int 3 00007ffc`6efcf0ed cc int 3 00007ffc`6efcf0ee cc int 3 00007ffc`6efcf0ef cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffc`6efcf0f0 4883ec38 sub rsp,38h 00007ffc`6efcf0f4 c744242000000000 mov dword ptr [rsp+20h],0 00007ffc`6efcf0fc e80f000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffc`6efcf110) 00007ffc`6efcf101 4883c438 add rsp,38h +00257563 Far.exe! (get the pdb): 00007ff6`e2467532 4881ec00010000 sub rsp,100h 00007ff6`e2467539 488b05002d2100 mov rax,qword ptr [Far+0x46a240 (00007ff6`e267a240)] 00007ff6`e2467540 4833c4 xor rax,rsp 00007ff6`e2467543 48898424f0000000 mov qword ptr [rsp+0F0h],rax 00007ff6`e246754b 488b5908 mov rbx,qword ptr [rcx+8] 00007ff6`e246754f 41b9ffffffff mov r9d,0FFFFFFFFh 00007ff6`e2467555 4533c0 xor r8d,r8d 00007ff6`e2467558 488b11 mov rdx,qword ptr [rcx] 00007ff6`e246755b 8bcb mov ecx,ebx 00007ff6`e246755d ff15d5fd1500 call qword ptr [Far+0x3b7338 (00007ff6`e25c7338)] 00007ff6`e2467563 8bc8 mov ecx,eax +0007676D Far.exe! (get the pdb): 00007ff6`e228673c 48894588 mov qword ptr [rbp-78h],rax 00007ff6`e2286740 488b8788000000 mov rax,qword ptr [rdi+88h] 00007ff6`e2286747 48894590 mov qword ptr [rbp-70h],rax 00007ff6`e228674b 488d4588 lea rax,[rbp-78h] 00007ff6`e228674f 488945a0 mov qword ptr [rbp-60h],rax 00007ff6`e2286753 48c745a802000000 mov qword ptr [rbp-58h],2 00007ff6`e228675b 0f2845a0 movaps xmm0,xmmword ptr [rbp-60h] 00007ff6`e228675f 660f7f45b0 movdqa xmmword ptr [rbp-50h],xmm0 00007ff6`e2286764 488d4db0 lea rcx,[rbp-50h] 00007ff6`e2286768 e8c30d1e00 call Far+0x257530 (00007ff6`e2467530) 00007ff6`e228676d 4883f801 cmp rax,1 +000828FE Far.exe! (get the pdb): 00007ff6`e22928d9 48894c2430 mov qword ptr [rsp+30h],rcx 00007ff6`e22928de 4c8b4910 mov r9,qword ptr [rcx+10h] 00007ff6`e22928e2 4863510c movsxd rdx,dword ptr [rcx+0Ch] 00007ff6`e22928e6 498b4108 mov rax,qword ptr [r9+8] 00007ff6`e22928ea 48630c02 movsxd rcx,dword ptr [rdx+rax] 00007ff6`e22928ee 48635308 movsxd rdx,dword ptr [rbx+8] 00007ff6`e22928f2 4903c9 add rcx,r9 00007ff6`e22928f5 4883c208 add rdx,8 00007ff6`e22928f9 4803ca add rcx,rdx 00007ff6`e22928fc ff13 call qword ptr [rbx] 00007ff6`e22928fe 90 nop +0036A556 Far.exe! (get the pdb): 00007ff6`e257a52d 7510 jne Far+0x36a53f (00007ff6`e257a53f) 00007ff6`e257a52f 8d48ff lea ecx,[rax-1] 00007ff6`e257a532 e8f1230100 call Far+0x37c928 (00007ff6`e258c928) 00007ff6`e257a537 85c0 test eax,eax 00007ff6`e257a539 0f94c0 sete al 00007ff6`e257a53c 884320 mov byte ptr [rbx+20h],al 00007ff6`e257a53f 49ba7028d1325b2e0c9e mov r10,9E0C2E5B32D12870h 00007ff6`e257a549 488b4b08 mov rcx,qword ptr [rbx+8] 00007ff6`e257a54d 488b03 mov rax,qword ptr [rbx] 00007ff6`e257a550 ff1522d90400 call qword ptr [Far+0x3b7e78 (00007ff6`e25c7e78)] 00007ff6`e257a556 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`6f55e8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`6f55e8c0 4053 push rbx 00007ffc`6f55e8c2 4883ec20 sub rsp,20h 00007ffc`6f55e8c6 33db xor ebx,ebx 00007ffc`6f55e8c8 85c9 test ecx,ecx 00007ffc`6f55e8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`6f55e8e6) 00007ffc`6f55e8cc 498bc8 mov rcx,r8 00007ffc`6f55e8cf 488bc2 mov rax,rdx 00007ffc`6f55e8d2 e839770500 call KERNEL32!TlsGetValue+0x1b80 (00007ffc`6f5b6010) 00007ffc`6f55e8d7 8bc8 mov ecx,eax +00008D9C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`716a8d77 488b0582ba1c00 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x4100 (00007ffc`71874800)] 00007ffc`716a8d7e 4885c0 test rax,rax 00007ffc`716a8d81 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`716a8da7) 00007ffc`716a8d83 488d0d76320700 lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7171c000)] 00007ffc`716a8d8a 4c8bc2 mov r8,rdx 00007ffc`716a8d8d 498bd1 mov rdx,r9 00007ffc`716a8d90 483bc1 cmp rax,rcx 00007ffc`716a8d93 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`716a8d9e) 00007ffc`716a8d95 33c9 xor ecx,ecx 00007ffc`716a8d97 e884b21600 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`71814020) 00007ffc`716a8d9c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`716a8dc6) ====================================================================== Thread 13284 / 0x33E4 (NetBox IdleThread) ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +001632B4 ntdll.dll!NtWaitForSingleObject+0x14 +0001895F KERNELBASE.dll!WaitForSingleObjectEx+0xAF +0016A166 NetBox.dll!OpenW+0x7D86 +000614D8 NetBox.dll! (get the pdb) +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +00008D9C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000000004 RBX = 0000000000000460 RCX = 0000000000000460 RDX = 0000000000000000 RSI = 00000000FFFFFFFF RDI = 0000000000000000 R8 = 0000000000000000 R9 = 0000001C86F4E000 R10 = 0000000000000460 R11 = 0000000000000460 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFC718032B4 RSP = 0000001C878FFBD8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +001632B4 ntdll.dll!NtWaitForSingleObject+0x14: 00007ffc`71803294 c3 ret 00007ffc`71803295 cd2e int 2Eh 00007ffc`71803297 c3 ret 00007ffc`71803298 0f1f840000000000 nop dword ptr [rax+rax] ntdll!NtWaitForSingleObject: 00007ffc`718032a0 4c8bd1 mov r10,rcx 00007ffc`718032a3 b804000000 mov eax,4 00007ffc`718032a8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`718032b0 7503 jne ntdll!NtWaitForSingleObject+0x15 (00007ffc`718032b5) 00007ffc`718032b2 0f05 syscall 00007ffc`718032b4 c3 ret +0001895F KERNELBASE.dll!WaitForSingleObjectEx+0xAF: 00007ffc`6efc8933 7419 je KERNELBASE!WaitForSingleObjectEx+0x9e (00007ffc`6efc894e) 00007ffc`6efc8935 4869ce10270000 imul rcx,rsi,2710h 00007ffc`6efc893c 48894c2428 mov qword ptr [rsp+28h],rcx 00007ffc`6efc8941 48f7d9 neg rcx 00007ffc`6efc8944 48894c2428 mov qword ptr [rsp+28h],rcx 00007ffc`6efc8949 4c8d742428 lea r14,[rsp+28h] 00007ffc`6efc894e 4d8bc6 mov r8,r14 00007ffc`6efc8951 400fb6d7 movzx edx,dil 00007ffc`6efc8955 488bcb mov rcx,rbx 00007ffc`6efc8958 48ff15c9d82700 call qword ptr [KERNELBASE!TlsGetValue+0xfd128 (00007ffc`6f246228)] 00007ffc`6efc895f 0f1f440000 nop dword ptr [rax+rax] +0016A166 NetBox.dll!OpenW+0x7D86: 00007ffc`3aa5a137 0f85a8000000 jne NetBox!OpenW+0x7e05 (00007ffc`3aa5a1e5) 00007ffc`3aa5a13d 48897c2430 mov qword ptr [rsp+30h],rdi 00007ffc`3aa5a142 807b3000 cmp byte ptr [rbx+30h],0 00007ffc`3aa5a146 757c jne NetBox!OpenW+0x7de4 (00007ffc`3aa5a1c4) 00007ffc`3aa5a148 0f1f840000000000 nop dword ptr [rax+rax] 00007ffc`3aa5a150 488d4b38 lea rcx,[rbx+38h] 00007ffc`3aa5a154 ff154e654600 call qword ptr [NetBox!OpenW+0x46e2c8 (00007ffc`3aec06a8)] 00007ffc`3aa5a15a 488b4b60 mov rcx,qword ptr [rbx+60h] 00007ffc`3aa5a15e 8bd6 mov edx,esi 00007ffc`3aa5a160 ff157a5f4600 call qword ptr [NetBox!OpenW+0x46dd00 (00007ffc`3aec00e0)] 00007ffc`3aa5a166 488d4b38 lea rcx,[rbx+38h] +000614D8 NetBox.dll! (get the pdb): 00007ffc`3a9514be c3 ret 00007ffc`3a9514bf cc int 3 00007ffc`3a9514c0 48894c2408 mov qword ptr [rsp+8],rcx 00007ffc`3a9514c5 53 push rbx 00007ffc`3a9514c6 4883ec20 sub rsp,20h 00007ffc`3a9514ca 488bd9 mov rbx,rcx 00007ffc`3a9514cd 4885c9 test rcx,rcx 00007ffc`3a9514d0 742f je NetBox+0x61501 (00007ffc`3a951501) 00007ffc`3a9514d2 488b01 mov rax,qword ptr [rcx] 00007ffc`3a9514d5 ff5030 call qword ptr [rax+30h] 00007ffc`3a9514d8 90 nop +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`6f55e8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`6f55e8c0 4053 push rbx 00007ffc`6f55e8c2 4883ec20 sub rsp,20h 00007ffc`6f55e8c6 33db xor ebx,ebx 00007ffc`6f55e8c8 85c9 test ecx,ecx 00007ffc`6f55e8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`6f55e8e6) 00007ffc`6f55e8cc 498bc8 mov rcx,r8 00007ffc`6f55e8cf 488bc2 mov rax,rdx 00007ffc`6f55e8d2 e839770500 call KERNEL32!TlsGetValue+0x1b80 (00007ffc`6f5b6010) 00007ffc`6f55e8d7 8bc8 mov ecx,eax +00008D9C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`716a8d77 488b0582ba1c00 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x4100 (00007ffc`71874800)] 00007ffc`716a8d7e 4885c0 test rax,rax 00007ffc`716a8d81 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`716a8da7) 00007ffc`716a8d83 488d0d76320700 lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7171c000)] 00007ffc`716a8d8a 4c8bc2 mov r8,rdx 00007ffc`716a8d8d 498bd1 mov rdx,r9 00007ffc`716a8d90 483bc1 cmp rax,rcx 00007ffc`716a8d93 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`716a8d9e) 00007ffc`716a8d95 33c9 xor ecx,ecx 00007ffc`716a8d97 e884b21600 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`71814020) 00007ffc`716a8d9c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`716a8dc6) ====================================================================== Thread 26312 / 0x66C8 ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0xC0000034 - Объект с указанным именем не найден. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00163D84 ntdll.dll!ZwWaitForMultipleObjects+0x14 +0001F233 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123 +0001F101 KERNELBASE.dll!WaitForMultipleObjects+0x11 +0000291A msiltcfg.dll!ShutdownMsi+0x6CA +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +00008D9C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000002 RCX = 0000000000000002 RDX = 0000001C879FF9F0 RSI = 0000000000000000 RDI = 0000000000000002 R8 = 0000000000000001 R9 = 0000000000000000 R10 = 0000000000000002 R11 = 0000000000000002 R12 = 0000001C879FF9F0 R13 = 0000001C86F1F000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFC71803D84 RSP = 0000001C879FF678 RBP = 0000001C879FFA10 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00163D84 ntdll.dll!ZwWaitForMultipleObjects+0x14: 00007ffc`71803d62 ae scas byte ptr [rdi] 00007ffc`71803d63 f8 clc 00007ffc`71803d64 ff6666 jmp qword ptr [rsi+66h] 00007ffc`71803d67 660f1f840000000000 nop word ptr [rax+rax] ntdll!ZwWaitForMultipleObjects: 00007ffc`71803d70 4c8bd1 mov r10,rcx 00007ffc`71803d73 b85b000000 mov eax,5Bh 00007ffc`71803d78 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`71803d80 7503 jne ntdll!ZwWaitForMultipleObjects+0x15 (00007ffc`71803d85) 00007ffc`71803d82 0f05 syscall 00007ffc`71803d84 c3 ret +0001F233 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123: 00007ffc`6efcf20a 488d742440 lea rsi,[rsp+40h] 00007ffc`6efcf20f 448b7c2438 mov r15d,dword ptr [rsp+38h] 00007ffc`6efcf214 4533c0 xor r8d,r8d 00007ffc`6efcf217 4585ff test r15d,r15d 00007ffc`6efcf21a 410f94c0 sete r8b 00007ffc`6efcf21e 4889742420 mov qword ptr [rsp+20h],rsi 00007ffc`6efcf223 450fb6ce movzx r9d,r14b 00007ffc`6efcf227 498bd4 mov rdx,r12 00007ffc`6efcf22a 8bcb mov ecx,ebx 00007ffc`6efcf22c 48ff15a5792700 call qword ptr [KERNELBASE!TlsGetValue+0xfdad8 (00007ffc`6f246bd8)] 00007ffc`6efcf233 0f1f440000 nop dword ptr [rax+rax] +0001F101 KERNELBASE.dll!WaitForMultipleObjects+0x11: 00007ffc`6efcf0ea cc int 3 00007ffc`6efcf0eb cc int 3 00007ffc`6efcf0ec cc int 3 00007ffc`6efcf0ed cc int 3 00007ffc`6efcf0ee cc int 3 00007ffc`6efcf0ef cc int 3 KERNELBASE!WaitForMultipleObjects: 00007ffc`6efcf0f0 4883ec38 sub rsp,38h 00007ffc`6efcf0f4 c744242000000000 mov dword ptr [rsp+20h],0 00007ffc`6efcf0fc e80f000000 call KERNELBASE!WaitForMultipleObjectsEx (00007ffc`6efcf110) 00007ffc`6efcf101 4883c438 add rsp,38h +0000291A msiltcfg.dll!ShutdownMsi+0x6CA: 00007ffc`681d28eb 0f85e9000000 jne msiltcfg!ShutdownMsi+0x78a (00007ffc`681d29da) 00007ffc`681d28f1 488b05304d0000 mov rax,qword ptr [msiltcfg!ShutdownMsi+0x53d8 (00007ffc`681d7628)] 00007ffc`681d28f8 488d55e0 lea rdx,[rbp-20h] 00007ffc`681d28fc 488b5df0 mov rbx,qword ptr [rbp-10h] 00007ffc`681d2900 4533c0 xor r8d,r8d 00007ffc`681d2903 4183c9ff or r9d,0FFFFFFFFh 00007ffc`681d2907 488945e0 mov qword ptr [rbp-20h],rax 00007ffc`681d290b 48895de8 mov qword ptr [rbp-18h],rbx 00007ffc`681d290f 418d4802 lea ecx,[r8+2] 00007ffc`681d2913 48ff15be290000 call qword ptr [msiltcfg!ShutdownMsi+0x3088 (00007ffc`681d52d8)] 00007ffc`681d291a 0f1f440000 nop dword ptr [rax+rax] +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`6f55e8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`6f55e8c0 4053 push rbx 00007ffc`6f55e8c2 4883ec20 sub rsp,20h 00007ffc`6f55e8c6 33db xor ebx,ebx 00007ffc`6f55e8c8 85c9 test ecx,ecx 00007ffc`6f55e8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`6f55e8e6) 00007ffc`6f55e8cc 498bc8 mov rcx,r8 00007ffc`6f55e8cf 488bc2 mov rax,rdx 00007ffc`6f55e8d2 e839770500 call KERNEL32!TlsGetValue+0x1b80 (00007ffc`6f5b6010) 00007ffc`6f55e8d7 8bc8 mov ecx,eax +00008D9C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`716a8d77 488b0582ba1c00 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x4100 (00007ffc`71874800)] 00007ffc`716a8d7e 4885c0 test rax,rax 00007ffc`716a8d81 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`716a8da7) 00007ffc`716a8d83 488d0d76320700 lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7171c000)] 00007ffc`716a8d8a 4c8bc2 mov r8,rdx 00007ffc`716a8d8d 498bd1 mov rdx,r9 00007ffc`716a8d90 483bc1 cmp rax,rcx 00007ffc`716a8d93 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`716a8d9e) 00007ffc`716a8d95 33c9 xor ecx,ecx 00007ffc`716a8d97 e884b21600 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`71814020) 00007ffc`716a8d9c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`716a8dc6) ====================================================================== Thread 29532 / 0x735C ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0x00000000 - STATUS_SUCCESS ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00166EE4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0007E02E ntdll.dll!RtlRaiseStatus+0x1C3E +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +00008D9C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001E6 RBX = 000001F904CD3930 RCX = 000000000000009C RDX = 000001F904CD35B0 RSI = 00007FFC7171CF90 RDI = 000001F904106040 R8 = 0000000000000010 R9 = 0000001C871FF908 R10 = 000000000000009C R11 = 000000000000009C R12 = 00007FFC717760D0 R13 = 0000000000000000 R14 = 000000000000FFFF R15 = 00007FFC716E2330 RIP = 00007FFC71806EE4 RSP = 0000001C871FF8A8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00166EE4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffc`71806ec4 c3 ret 00007ffc`71806ec5 cd2e int 2Eh 00007ffc`71806ec7 c3 ret 00007ffc`71806ec8 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffc`71806ed0 4c8bd1 mov r10,rcx 00007ffc`71806ed3 b8e6010000 mov eax,1E6h 00007ffc`71806ed8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`71806ee0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffc`71806ee5) 00007ffc`71806ee2 0f05 syscall 00007ffc`71806ee4 c3 ret +0007E02E ntdll.dll!RtlRaiseStatus+0x1C3E: 00007ffc`7171dff6 488b03 mov rax,qword ptr [rbx] 00007ffc`7171dff9 4889842488000000 mov qword ptr [rsp+88h],rax 00007ffc`7171e001 44896c2458 mov dword ptr [rsp+58h],r13d 00007ffc`7171e006 488d842468020000 lea rax,[rsp+268h] 00007ffc`7171e00e 4889442420 mov qword ptr [rsp+20h],rax 00007ffc`7171e013 4c8d4c2458 lea r9,[rsp+58h] 00007ffc`7171e018 448b442454 mov r8d,dword ptr [rsp+54h] 00007ffc`7171e01d 488b942488000000 mov rdx,qword ptr [rsp+88h] 00007ffc`7171e025 488b4f38 mov rcx,qword ptr [rdi+38h] 00007ffc`7171e029 e8a28e0e00 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffc`71806ed0) 00007ffc`7171e02e 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`6f55e8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`6f55e8c0 4053 push rbx 00007ffc`6f55e8c2 4883ec20 sub rsp,20h 00007ffc`6f55e8c6 33db xor ebx,ebx 00007ffc`6f55e8c8 85c9 test ecx,ecx 00007ffc`6f55e8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`6f55e8e6) 00007ffc`6f55e8cc 498bc8 mov rcx,r8 00007ffc`6f55e8cf 488bc2 mov rax,rdx 00007ffc`6f55e8d2 e839770500 call KERNEL32!TlsGetValue+0x1b80 (00007ffc`6f5b6010) 00007ffc`6f55e8d7 8bc8 mov ecx,eax +00008D9C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`716a8d77 488b0582ba1c00 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x4100 (00007ffc`71874800)] 00007ffc`716a8d7e 4885c0 test rax,rax 00007ffc`716a8d81 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`716a8da7) 00007ffc`716a8d83 488d0d76320700 lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7171c000)] 00007ffc`716a8d8a 4c8bc2 mov r8,rdx 00007ffc`716a8d8d 498bd1 mov rdx,r9 00007ffc`716a8d90 483bc1 cmp rax,rcx 00007ffc`716a8d93 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`716a8d9e) 00007ffc`716a8d95 33c9 xor ecx,ecx 00007ffc`716a8d97 e884b21600 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`71814020) 00007ffc`716a8d9c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`716a8dc6) ====================================================================== Thread 6552 / 0x1998 ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0x00000000 - STATUS_SUCCESS ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00166EE4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0007E02E ntdll.dll!RtlRaiseStatus+0x1C3E +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +00008D9C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001E6 RBX = 000001F904CD3210 RCX = 000000000000009C RDX = 000001F904CD2E90 RSI = 00007FFC7171CF90 RDI = 000001F904106040 R8 = 0000000000000010 R9 = 0000001C872FF758 R10 = 000000000000009C R11 = 000000000000009C R12 = 00007FFC717760D0 R13 = 0000000000000000 R14 = 000000000000FFFF R15 = 00007FFC716E2330 RIP = 00007FFC71806EE4 RSP = 0000001C872FF6F8 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00166EE4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffc`71806ec4 c3 ret 00007ffc`71806ec5 cd2e int 2Eh 00007ffc`71806ec7 c3 ret 00007ffc`71806ec8 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffc`71806ed0 4c8bd1 mov r10,rcx 00007ffc`71806ed3 b8e6010000 mov eax,1E6h 00007ffc`71806ed8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`71806ee0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffc`71806ee5) 00007ffc`71806ee2 0f05 syscall 00007ffc`71806ee4 c3 ret +0007E02E ntdll.dll!RtlRaiseStatus+0x1C3E: 00007ffc`7171dff6 488b03 mov rax,qword ptr [rbx] 00007ffc`7171dff9 4889842488000000 mov qword ptr [rsp+88h],rax 00007ffc`7171e001 44896c2458 mov dword ptr [rsp+58h],r13d 00007ffc`7171e006 488d842468020000 lea rax,[rsp+268h] 00007ffc`7171e00e 4889442420 mov qword ptr [rsp+20h],rax 00007ffc`7171e013 4c8d4c2458 lea r9,[rsp+58h] 00007ffc`7171e018 448b442454 mov r8d,dword ptr [rsp+54h] 00007ffc`7171e01d 488b942488000000 mov rdx,qword ptr [rsp+88h] 00007ffc`7171e025 488b4f38 mov rcx,qword ptr [rdi+38h] 00007ffc`7171e029 e8a28e0e00 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffc`71806ed0) 00007ffc`7171e02e 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`6f55e8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`6f55e8c0 4053 push rbx 00007ffc`6f55e8c2 4883ec20 sub rsp,20h 00007ffc`6f55e8c6 33db xor ebx,ebx 00007ffc`6f55e8c8 85c9 test ecx,ecx 00007ffc`6f55e8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`6f55e8e6) 00007ffc`6f55e8cc 498bc8 mov rcx,r8 00007ffc`6f55e8cf 488bc2 mov rax,rdx 00007ffc`6f55e8d2 e839770500 call KERNEL32!TlsGetValue+0x1b80 (00007ffc`6f5b6010) 00007ffc`6f55e8d7 8bc8 mov ecx,eax +00008D9C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`716a8d77 488b0582ba1c00 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x4100 (00007ffc`71874800)] 00007ffc`716a8d7e 4885c0 test rax,rax 00007ffc`716a8d81 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`716a8da7) 00007ffc`716a8d83 488d0d76320700 lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7171c000)] 00007ffc`716a8d8a 4c8bc2 mov r8,rdx 00007ffc`716a8d8d 498bd1 mov rdx,r9 00007ffc`716a8d90 483bc1 cmp rax,rcx 00007ffc`716a8d93 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`716a8d9e) 00007ffc`716a8d95 33c9 xor ecx,ecx 00007ffc`716a8d97 e884b21600 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`71814020) 00007ffc`716a8d9c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`716a8dc6) ====================================================================== Thread 27664 / 0x6C10 ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0x00000000 - STATUS_SUCCESS ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00166EE4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0007E02E ntdll.dll!RtlRaiseStatus+0x1C3E +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +00008D9C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001E6 RBX = 000001F904CD23D0 RCX = 000000000000009C RDX = 000001F904CD2050 RSI = 00007FFC7171CF90 RDI = 000001F904106040 R8 = 0000000000000010 R9 = 0000001C873FF7F8 R10 = 000000000000009C R11 = 000000000000009C R12 = 00007FFC717760D0 R13 = 0000000000000000 R14 = 000000000000FFFF R15 = 00007FFC716E2330 RIP = 00007FFC71806EE4 RSP = 0000001C873FF798 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00166EE4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffc`71806ec4 c3 ret 00007ffc`71806ec5 cd2e int 2Eh 00007ffc`71806ec7 c3 ret 00007ffc`71806ec8 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffc`71806ed0 4c8bd1 mov r10,rcx 00007ffc`71806ed3 b8e6010000 mov eax,1E6h 00007ffc`71806ed8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`71806ee0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffc`71806ee5) 00007ffc`71806ee2 0f05 syscall 00007ffc`71806ee4 c3 ret +0007E02E ntdll.dll!RtlRaiseStatus+0x1C3E: 00007ffc`7171dff6 488b03 mov rax,qword ptr [rbx] 00007ffc`7171dff9 4889842488000000 mov qword ptr [rsp+88h],rax 00007ffc`7171e001 44896c2458 mov dword ptr [rsp+58h],r13d 00007ffc`7171e006 488d842468020000 lea rax,[rsp+268h] 00007ffc`7171e00e 4889442420 mov qword ptr [rsp+20h],rax 00007ffc`7171e013 4c8d4c2458 lea r9,[rsp+58h] 00007ffc`7171e018 448b442454 mov r8d,dword ptr [rsp+54h] 00007ffc`7171e01d 488b942488000000 mov rdx,qword ptr [rsp+88h] 00007ffc`7171e025 488b4f38 mov rcx,qword ptr [rdi+38h] 00007ffc`7171e029 e8a28e0e00 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffc`71806ed0) 00007ffc`7171e02e 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`6f55e8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`6f55e8c0 4053 push rbx 00007ffc`6f55e8c2 4883ec20 sub rsp,20h 00007ffc`6f55e8c6 33db xor ebx,ebx 00007ffc`6f55e8c8 85c9 test ecx,ecx 00007ffc`6f55e8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`6f55e8e6) 00007ffc`6f55e8cc 498bc8 mov rcx,r8 00007ffc`6f55e8cf 488bc2 mov rax,rdx 00007ffc`6f55e8d2 e839770500 call KERNEL32!TlsGetValue+0x1b80 (00007ffc`6f5b6010) 00007ffc`6f55e8d7 8bc8 mov ecx,eax +00008D9C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`716a8d77 488b0582ba1c00 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x4100 (00007ffc`71874800)] 00007ffc`716a8d7e 4885c0 test rax,rax 00007ffc`716a8d81 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`716a8da7) 00007ffc`716a8d83 488d0d76320700 lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7171c000)] 00007ffc`716a8d8a 4c8bc2 mov r8,rdx 00007ffc`716a8d8d 498bd1 mov rdx,r9 00007ffc`716a8d90 483bc1 cmp rax,rcx 00007ffc`716a8d93 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`716a8d9e) 00007ffc`716a8d95 33c9 xor ecx,ecx 00007ffc`716a8d97 e884b21600 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`71814020) 00007ffc`716a8d9c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`716a8dc6) ====================================================================== Thread 16048 / 0x3EB0 ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00001324 win32u.dll!NtUserGetMessage+0x14 +0003FAD2 USER32.dll!GetMessageW+0x22 +001179A4 dbgeng.DLL! (get the pdb) ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 0000000000001004 RBX = 0000001C877FF888 RCX = 0000001C877FF888 RDX = 0000000000000000 RSI = 0000000000000000 RDI = 0000000000000000 R8 = 0000000000000000 R9 = 0000000000000000 R10 = 0000001C877FF888 R11 = 0000001C877FF888 R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFC6E831324 RSP = 0000001C877FF7F8 RBP = 0000001C877FF8C0 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00001324 win32u.dll!NtUserGetMessage+0x14: 00007ffc`6e831304 c3 ret 00007ffc`6e831305 cd2e int 2Eh 00007ffc`6e831307 c3 ret 00007ffc`6e831308 0f1f840000000000 nop dword ptr [rax+rax] win32u!NtUserGetMessage: 00007ffc`6e831310 4c8bd1 mov r10,rcx 00007ffc`6e831313 b804100000 mov eax,1004h 00007ffc`6e831318 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`6e831320 7503 jne win32u!NtUserGetMessage+0x15 (00007ffc`6e831325) 00007ffc`6e831322 0f05 syscall 00007ffc`6e831324 c3 ret +0003FAD2 USER32.dll!GetMessageW+0x22: USER32!GetMessageW: 00007ffc`6f89fab0 4053 push rbx 00007ffc`6f89fab2 4883ec50 sub rsp,50h 00007ffc`6f89fab6 418bc0 mov eax,r8d 00007ffc`6f89fab9 488bd9 mov rbx,rcx 00007ffc`6f89fabc 410bc1 or eax,r9d 00007ffc`6f89fabf a90000feff test eax,0FFFE0000h 00007ffc`6f89fac4 753b jne USER32!GetMessageW+0x51 (00007ffc`6f89fb01) 00007ffc`6f89fac6 48897c2460 mov qword ptr [rsp+60h],rdi 00007ffc`6f89facb 48ff159eb40600 call qword ptr [USER32!gapfnScSendMessage+0x1b30 (00007ffc`6f90af70)] 00007ffc`6f89fad2 0f1f440000 nop dword ptr [rax+rax] +001179A4 dbgeng.DLL! (get the pdb): 00007ffc`2547797e 19f6 sbb esi,esi 00007ffc`25477980 ff488b dec dword ptr [rax-75h] 00007ffc`25477983 4dd848ff fmul dword ptr [r8-1] 00007ffc`25477987 15a4353c00 adc eax,3C35A4h 00007ffc`2547798c 0f1f440000 nop dword ptr [rax+rax] 00007ffc`25477991 4533c9 xor r9d,r9d 00007ffc`25477994 4533c0 xor r8d,r8d 00007ffc`25477997 33d2 xor edx,edx 00007ffc`25477999 488d4dc8 lea rcx,[rbp-38h] 00007ffc`2547799d 48ff156c765d00 call qword ptr [dbgeng!Ordinal453+0x3939d0 (00007ffc`25a4f010)] 00007ffc`254779a4 0f1f440000 nop dword ptr [rax+rax] ====================================================================== Thread 27216 / 0x6A50 ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00166EE4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0007E02E ntdll.dll!RtlRaiseStatus+0x1C3E +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +00008D9C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001E6 RBX = 0000000000000000 RCX = 00000000000008C8 RDX = 000001F904CD3220 RSI = 00007FFC7171CF90 RDI = 000001F9082D8070 R8 = 0000000000000010 R9 = 0000001C87CFF9C8 R10 = 00000000000008C8 R11 = 00000000000008C8 R12 = 00007FFC717760D0 R13 = 0000000000000000 R14 = 000000000000FFFF R15 = 00007FFC716E2330 RIP = 00007FFC71806EE4 RSP = 0000001C87CFF968 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00166EE4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffc`71806ec4 c3 ret 00007ffc`71806ec5 cd2e int 2Eh 00007ffc`71806ec7 c3 ret 00007ffc`71806ec8 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffc`71806ed0 4c8bd1 mov r10,rcx 00007ffc`71806ed3 b8e6010000 mov eax,1E6h 00007ffc`71806ed8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`71806ee0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffc`71806ee5) 00007ffc`71806ee2 0f05 syscall 00007ffc`71806ee4 c3 ret +0007E02E ntdll.dll!RtlRaiseStatus+0x1C3E: 00007ffc`7171dff6 488b03 mov rax,qword ptr [rbx] 00007ffc`7171dff9 4889842488000000 mov qword ptr [rsp+88h],rax 00007ffc`7171e001 44896c2458 mov dword ptr [rsp+58h],r13d 00007ffc`7171e006 488d842468020000 lea rax,[rsp+268h] 00007ffc`7171e00e 4889442420 mov qword ptr [rsp+20h],rax 00007ffc`7171e013 4c8d4c2458 lea r9,[rsp+58h] 00007ffc`7171e018 448b442454 mov r8d,dword ptr [rsp+54h] 00007ffc`7171e01d 488b942488000000 mov rdx,qword ptr [rsp+88h] 00007ffc`7171e025 488b4f38 mov rcx,qword ptr [rdi+38h] 00007ffc`7171e029 e8a28e0e00 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffc`71806ed0) 00007ffc`7171e02e 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`6f55e8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`6f55e8c0 4053 push rbx 00007ffc`6f55e8c2 4883ec20 sub rsp,20h 00007ffc`6f55e8c6 33db xor ebx,ebx 00007ffc`6f55e8c8 85c9 test ecx,ecx 00007ffc`6f55e8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`6f55e8e6) 00007ffc`6f55e8cc 498bc8 mov rcx,r8 00007ffc`6f55e8cf 488bc2 mov rax,rdx 00007ffc`6f55e8d2 e839770500 call KERNEL32!TlsGetValue+0x1b80 (00007ffc`6f5b6010) 00007ffc`6f55e8d7 8bc8 mov ecx,eax +00008D9C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`716a8d77 488b0582ba1c00 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x4100 (00007ffc`71874800)] 00007ffc`716a8d7e 4885c0 test rax,rax 00007ffc`716a8d81 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`716a8da7) 00007ffc`716a8d83 488d0d76320700 lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7171c000)] 00007ffc`716a8d8a 4c8bc2 mov r8,rdx 00007ffc`716a8d8d 498bd1 mov rdx,r9 00007ffc`716a8d90 483bc1 cmp rax,rcx 00007ffc`716a8d93 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`716a8d9e) 00007ffc`716a8d95 33c9 xor ecx,ecx 00007ffc`716a8d97 e884b21600 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`71814020) 00007ffc`716a8d9c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`716a8dc6) ====================================================================== Thread 13148 / 0x335C ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00163D84 ntdll.dll!ZwWaitForMultipleObjects+0x14 +0001F233 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123 +0009F1B7 CRYPT32.dll! (get the pdb) ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 000000000000005B RBX = 0000000000000001 RCX = 0000000000000001 RDX = 000001F908058110 RSI = 0000001C87DFFA60 RDI = 0000000000000001 R8 = 0000000000000001 R9 = 0000000000000000 R10 = 0000000000000001 R11 = 0000000000000001 R12 = 000001F908058110 R13 = 0000001C86F1F000 R14 = 0000000000000000 R15 = 0000000000000000 RIP = 00007FFC71803D84 RSP = 0000001C87DFFA18 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00163D84 ntdll.dll!ZwWaitForMultipleObjects+0x14: 00007ffc`71803d62 ae scas byte ptr [rdi] 00007ffc`71803d63 f8 clc 00007ffc`71803d64 ff6666 jmp qword ptr [rsi+66h] 00007ffc`71803d67 660f1f840000000000 nop word ptr [rax+rax] ntdll!ZwWaitForMultipleObjects: 00007ffc`71803d70 4c8bd1 mov r10,rcx 00007ffc`71803d73 b85b000000 mov eax,5Bh 00007ffc`71803d78 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`71803d80 7503 jne ntdll!ZwWaitForMultipleObjects+0x15 (00007ffc`71803d85) 00007ffc`71803d82 0f05 syscall 00007ffc`71803d84 c3 ret +0001F233 KERNELBASE.dll!WaitForMultipleObjectsEx+0x123: 00007ffc`6efcf20a 488d742440 lea rsi,[rsp+40h] 00007ffc`6efcf20f 448b7c2438 mov r15d,dword ptr [rsp+38h] 00007ffc`6efcf214 4533c0 xor r8d,r8d 00007ffc`6efcf217 4585ff test r15d,r15d 00007ffc`6efcf21a 410f94c0 sete r8b 00007ffc`6efcf21e 4889742420 mov qword ptr [rsp+20h],rsi 00007ffc`6efcf223 450fb6ce movzx r9d,r14b 00007ffc`6efcf227 498bd4 mov rdx,r12 00007ffc`6efcf22a 8bcb mov ecx,ebx 00007ffc`6efcf22c 48ff15a5792700 call qword ptr [KERNELBASE!TlsGetValue+0xfdad8 (00007ffc`6f246bd8)] 00007ffc`6efcf233 0f1f440000 nop dword ptr [rax+rax] +0009F1B7 CRYPT32.dll! (get the pdb): 00007ffc`6eaff193 488bd9 mov rbx,rcx 00007ffc`6eaff196 48f7d8 neg rax 00007ffc`6eaff199 1bff sbb edi,edi 00007ffc`6eaff19b f7df neg edi 00007ffc`6eaff19d 448b4b30 mov r9d,dword ptr [rbx+30h] 00007ffc`6eaff1a1 488d5310 lea rdx,[rbx+10h] 00007ffc`6eaff1a5 8364242000 and dword ptr [rsp+20h],0 00007ffc`6eaff1aa 8d4f01 lea ecx,[rdi+1] 00007ffc`6eaff1ad 4533c0 xor r8d,r8d 00007ffc`6eaff1b0 48ff15c9660900 call qword ptr [00007ffc`6eb95880] 00007ffc`6eaff1b7 0f1f440000 nop dword ptr [rax+rax] ====================================================================== Thread 22252 / 0x56EC ====================================================================== LastError: 0x00000000 - Операция успешно завершена. NTSTATUS: 0x00000000 - STATUS_SUCCESS ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00166EE4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0007E02E ntdll.dll!RtlRaiseStatus+0x1C3E +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +00008D9C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001E6 RBX = 000001F904CD2AF0 RCX = 0000000000000018 RDX = 000001F904CD2770 RSI = 00007FFC7171CF90 RDI = 000001F904103280 R8 = 0000000000000010 R9 = 0000001C87EFF778 R10 = 0000000000000018 R11 = 0000000000000018 R12 = 00007FFC717760D0 R13 = 0000000000000000 R14 = 000000000000FFFF R15 = 00007FFC716E2330 RIP = 00007FFC71806EE4 RSP = 0000001C87EFF718 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00166EE4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffc`71806ec4 c3 ret 00007ffc`71806ec5 cd2e int 2Eh 00007ffc`71806ec7 c3 ret 00007ffc`71806ec8 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffc`71806ed0 4c8bd1 mov r10,rcx 00007ffc`71806ed3 b8e6010000 mov eax,1E6h 00007ffc`71806ed8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`71806ee0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffc`71806ee5) 00007ffc`71806ee2 0f05 syscall 00007ffc`71806ee4 c3 ret +0007E02E ntdll.dll!RtlRaiseStatus+0x1C3E: 00007ffc`7171dff6 488b03 mov rax,qword ptr [rbx] 00007ffc`7171dff9 4889842488000000 mov qword ptr [rsp+88h],rax 00007ffc`7171e001 44896c2458 mov dword ptr [rsp+58h],r13d 00007ffc`7171e006 488d842468020000 lea rax,[rsp+268h] 00007ffc`7171e00e 4889442420 mov qword ptr [rsp+20h],rax 00007ffc`7171e013 4c8d4c2458 lea r9,[rsp+58h] 00007ffc`7171e018 448b442454 mov r8d,dword ptr [rsp+54h] 00007ffc`7171e01d 488b942488000000 mov rdx,qword ptr [rsp+88h] 00007ffc`7171e025 488b4f38 mov rcx,qword ptr [rdi+38h] 00007ffc`7171e029 e8a28e0e00 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffc`71806ed0) 00007ffc`7171e02e 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`6f55e8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`6f55e8c0 4053 push rbx 00007ffc`6f55e8c2 4883ec20 sub rsp,20h 00007ffc`6f55e8c6 33db xor ebx,ebx 00007ffc`6f55e8c8 85c9 test ecx,ecx 00007ffc`6f55e8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`6f55e8e6) 00007ffc`6f55e8cc 498bc8 mov rcx,r8 00007ffc`6f55e8cf 488bc2 mov rax,rdx 00007ffc`6f55e8d2 e839770500 call KERNEL32!TlsGetValue+0x1b80 (00007ffc`6f5b6010) 00007ffc`6f55e8d7 8bc8 mov ecx,eax +00008D9C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`716a8d77 488b0582ba1c00 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x4100 (00007ffc`71874800)] 00007ffc`716a8d7e 4885c0 test rax,rax 00007ffc`716a8d81 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`716a8da7) 00007ffc`716a8d83 488d0d76320700 lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7171c000)] 00007ffc`716a8d8a 4c8bc2 mov r8,rdx 00007ffc`716a8d8d 498bd1 mov rdx,r9 00007ffc`716a8d90 483bc1 cmp rax,rcx 00007ffc`716a8d93 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`716a8d9e) 00007ffc`716a8d95 33c9 xor ecx,ecx 00007ffc`716a8d97 e884b21600 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`71814020) 00007ffc`716a8d9c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`716a8dc6) ====================================================================== Thread 18968 / 0x4A18 ====================================================================== LastError: 0x00000057 - Параметр задан неверно. NTSTATUS: 0xC000000D - Службе или функции передан неверный параметр. ---------------------------------------------------------------------- Stack ---------------------------------------------------------------------- +00166EE4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14 +0007E02E ntdll.dll!RtlRaiseStatus+0x1C3E +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17 +00008D9C ntdll.dll!RtlUserThreadStart+0x2C ---------------------------------------------------------------------- Registers ---------------------------------------------------------------------- RAX = 00000000000001E6 RBX = 0000000000000000 RCX = 0000000000000018 RDX = 000001F90B04BB00 RSI = 00007FFC7171CF90 RDI = 000001F904103280 R8 = 0000000000000010 R9 = 0000001C87FFF588 R10 = 0000000000000018 R11 = 0000000000000018 R12 = 00007FFC717760D0 R13 = 0000000000000000 R14 = 000000000000FFFF R15 = 00007FFC716E2330 RIP = 00007FFC71806EE4 RSP = 0000001C87FFF528 RBP = 0000000000000000 EFL = 00000246 ---------------------------------------------------------------------- Disassembly ---------------------------------------------------------------------- +00166EE4 ntdll.dll!ZwWaitForWorkViaWorkerFactory+0x14: 00007ffc`71806ec4 c3 ret 00007ffc`71806ec5 cd2e int 2Eh 00007ffc`71806ec7 c3 ret 00007ffc`71806ec8 0f1f840000000000 nop dword ptr [rax+rax] ntdll!ZwWaitForWorkViaWorkerFactory: 00007ffc`71806ed0 4c8bd1 mov r10,rcx 00007ffc`71806ed3 b8e6010000 mov eax,1E6h 00007ffc`71806ed8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 00007ffc`71806ee0 7503 jne ntdll!ZwWaitForWorkViaWorkerFactory+0x15 (00007ffc`71806ee5) 00007ffc`71806ee2 0f05 syscall 00007ffc`71806ee4 c3 ret +0007E02E ntdll.dll!RtlRaiseStatus+0x1C3E: 00007ffc`7171dff6 488b03 mov rax,qword ptr [rbx] 00007ffc`7171dff9 4889842488000000 mov qword ptr [rsp+88h],rax 00007ffc`7171e001 44896c2458 mov dword ptr [rsp+58h],r13d 00007ffc`7171e006 488d842468020000 lea rax,[rsp+268h] 00007ffc`7171e00e 4889442420 mov qword ptr [rsp+20h],rax 00007ffc`7171e013 4c8d4c2458 lea r9,[rsp+58h] 00007ffc`7171e018 448b442454 mov r8d,dword ptr [rsp+54h] 00007ffc`7171e01d 488b942488000000 mov rdx,qword ptr [rsp+88h] 00007ffc`7171e025 488b4f38 mov rcx,qword ptr [rdi+38h] 00007ffc`7171e029 e8a28e0e00 call ntdll!ZwWaitForWorkViaWorkerFactory (00007ffc`71806ed0) 00007ffc`7171e02e 8bc8 mov ecx,eax +0002E8D7 KERNEL32.DLL!BaseThreadInitThunk+0x17: 00007ffc`6f55e8bf cc int 3 KERNEL32!BaseThreadInitThunk: 00007ffc`6f55e8c0 4053 push rbx 00007ffc`6f55e8c2 4883ec20 sub rsp,20h 00007ffc`6f55e8c6 33db xor ebx,ebx 00007ffc`6f55e8c8 85c9 test ecx,ecx 00007ffc`6f55e8ca 751a jne KERNEL32!BaseThreadInitThunk+0x26 (00007ffc`6f55e8e6) 00007ffc`6f55e8cc 498bc8 mov rcx,r8 00007ffc`6f55e8cf 488bc2 mov rax,rdx 00007ffc`6f55e8d2 e839770500 call KERNEL32!TlsGetValue+0x1b80 (00007ffc`6f5b6010) 00007ffc`6f55e8d7 8bc8 mov ecx,eax +00008D9C ntdll.dll!RtlUserThreadStart+0x2C: 00007ffc`716a8d77 488b0582ba1c00 mov rax,qword ptr [ntdll!RtlpFreezeTimeBias+0x4100 (00007ffc`71874800)] 00007ffc`716a8d7e 4885c0 test rax,rax 00007ffc`716a8d81 7424 je ntdll!RtlUserThreadStart+0x37 (00007ffc`716a8da7) 00007ffc`716a8d83 488d0d76320700 lea rcx,[ntdll!RtlLeaveCriticalSection (00007ffc`7171c000)] 00007ffc`716a8d8a 4c8bc2 mov r8,rdx 00007ffc`716a8d8d 498bd1 mov rdx,r9 00007ffc`716a8d90 483bc1 cmp rax,rcx 00007ffc`716a8d93 7409 je ntdll!RtlUserThreadStart+0x2e (00007ffc`716a8d9e) 00007ffc`716a8d95 33c9 xor ecx,ecx 00007ffc`716a8d97 e884b21600 call ntdll!RtlFreeMemoryBlockLookaside+0x1e80 (00007ffc`71814020) 00007ffc`716a8d9c eb28 jmp ntdll!RtlUserThreadStart+0x56 (00007ffc`716a8dc6) ====================================================================== Modules ====================================================================== 0x00007FF6E2210000 - 0x00007FF6E2767000 | C:\Program Files\Far Manager\Far.exe | File and archive manager | 3.0.6446.0 x64 0x00007FFC716A0000 - 0x00007FFC71909000 | C:\WINDOWS\SYSTEM32\ntdll.dll | Системная библиотека NT | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC6F530000 - 0x00007FFC6F5F9000 | C:\WINDOWS\System32\KERNEL32.DLL | Библиотека клиента Windows NT BASE API | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC6EFB0000 - 0x00007FFC6F3A3000 | C:\WINDOWS\System32\KERNELBASE.dll | Библиотека клиента Windows NT BASE API | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC6F470000 - 0x00007FFC6F524000 | C:\WINDOWS\System32\ADVAPI32.dll | Расширенная библиотека API Windows 32 | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC6FF40000 - 0x00007FFC6FFE9000 | C:\WINDOWS\System32\msvcrt.dll | Windows NT CRT DLL | 7.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC6FE90000 - 0x00007FFC6FF36000 | C:\WINDOWS\System32\sechost.dll | Host for SCM/SDDL/LSA Lookup APIs | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC70A80000 - 0x00007FFC70B98000 | C:\WINDOWS\System32\RPCRT4.dll | Библиотека удаленного вызова процедур | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC6F860000 - 0x00007FFC6FA24000 | C:\WINDOWS\System32\USER32.dll | Многопользовательская библиотека клиента USER API Windows | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC6E830000 - 0x00007FFC6E857000 | C:\WINDOWS\System32\win32u.dll | Win32u | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC715C0000 - 0x00007FFC715EB000 | C:\WINDOWS\System32\GDI32.dll | GDI Client DLL | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC6EBE0000 - 0x00007FFC6ED0D000 | C:\WINDOWS\System32\gdi32full.dll | GDI Client DLL | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC6E860000 - 0x00007FFC6E903000 | C:\WINDOWS\System32\msvcp_win.dll | Microsoft® C Runtime Library | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC6E910000 - 0x00007FFC6EA5B000 | C:\WINDOWS\System32\ucrtbase.dll | Microsoft® C Runtime Library | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC701D0000 - 0x00007FFC7091D000 | C:\WINDOWS\System32\SHELL32.dll | Общая библиотека оболочки Windows | 10.0.26100.4768 (WinBuild.160101.0800) 0x00007FFC6ED10000 - 0x00007FFC6EE7C000 | C:\WINDOWS\System32\wintypes.dll | Библиотека DLL основных типов Windows | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC71150000 - 0x00007FFC714CB000 | C:\WINDOWS\System32\combase.dll | Microsoft COM для Windows | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC6FAE0000 - 0x00007FFC6FC78000 | C:\WINDOWS\System32\ole32.dll | Microsoft OLE для Windows | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC70920000 - 0x00007FFC70928000 | C:\WINDOWS\System32\PSAPI.DLL | Process Status Helper | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC70BA0000 - 0x00007FFC71027000 | C:\WINDOWS\System32\SETUPAPI.dll | Windows Setup API | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC6FD90000 - 0x00007FFC6FE81000 | C:\WINDOWS\System32\COMDLG32.dll | Библиотека общих диалоговых окон | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC71050000 - 0x00007FFC71140000 | C:\WINDOWS\System32\shcore.dll | SHCORE | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC6FFF0000 - 0x00007FFC70052000 | C:\WINDOWS\System32\SHLWAPI.dll | Библиотека небольших программ оболочки | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC583F0000 - 0x00007FFC5840A000 | C:\WINDOWS\SYSTEM32\NETAPI32.dll | Net Win32 API DLL | 10.0.26100.1150 (WinBuild.160101.0800) 0x00007FFC70980000 - 0x00007FFC709AF000 | C:\WINDOWS\System32\IMM32.dll | Multi-User Windows IMM32 API Client DLL | 10.0.26100.4484 (WinBuild.160101.0800) 0x00007FFC65C50000 - 0x00007FFC65D02000 | C:\WINDOWS\SYSTEM32\WINSPOOL.DRV | Драйвер диспетчера очереди Windows | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC6BAE0000 - 0x00007FFC6BAED000 | C:\WINDOWS\SYSTEM32\Secur32.dll | Security Support Provider Interface | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC69E00000 - 0x00007FFC69E0B000 | C:\WINDOWS\SYSTEM32\VERSION.dll | Version Checking and File Installation Libraries | 10.0.26100.1150 (WinBuild.160101.0800) 0x00007FFC6DC30000 - 0x00007FFC6DC5B000 | C:\WINDOWS\SYSTEM32\USERENV.dll | Userenv | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC51210000 - 0x00007FFC514A3000 | C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.5074_none_3e0d6f78e32fd63f\COMCTL32.dll | Библиотека элементов управления взаимодействия с пользователем | 6.10 (WinBuild.160101.0800) 0x00007FFC6E3B0000 - 0x00007FFC6E407000 | C:\WINDOWS\SYSTEM32\cfgmgr32.dll | Configuration Manager DLL | 10.0.26100.4202 (WinBuild.160101.0800) 0x00007FFC664B0000 - 0x00007FFC664D1000 | C:\WINDOWS\SYSTEM32\MPR.dll | Библиотека маршрутизации для нескольких служб доступа | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC67180000 - 0x00007FFC672A6000 | C:\Program Files\Far Manager\sqlite3.dll | SQLite is a software library that implements a self-contained, serverless, zero-configuration, transactional SQL database engine. | 3.49.1 0x00007FFC6D190000 - 0x00007FFC6D19D000 | C:\WINDOWS\SYSTEM32\NETUTILS.DLL | Net Win32 API Helpers DLL | 10.0.26100.1882 (WinBuild.160101.0800) 0x00007FFC6D140000 - 0x00007FFC6D15B000 | C:\WINDOWS\SYSTEM32\SAMCLI.DLL | Security Accounts Manager Client DLL | 10.0.26100.4768 (WinBuild.160101.0800) 0x00007FFC5FFC0000 - 0x00007FFC5FFE9000 | C:\WINDOWS\SYSTEM32\SRVCLI.DLL | Server Service Client DLL | 10.0.26100.1150 (WinBuild.160101.0800) 0x00007FFC6D8B0000 - 0x00007FFC6D8F9000 | C:\WINDOWS\SYSTEM32\SSPICLI.DLL | Security Support Provider Interface | 10.0.26100.6584 (WinBuild.160101.0800) 0x00007FFC6D610000 - 0x00007FFC6D62B000 | C:\WINDOWS\SYSTEM32\kernel.appcore.dll | AppModel API Host | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC6BB90000 - 0x00007FFC6BC38000 | C:\WINDOWS\system32\uxtheme.dll | Библиотека тем UxTheme (Microsoft) | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC70070000 - 0x00007FFC701C8000 | C:\WINDOWS\System32\MSCTF.dll | Серверная библиотека MSCTF | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC6C4D0000 - 0x00007FFC6CD29000 | C:\WINDOWS\SYSTEM32\windows.storage.dll | API хранения Microsoft WinRT | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC6E750000 - 0x00007FFC6E779000 | C:\WINDOWS\SYSTEM32\profapi.dll | User Profile Basic API | 10.0.26100.4768 (WinBuild.160101.0800) 0x00007FFC6EE80000 - 0x00007FFC6EF19000 | C:\WINDOWS\System32\bcryptPrimitives.dll | Windows Cryptographic Primitives Library | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC709C0000 - 0x00007FFC70A71000 | C:\WINDOWS\System32\clbcatq.dll | COM+ Configuration Catalog | 2001.12.10941.16384 (WinBuild.160101.0800) 0x00007FFC46510000 - 0x00007FFC467CE000 | C:\WINDOWS\system32\explorerframe.dll | ExplorerFrame | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC5C440000 - 0x00007FFC5CA8C000 | C:\Windows\System32\OneCoreUAPCommonProxyStub.dll | OneCoreUAP Common Proxy Stub | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC50270000 - 0x00007FFC50293000 | C:\Program Files\Far Manager\Plugins\LuaMacro\LuaMacro.dll | Lua Macros for Far Manager | 3.0.868.0 0x00007FFC3B400000 - 0x00007FFC3B4AC000 | C:\Program Files\Far Manager\luafar3.dll | LuaFar library | 3.0.868.0 0x0000000066D80000 - 0x0000000066E00000 | C:\Program Files\Far Manager\lua51.dll | 0x00000715 - Указанный тип ресурса в файле образа отсутствует. 0x00007FFC6DE30000 - 0x00007FFC6DE3C000 | C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL | Base cryptographic API DLL | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC4F240000 - 0x00007FFC4F279000 | C:\Program Files\Far Manager\Plugins\TmpPanel\TmpPanel.dll | Temporary Panel for Far Manager | 3.0.121.0 0x00007FFC6D730000 - 0x00007FFC6D766000 | C:\WINDOWS\SYSTEM32\ntmarta.dll | Поставщик Windows NT MARTA | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC39620000 - 0x00007FFC39828000 | C:\Program Files\Far Manager\Plugins\FarColorer\bin\colorer.dll | FarColorer - Syntax Highlighting for Far Manager 3 x64 ICU | 1.6.3 0x00007FFC3A8F0000 - 0x00007FFC3B07F000 | C:\Program Files\Far Manager\Plugins\NetBox\NetBox.dll | NetBox: SFTP/FTP/FTPS/SCP/WebDAV/S3 client for Far Manager 3.0 | 24.12.2.608 0x00007FFC6DE40000 - 0x00007FFC6DE5B000 | C:\WINDOWS\SYSTEM32\CRYPTSP.dll | Cryptographic Service Provider API | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC6D570000 - 0x00007FFC6D5AB000 | C:\WINDOWS\system32\rsaenh.dll | Microsoft Enhanced Cryptographic Provider | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC714D0000 - 0x00007FFC715A7000 | C:\WINDOWS\System32\OLEAUT32.dll | OLEAUT32.DLL | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC69A70000 - 0x00007FFC69B74000 | C:\WINDOWS\system32\propsys.dll | Система страниц свойств (Майкрософт) | 7.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC6FC80000 - 0x00007FFC6FCF4000 | C:\WINDOWS\System32\ws2_32.dll | 32-разрядная библиотека Windows Socket 2.0 | 10.0.26100.6713 (WinBuild.160101.0800) 0x000001F906C90000 - 0x000001F906C93000 | C:\WINDOWS\SYSTEM32\security.dll | Security Support Provider Interface | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC67350000 - 0x00007FFC67376000 | C:\Program Files\Far Manager\Plugins\AutoWrap\AutoWrap.dll | Auto wrap for Far Manager | 3.0.27.0 0x00007FFC672C0000 - 0x00007FFC672E7000 | C:\Program Files\Far Manager\Plugins\HlfViewer\HlfViewer.dll | Hlf-file Viewer for Far Manager | 3.0.50.0 0x00007FFC68110000 - 0x00007FFC68121000 | C:\WINDOWS\SYSTEM32\wtdccm.dll | 0x00000715 - Указанный тип ресурса в файле образа отсутствует. 0x00007FFC41840000 - 0x00007FFC41931000 | C:\Program Files\Far Manager\Plugins\ArcLite\arclite.dll | Archive support for Far Manager (based on 7-Zip project) | 3.0.347.0 0x00000000591C0000 - 0x00000000593A2000 | C:\Program Files\Far Manager\Plugins\ArcLite\7z.dll | 7z Plugin | 24.09 0x00007FFC595C0000 - 0x00007FFC595E9000 | C:\WINDOWS\SYSTEM32\edputil.dll | Служебная программа EDP | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC5FB70000 - 0x00007FFC5FD4F000 | C:\WINDOWS\SYSTEM32\urlmon.dll | Расширения OLE32 для Win32 | 11.00.26100.6713 (WinBuild.160101.0800) 0x00007FFC5F870000 - 0x00007FFC5FB34000 | C:\WINDOWS\SYSTEM32\iertutil.dll | Служебная программа времени выполнения для Internet Explorer | 11.00.26100.6713 (WinBuild.160101.0800) 0x00007FFC55780000 - 0x00007FFC55797000 | C:\WINDOWS\SYSTEM32\virtdisk.dll | Virtual Disk API DLL | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC6DF10000 - 0x00007FFC6DF74000 | C:\WINDOWS\SYSTEM32\Wldp.dll | Политика блокировки Windows | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC6B940000 - 0x00007FFC6B9DE000 | C:\WINDOWS\SYSTEM32\apphelp.dll | Клиентская библиотека совместимости приложений | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC6E720000 - 0x00007FFC6E746000 | C:\WINDOWS\SYSTEM32\bcrypt.dll | Библиотека криптографических примитивов Windows | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC6F7E0000 - 0x00007FFC6F85A000 | C:\WINDOWS\System32\coml2.dll | Microsoft COM for Windows | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC67400000 - 0x00007FFC6740B000 | C:\WINDOWS\system32\c_is2022.dll | ISO-2022 Code Page Translation DLL | 10.0.26100.1150 (WinBuild.160101.0800) 0x00007FFC61FD0000 - 0x00007FFC6200D000 | C:\WINDOWS\system32\c_g18030.dll | GB18030 DBCS-Unicode Conversion DLL | 10.0.26100.1150 (WinBuild.160101.0800) 0x00007FFC673F0000 - 0x00007FFC673FA000 | C:\WINDOWS\system32\c_gsm7.dll | GSM 7bit Code Page Translation DLL for SMS | 10.0.26100.1150 (WinBuild.160101.0800) 0x00007FFC67340000 - 0x00007FFC67349000 | C:\WINDOWS\system32\c_iscii.dll | ISCII Code Page Translation DLL | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC470A0000 - 0x00007FFC4712A000 | C:\WINDOWS\SYSTEM32\shdocvw.dll | Библиотека объектов документов и элементов управления оболочки | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC685A0000 - 0x00007FFC686BF000 | C:\WINDOWS\SYSTEM32\WINHTTP.dll | Службы HTTP Windows | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC5F820000 - 0x00007FFC5F864000 | C:\WINDOWS\SYSTEM32\rstrtmgr.DLL | Диспетчер перезапуска | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC6E050000 - 0x00007FFC6E080000 | C:\WINDOWS\SYSTEM32\ncrypt.dll | Маршрутизатор Windows NCrypt | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC6E000000 - 0x00007FFC6E03F000 | C:\WINDOWS\SYSTEM32\NTASN1.dll | Microsoft ASN.1 API | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC6E6B0000 - 0x00007FFC6E70E000 | C:\WINDOWS\SYSTEM32\powrprof.dll | DLL модуля поддержки профиля управления питанием | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC6E690000 - 0x00007FFC6E6A4000 | C:\WINDOWS\SYSTEM32\UMPDC.dll | User Mode Power Dependency Coordinator | 10.0.26100.1301 (WinBuild.160101.0800) 0x00007FFC6D160000 - 0x00007FFC6D18B000 | C:\WINDOWS\SYSTEM32\SAMLIB.dll | DLL библиотеки SAM | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC5B530000 - 0x00007FFC5B577000 | C:\WINDOWS\SYSTEM32\windows.staterepositoryclient.dll | Windows StateRepository Client API | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC681D0000 - 0x00007FFC681DB000 | C:\WINDOWS\SYSTEM32\msiltcfg.dll | Windows Installer Configuration API Stub | 5.0.26100.3624 (WinBuild.160101.0800) 0x00007FFC43DF0000 - 0x00007FFC4413A000 | C:\WINDOWS\SYSTEM32\msi.dll | Windows Installer | 5.0.26100.6584 0x00007FFC56B50000 - 0x00007FFC56B80000 | C:\WINDOWS\SYSTEM32\srpapi.dll | Библиотека DLL программных интерфейсов (API) поставщика общих ресурсов | 10.0.26100.6713 (WinBuild.160101.0800) 0x000001F909EC0000 - 0x000001F909EC3000 | C:\WINDOWS\system32\SFC.DLL | Windows File Protection | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC6B800000 - 0x00007FFC6B80A000 | C:\WINDOWS\SYSTEM32\sfc_os.DLL | Windows File Protection | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC6E450000 - 0x00007FFC6E52D000 | C:\WINDOWS\SYSTEM32\ServicingCommon.dll | Servicing Base DLL | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC63A50000 - 0x00007FFC63A94000 | C:\WINDOWS\SYSTEM32\XmlLite.dll | Microsoft XmlLite Library | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC6E530000 - 0x00007FFC6E5D1000 | C:\WINDOWS\SYSTEM32\sxs.dll | Fusion 2.5 | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC458C0000 - 0x00007FFC45967000 | C:\WINDOWS\system32\ntshrui.dll | Расширения оболочки, обеспечивающие общий доступ | 10.0.26100.6713 (WinBuild.160101.0800) 0x0000000059120000 - 0x00000000591B4000 | C:\Program Files (x86)\WinSCP\DragExt64.dll | Drag&Drop shell extension for WinSCP (Win64) | 2.1.0.16311 0x00007FFC582B0000 - 0x00007FFC582C3000 | C:\WINDOWS\SYSTEM32\cscapi.dll | Offline Files Win32 API | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC47540000 - 0x00007FFC4754F000 | C:\WINDOWS\SYSTEM32\LINKINFO.dll | Windows Volume Tracking | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC5A630000 - 0x00007FFC5A652000 | C:\WINDOWS\System32\p9np.dll | Plan 9 Network Provider | 10.0.26100.4768 (WinBuild.160101.0800) 0x00007FFC672B0000 - 0x00007FFC672BD000 | C:\WINDOWS\System32\drprov.dll | Служба доступа к сети для сервера, обслуживающего сеансы подключения к удаленному рабочему столу (Майкрософт) | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC57CD0000 - 0x00007FFC57CF6000 | C:\WINDOWS\System32\ntlanman.dll | Microsoft® LAN Manager | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC551B0000 - 0x00007FFC551D1000 | C:\WINDOWS\System32\davclnt.dll | Web DAV Client DLL | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC6E5E0000 - 0x00007FFC6E643000 | C:\WINDOWS\System32\WINSTA.dll | Winstation Library | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC683B0000 - 0x00007FFC683CB000 | C:\WINDOWS\System32\wkscli.dll | Workstation Service Client DLL | 10.0.26100.1882 (WinBuild.160101.0800) 0x00007FFC2B930000 - 0x00007FFC2BB72000 | C:\WINDOWS\SYSTEM32\dbghelp.DLL | Windows Image Helper | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC68800000 - 0x00007FFC6883D000 | C:\WINDOWS\SYSTEM32\dbgcore.DLL | Windows Core Debugging Helpers | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC25360000 - 0x00007FFC25A7C000 | C:\WINDOWS\SYSTEM32\dbgeng.DLL | Windows Symbolic Debugger Engine | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC46C40000 - 0x00007FFC46D59000 | C:\WINDOWS\SYSTEM32\dbgmodel.dll | Windows Debugger Data Model | 10.0.26100.1 (WinBuild.160101.0800) 0x00007FFC6EF20000 - 0x00007FFC6EF9E000 | C:\WINDOWS\System32\wintrust.dll | Microsoft Trust Verification APIs | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC6EA60000 - 0x00007FFC6EBD7000 | C:\WINDOWS\System32\CRYPT32.dll | API32 криптографии | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC6DEA0000 - 0x00007FFC6DEB3000 | C:\WINDOWS\SYSTEM32\MSASN1.dll | ASN.1 Runtime APIs | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC6FA30000 - 0x00007FFC6FA50000 | C:\WINDOWS\System32\imagehlp.dll | Windows NT Image Helper | 10.0.26100.4202 (WinBuild.160101.0800) 0x00007FFC6DC00000 - 0x00007FFC6DC27000 | C:\WINDOWS\SYSTEM32\gpapi.dll | Клиентские функции API групповой политики | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC68430000 - 0x00007FFC6846B000 | C:\WINDOWS\SYSTEM32\cryptnet.dll | Crypto Network Related API | 10.0.26100.3624 (WinBuild.160101.0800) 0x00007FFC6CF50000 - 0x00007FFC6CF84000 | C:\WINDOWS\SYSTEM32\IPHLPAPI.DLL | API вспомогательного приложения IP | 10.0.26100.6713 (WinBuild.160101.0800) 0x00007FFC6BAC0000 - 0x00007FFC6BACF000 | C:\WINDOWS\SYSTEM32\WINNSI.DLL | Network Store Information RPC interface | 10.0.26100.5074 (WinBuild.160101.0800) 0x00007FFC71650000 - 0x00007FFC7165A000 | C:\WINDOWS\System32\NSI.dll | NSI User-mode interface DLL | 10.0.26100.5074 (WinBuild.160101.0800) ====================================================================== Environment ====================================================================== FARADMINMODE=1 FARHOME=C:\Program Files\Far Manager FARLANG=English FARLOCALPROFILE=C:\Users\USER\AppData\Local\Far Manager\Profile FARPROFILE=C:\Users\USER\AppData\Roaming\Far Manager\Profile