EurekaLog 7.9.0.0 D1ABA1B7D457384FACF27851A4CB5B98 0A176FA385B34A4E88E8D60988A2E5B6 DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 BD225D8F34584843B570DDBE1CC178C2 Application: ------------------------------------------------------------------------- 1.1 Start Date : Thu, 15 Apr 2021 10:09:47 +0300 1.2 Name/Description: mcclient.exe - (mcclient) 1.3 Version Number : 8.3.0.1 1.4 Parameters : /autorun 1.5 Compilation Date: Tue, 15 Dec 2020 17:51:29 +0300 1.6 Up Time : 55 second(s) 1.7 Elevated : 0 1.10 RAM : 160808960 (153,36 Mb); Max: 169074688 (161,24 Mb) 1.11 Private : 127541248 (121,63 Mb); Max: 128045056 (122,11 Mb) 1.12 Virtual : 347394048 (331,30 Mb) Exception: ----------------------------------------------------- 2.1 Date : Thu, 15 Apr 2021 10:10:43 +0300 2.2 Address : 008B899E 2.3 Module Name : mcclient.exe - (mcclient) 2.4 Module Version: 8.3.0.1 2.5 Type : EJPEG 2.6 Message : JPEG error #42. 2.7 ID : EF448CF8 2.8 Count : 1 2.9 Status : New 2.10 Note : 2.11 Sent : 0 User: ---------------------------------------------------------------- 3.1 ID : NIKoloskova 3.2 Name : NIKoloskova 3.3 Email : 3.4 Company : 3.5 Privileges: SeShutdownPrivilege - OFF SeChangeNotifyPrivilege - ON (default) SeUndockPrivilege - OFF SeIncreaseWorkingSetPrivilege - OFF SeTimeZonePrivilege - OFF 3.6 Admin : limited 3.7 Restricted: 0 Active Controls: -------------------------------------- 4.1 Form Class : TaskManagerWindow 4.2 Form Text : Диспетчер задач 4.3 Control Class: Button 4.4 Control Text : ОК Computer: ----------------------------------------------------------------------------------------- 5.1 Name : OTD17-K318-PC1 5.2 Total Memory : 8457383936 (7,88 Gb) 5.3 Free Memory : 5291499520 (4,93 Gb) 5.4 Total Disk : 499345518592 (465,05 Gb) 5.5 Free Disk : 393967095808 (366,91 Gb) 5.6 System Up Time : 1 minute(s), 45 second(s) / 5 minute(s), 22 second(s) 5.7 Processor : Intel(R) Core(TM) i5-7400 CPU @ 3.00GHz 5.8 Display Mode : 1920 x 1080, 32 bit 5.9 Display DPI : 96 5.10 Video Card : Intel(R) HD Graphics 630 (driver 27.20.100.8682 - RAM 1073741824) 5.11 Printer : Kyocera ECOSYS M2530dn KX (driver 5,0,0,0) 5.12 Virtual Machine: 5.13 System Idle : few seconds Operating System: ----------------------------------------------------- 6.1 Type : Microsoft Windows 10 (64 bit) 6.2 Build # : 2009 (10.0.19042.928) 6.3 Update : 6.4 Language : Russian (0419) 6.5 Charset : 204/1251 6.6 Install Language: Russian (0419) 6.7 UI Language : Russian (0419) 6.8 Edition : Enterprise 6.9 UAC : 1 Network: ----------------------------------------------------------------- 7.1 IP Address : fe80::8016:5160:e60e:1019%15 - 192.168.040.022 7.2 Submask : /64 - 255.255.255.000 7.3 Gateway : - 192.168.040.001 7.4 DNS 1 : - 172.016.015.001 7.5 DNS 2 : - 172.016.015.002 7.6 DHCP : ON 7.7 Description: Ethernet 3 Steps to reproduce: ------------ 8.1 Text: Custom Information: ------------------------------------------------------------------------ 9.1 ServerHWID: 298468386_4005_6-15-1-600000000 9.2 License : COMMERCIAL 9.3 ClientHWID: 417201849035490203026422409650645641642905501645F45972 Call Stack Information: ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |Methods |Details|Stack |Address |Module |Offset |Source |Unit |Class |Procedure/Method |Line | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |*Exception Thread: ID=8952; Parent=0; Priority=0 | |Class=; Name=MAIN | |DeadLock=0; Wait Chain= | |Comment= | |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |7FFFFFFE|03 |00000000|008B899E|mcclient.exe |004B899E|Vcl.Imaging.jpeg.pas |Vcl.Imaging.jpeg| |JpegError | | |00000020|03 |0019EDBC|0040B8E6|mcclient.exe |0000B8E6|System.pas |System | |_HandleFinally | | |00000020|03 |0019EDD8|008BB734|mcclient.exe |004BB734|Vcl.Imaging.jpeg.pas |Vcl.Imaging.jpeg| |? | | |00000020|03 |0019EDE4|008C510F|mcclient.exe |004C510F|Vcl.Imaging.jpeg.pas |Vcl.Imaging.jpeg| |? | | |00000020|03 |0019EDEC|0040737C|mcclient.exe |0000737C|System.pas |System | |AllocMem | | |00000020|03 |0019EE00|008C51AF|mcclient.exe |004C51AF|Vcl.Imaging.jpeg.pas |Vcl.Imaging.jpeg| |? | | |00000020|03 |0019EE0C|008BB5E7|mcclient.exe |004BB5E7|Vcl.Imaging.jpeg.pas |Vcl.Imaging.jpeg| |? | | |00000020|03 |0019EE1C|008BA3C9|mcclient.exe |004BA3C9|Vcl.Imaging.jpeg.pas |Vcl.Imaging.jpeg| |jpeg_consume_input | | |00000020|03 |0019EE28|008BA32A|mcclient.exe |004BA32A|Vcl.Imaging.jpeg.pas |Vcl.Imaging.jpeg| |jpeg_read_header | | |00000020|03 |0019EE34|008B8D6B|mcclient.exe |004B8D6B|Vcl.Imaging.jpeg.pas |Vcl.Imaging.jpeg| |InitDecompressor | | |00000020|03 |0019EE58|008B9562|mcclient.exe |004B9562|Vcl.Imaging.jpeg.pas |Vcl.Imaging.jpeg|TJPEGImage |GetBitmap | | |00000020|03 |0019EE70|75FC005E|gdi32full.dll |0004005E|gdi32full.dll |gdi32full | | (possible ExtTextOutWImpl+1854) | | |00000020|03 |0019EE78|008B8951|mcclient.exe |004B8951|Vcl.Imaging.jpeg.pas |Vcl.Imaging.jpeg| |InvalidOperation | | |00000020|04 |0019F110|0044C5D0|mcclient.exe |0004C5D0|EMemLeaks.pas |EMemLeaks | |_TObjectFreeHook |3714[1] | |00000020|03 |0019F124|008B930C|mcclient.exe |004B930C|Vcl.Imaging.jpeg.pas |Vcl.Imaging.jpeg|TJPEGImage |Draw | | |00000020|03 |0019F134|00658CB3|mcclient.exe |00258CB3|Vcl.Graphics.pas |Vcl.Graphics |TCanvas |Draw | | |00000020|04 |0019F160|00FD996F|mcclient.exe |00BD996F|myTalks.pas |myTalks |TTalkList |DrawNodeBig |1008[343] | |00000020|03 |0019F16C|0040B8E6|mcclient.exe |0000B8E6|System.pas |System | |_HandleFinally | | |00000020|04 |0019F250|00FD881A|mcclient.exe |00BD881A|myTalks.pas |myTalks |TTalkList |DrawNode |642[9] | |00000020|04 |0019F25C|00E5029A|mcclient.exe |00A5029A|VirtualTrees.pas |VirtualTrees |TCustomVirtualDrawTree|DoPaintNode |34780[2] | |00000020|04 |0019F268|00E48D95|mcclient.exe |00A48D95|VirtualTrees.pas |VirtualTrees |TBaseVirtualTree |PaintTree |30723[345] | |00008020|03 |0019F27C|0040B8E6|a |0000B8E6|{38E0C963-48A9-4649-A681-F4F0B4371047}|recursive |area |removed |2[0] | |00000020|03 |0019F288|0040B8E6|mcclient.exe |0000B8E6|System.pas |System | |_HandleFinally | | |00000020|03 |0019F480|75FB6D58|gdi32full.dll |00036D58|gdi32full.dll |gdi32full | |MoveToExImpl | | |00000020|04 |0019F4D4|00E3C57F|mcclient.exe |00A3C57F|VirtualTrees.pas |VirtualTrees |TBaseVirtualTree |Paint |23841[23] | |00000020|03 |0019F514|00690387|mcclient.exe |00290387|Vcl.Controls.pas |Vcl.Controls |TCustomControl |PaintWindow | | |00000020|03 |0019F51C|0040B8E6|mcclient.exe |0000B8E6|System.pas |System | |_HandleFinally | | |00000020|03 |0019F528|0040B8E6|mcclient.exe |0000B8E6|System.pas |System | |_HandleFinally | | |00000020|03 |0019F53C|00689B6D|mcclient.exe |00289B6D|Vcl.Controls.pas |Vcl.Controls |TWinControl |PaintHandler | | |00000020|03 |0019F544|0040B8E6|mcclient.exe |0000B8E6|System.pas |System | |_HandleFinally | | |00000020|03 |0019F5AC|0068A4C4|mcclient.exe |0028A4C4|Vcl.Controls.pas |Vcl.Controls |TWinControl |WMPaint | | |00000020|03 |0019F5F4|771F5D79|ntdll.dll |00045D79|ntdll.dll |ntdll | |RtlAllocateHeap | | |00000020|03 |0019F5FC|771F5D79|ntdll.dll |00045D79|ntdll.dll |ntdll | |RtlAllocateHeap | | |00000020|03 |0019F614|00690321|mcclient.exe |00290321|Vcl.Controls.pas |Vcl.Controls |TCustomControl |WMPaint | | |00000020|04 |0019F620|00E312B9|mcclient.exe |00A312B9|VirtualTrees.pas |VirtualTrees |TBaseVirtualTree |WMPaint |17597[8] | |00000020|03 |0019F630|771F5B2C|ntdll.dll |00045B2C|ntdll.dll |ntdll | | (possible RtlDosSearchPath_Ustr+2492) | | |00000020|03 |0019F640|0040A837|mcclient.exe |0000A837|System.pas |System |TObject |Dispatch | | |00000020|03 |0019F64C|00684ABE|mcclient.exe |00284ABE|Vcl.Controls.pas |Vcl.Controls |TControl |WndProc | | |00000020|04 |0019F6E4|0044C094|mcclient.exe |0004C094|EMemLeaks.pas |EMemLeaks | |CheckOurPointer |3473[42] | |00000020|03 |0019F6F0|772229CA|ntdll.dll |000729CA|ntdll.dll |ntdll | |ZwReadFile | | |00000020|03 |0019F6F4|752501B6|KERNELBASE.dll |001101B6|KERNELBASE.dll |KERNELBASE | | (possible ReadFile+230) | | |00000020|04 |0019F72C|0044E266|mcclient.exe |0004E266|EMemLeaks.pas |EMemLeaks | |EurekaGetMem |4983[203] | |00000020|03 |0019F758|00480A1C|mcclient.exe |00080A1C|System.SysUtils.pas |System.SysUtils | |FileRead | | |00000020|03 |0019F778|006899A6|mcclient.exe |002899A6|Vcl.Controls.pas |Vcl.Controls |TWinControl |WndProc | | |00000020|03 |0019F798|008B8F54|mcclient.exe |004B8F54|Vcl.Imaging.jpeg.pas |Vcl.Imaging.jpeg|TJPEGImage |Changed | | |00000020|03 |0019F79C|008B9D98|mcclient.exe |004B9D98|Vcl.Imaging.jpeg.pas |Vcl.Imaging.jpeg|TJPEGImage |ReadStream | | |00000020|03 |0019F7B0|7585687A|user32.dll |0003687A|USER32.dll |USER32 | |GetWindowLongW | | |00000020|04 |0019F7CC|00E405CC|mcclient.exe |00A405CC|VirtualTrees.pas |VirtualTrees |TBaseVirtualTree |WndProc |25686[32] | |00000020|03 |0019F7E4|00688F28|mcclient.exe |00288F28|Vcl.Controls.pas |Vcl.Controls |TWinControl |MainWndProc | | |00000020|03 |0019F7EC|0040B8E6|mcclient.exe |0000B8E6|System.pas |System | |_HandleFinally | | |00000020|03 |0019F7F8|0040B6B6|mcclient.exe |0000B6B6|System.pas |System | |_HandleAnyException | | |00000030|03 |0019F814|005371D8|mcclient.exe |001371D8|System.Classes.pas |System.Classes | |StdWndProc | | |00000030|03 |0019F82C|7585EEB9|user32.dll |0003EEB9|USER32.dll |USER32 | | (possible AddClipboardFormatListener+73) | | |00000030|03 |0019F858|75855E75|user32.dll |00035E75|USER32.dll |USER32 | | (possible GetClassLongW+1957) | | |00000020|03 |0019F870|746591D2|windows.storage.dll|001C91D2|windows.storage.dll |windows.storage | | (possible CViewSettings_CreateInstance+2994) | | |00000020|04 |0019F894|0044C094|mcclient.exe |0004C094|EMemLeaks.pas |EMemLeaks | |CheckOurPointer |3473[42] | |00000020|03 |0019F8AC|7720AB34|ntdll.dll |0005AB34|ntdll.dll |ntdll | |RtlRestoreLastWin32Error | | |00000020|04 |0019F8B0|0044E777|mcclient.exe |0004E777|EMemLeaks.pas |EMemLeaks | |EurekaFreeMem |5226[87] | |00000020|03 |0019F8D4|75855C88|user32.dll |00035C88|USER32.dll |USER32 | | (possible GetClassLongW+1464) | | |00000020|03 |0019F920|00412D49|mcclient.exe |00012D49|System.pas |System |TInterfacedObject |_Release | | |00000030|03 |0019F93C|75855A75|user32.dll |00035A75|USER32.dll |USER32 | | (possible GetClassLongW+933) | | |00000020|03 |0019F95C|74659176|windows.storage.dll|001C9176|windows.storage.dll |windows.storage | | (possible CViewSettings_CreateInstance+2902) | | |00000020|04 |0019F970|00E42FCE|mcclient.exe |00A42FCE|VirtualTrees.pas |VirtualTrees |TBaseVirtualTree |GetDisplayRect |27048[51] | |00000030|03 |0019F9A0|7585963D|user32.dll |0003963D|USER32.dll |USER32 | | (possible CallNextHookEx+413) | | |00000020|04 |0019F9C4|0044E904|mcclient.exe |0004E904|EMemLeaks.pas |EMemLeaks | |EurekaFreeMem |5282[143] | |00000030|03 |0019F9DC|77224E4B|ntdll.dll |00074E4B|ntdll.dll |ntdll | | (possible KiUserCallbackDispatcher+75) | | |00000020|04 |0019FA14|00E4A7C1|mcclient.exe |00A4A7C1|VirtualTrees.pas |VirtualTrees |TBaseVirtualTree |RepaintNode |31530[4] | |00000030|04 |0019FA44|00FDAD5C|mcclient.exe |00BDAD5C|myTalks.pas |myTalks |TTalkList |ReloadUserAvatar |1668[26] | |00000020|03 |0019FA68|0040C3A8|mcclient.exe |0000C3A8|System.pas |System | |_UStrClr | | |00000030|04 |0019FA84|00E56C56|mcclient.exe |00A56C56|myPrivateDialogs.pas |myPrivateDialogs|TPrivateDialogs |ReloadUserAvatar |865[1] | |00000030|04 |0019FA8C|012968FA|mcclient.exe |00E968FA|mccadditional.pas |mccadditional | |mcUsersAvatarsData |689[27] | |00000030|04 |0019FB00|0114B422|mcclient.exe |00D4B422|mcparse.pas |mcparse | |Parser |198[170] | |00000030|04 |0019FB44|01422CAB|mcclient.exe |01022CAB|fm_main.pas |fm_main |TMainForm |EventParse |4493[10] | |00000030|04 |0019FB60|01421D2C|mcclient.exe |01021D2C|fm_main.pas |fm_main |TMainForm |WndProc |4003[56] | |00000030|04 |0019FB90|0093E5B9|mcclient.exe |0053E5B9|DynamicSkinForm.pas |DynamicSkinForm |TspDynamicSkinForm |NewWndProc |19435[1287] | |00000020|03 |0019FC34|6C69CA51|CoreMessaging.dll |0003CA51|CoreMessaging.dll |CoreMessaging | | (possible CoreUIConfigureUserIntegration+2673)| | |00000020|03 |0019FC38|6C69CA56|CoreMessaging.dll |0003CA56|CoreMessaging.dll |CoreMessaging | | (possible CoreUIConfigureUserIntegration+2678)| | |00000030|03 |0019FCA0|00688F28|mcclient.exe |00288F28|Vcl.Controls.pas |Vcl.Controls |TWinControl |MainWndProc | | |00000020|03 |0019FCB4|00688F52|mcclient.exe |00288F52|Vcl.Controls.pas |Vcl.Controls |TWinControl |MainWndProc | | |00000030|03 |0019FCD0|005371D8|mcclient.exe |001371D8|System.Classes.pas |System.Classes | |StdWndProc | | |00000030|03 |0019FCE8|7585EEB9|user32.dll |0003EEB9|USER32.dll |USER32 | | (possible AddClipboardFormatListener+73) | | |00000030|03 |0019FD14|75855E75|user32.dll |00035E75|USER32.dll |USER32 | | (possible GetClassLongW+1957) | | |00000020|03 |0019FD68|7585963D|user32.dll |0003963D|USER32.dll |USER32 | | (possible CallNextHookEx+413) | | |00000020|03 |0019FD70|772229BA|ntdll.dll |000729BA|ntdll.dll |ntdll | |ZwCallbackReturn | | |00000020|03 |0019FD90|75855C88|user32.dll |00035C88|USER32.dll |USER32 | | (possible GetClassLongW+1464) | | |00000020|03 |0019FDDC|758598D4|user32.dll |000398D4|USER32.dll |USER32 | | (possible PeekMessageW+500) | | |00000030|03 |0019FDF8|75853BE5|user32.dll |00033BE5|USER32.dll |USER32 | | (possible DispatchMessageW+581) | | |00000020|03 |0019FE28|758010EA|win32u.dll |000010EA|win32u.dll |win32u | |NtUserGetProp | | |00000020|03 |0019FE2C|7585A1E9|user32.dll |0003A1E9|USER32.dll |USER32 | |GetPropW | | |00000030|03 |0019FE6C|758539AB|user32.dll |000339AB|USER32.dll |USER32 | |DispatchMessageW | | |00000020|03 |0019FE78|00780EC7|mcclient.exe |00380EC7|Vcl.Forms.pas |Vcl.Forms |TApplication |ProcessMessage | | |00000020|03 |0019FE94|00780F0A|mcclient.exe |00380F0A|Vcl.Forms.pas |Vcl.Forms |TApplication |HandleMessage | | |00000020|03 |0019FEB8|0078123D|mcclient.exe |0038123D|Vcl.Forms.pas |Vcl.Forms |TApplication |Run | | |00000020|03 |0019FEC0|0078124A|mcclient.exe |0038124A|Vcl.Forms.pas |Vcl.Forms |TApplication |Run | | |00000030|03 |0019FECC|00781285|mcclient.exe |00381285|Vcl.Forms.pas |Vcl.Forms |TApplication |Run | | |00000020|04 |0019FEE8|0145331B|mcclient.exe |0105331B|mcclient.dpr |mcclient | |Initialization |489[259] | |00000030|04 |0019FEF0|01453353|mcclient.exe |01053353|mcclient.dpr |mcclient | |Initialization |494[264] | |7FFF7FFE|03 |0019FF74|7675FA27|kernel32.dll |0001FA27|KERNEL32.DLL |KERNEL32 | |BaseThreadInitThunk | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Mosules Information: ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |Handle |Name |Description |Version |Size |Modified |Path | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |00400000|mcclient.exe |mcclient |8.3.0.1 |25756144|2020-12-15 18:31:16|C:\Users\NIKoloskova\AppData\Local\NSS\MyChat Client\ | |04BB0000|bcrypt.dll |Библиотека криптографических примитивов Windows |6.2.19041.546 |96032 |2021-04-05 16:30:38|C:\Windows\System32\ | |0DF10000|Beeper.dll | | |1184256 |2020-12-02 09:28:51|C:\Users\NIKoloskova\AppData\Local\MyChat Client\plugins\Beeper\bin\ | |11000000|libeay32.dll |OpenSSL Shared Library |1.0.2.14 |1371136 |2017-12-07 16:08:22|C:\Users\NIKoloskova\AppData\Local\NSS\MyChat Client\ | |12000000|ssleay32.dll |OpenSSL Shared Library |1.0.2.14 |337920 |2017-12-07 16:08:22|C:\Users\NIKoloskova\AppData\Local\NSS\MyChat Client\ | |6B310000|Faultrep.dll |Библиотека отчетов о сбоях в пользовательском режиме Windows |6.2.19041.867 |410064 |2021-04-05 16:30:40|C:\Windows\System32\ | |6B380000|GdiPlus.dll |Microsoft GDI+ |6.2.19041.928 |1461760 |2021-04-08 03:42:58|C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.928_none_429ce31a8a8fefd2\ | |6C090000|AudioSes.dll |Сеанс обработки звука |6.2.19041.906 |1258256 |2021-04-14 09:14:58|C:\Windows\System32\ | |6C1D0000|MMDevAPI.dll |MMDevice API |6.2.19041.789 |421480 |2021-04-05 16:29:38|C:\Windows\System32\ | |6C2A0000|ntshrui.dll |Расширения оболочки, обеспечивающие общий доступ |6.2.19041.844 |357376 |2021-04-05 16:31:06|C:\Windows\System32\ | |6C3E0000|CoreUIComponents.dll |Microsoft Core UI Components Dll |6.2.19041.546 |2621720 |2021-04-05 16:30:05|C:\Windows\System32\ | |6C660000|CoreMessaging.dll |Microsoft CoreMessaging Dll |6.2.19041.867 |630592 |2021-04-05 16:30:37|C:\Windows\System32\ | |6CEF0000|avrt.dll |Среда выполнения мультимедиа в реальном времени |6.2.19041.546 |27336 |2021-04-05 16:29:38|C:\Windows\System32\ | |6CF00000|linkinfo.dll |Windows Volume Tracking |6.2.19041.546 |23552 |2021-04-05 16:31:06|C:\Windows\System32\ | |6CF10000|textinputframework.dll |"TextInputFramework.DYNLINK" |6.2.19041.906 |754608 |2021-04-14 09:15:03|C:\Windows\System32\ | |6D230000|umpdc.dll | | |47472 |2021-04-05 16:30:22|C:\Windows\System32\ | |6D240000|powrprof.dll |DLL модуля поддержки профиля управления питанием |6.2.19041.546 |268080 |2021-04-05 16:30:39|C:\Windows\System32\ | |6D290000|idndl.dll |Downlevel DLL |6.2.19041.1 |8192 |2019-12-07 12:09:29|C:\Windows\System32\ | |6D560000|twinapi.appcore.dll |twinapi.appcore |6.2.19041.746 |1634208 |2021-04-05 16:30:23|C:\Windows\System32\ | |6D710000|dcomp.dll |Microsoft DirectComposition Library |6.2.19041.906 |1448736 |2021-04-14 09:15:08|C:\Windows\System32\ | |6D880000|dataexchange.dll |Data exchange |6.2.19041.746 |183296 |2021-04-05 16:30:01|C:\Windows\System32\ | |6DAA0000|WinTypes.dll |Библиотека DLL основных типов Windows |6.2.19041.928 |896064 |2021-04-14 09:15:08|C:\Windows\System32\ | |6DB80000|olepro32.dll |OLEPRO32.DLL |6.2.19041.84 |88576 |2021-04-05 16:30:56|C:\Windows\System32\ | |6E220000|dxgi.dll |DirectX Graphics Infrastructure |6.2.19041.928 |784016 |2021-04-14 09:15:03|C:\Windows\System32\ | |6E2F0000|d3d11.dll |Direct3D 11 Runtime |6.2.19041.746 |1963736 |2021-04-05 16:30:06|C:\Windows\System32\ | |6E880000|hunspelldll.dll | | |223232 |2006-05-27 15:34:22|C:\Users\NIKoloskova\AppData\Local\NSS\MyChat Client\ | |711D0000|srvcli.dll |Server Service Client DLL |6.2.19041.546 |76952 |2021-04-05 16:30:39|C:\Windows\System32\ | |71270000|propsys.dll |Система страниц свойств (Майкрософт) |7.0.19041.746 |797472 |2021-04-05 16:30:16|C:\Windows\System32\ | |714C0000|usp10.dll |Uniscribe Unicode script processor |6.2.19041.546 |77824 |2021-04-05 16:30:45|C:\Windows\System32\ | |72E20000|TextShaping.dll | | |611952 |2021-04-05 16:30:10|C:\Windows\System32\ | |73110000|profapi.dll |User Profile Basic API |6.2.19041.844 |89360 |2021-04-05 16:29:39|C:\Windows\System32\ | |73160000|winrnr.dll |LDAP RnR Provider DLL |6.2.19041.546 |34304 |2021-04-05 16:30:47|C:\Windows\System32\ | |73170000|dwmapi.dll |Интерфейс API диспетчера окон рабочего стола (Майкрософт) |6.2.19041.746 |138936 |2021-04-05 16:30:37|C:\Windows\System32\ | |733D0000|wininet.dll |Расширения Интернета для Win32 |11.0.19041.844 |4534784 |2021-04-05 16:30:49|C:\Windows\System32\ | |73830000|nlaapi.dll |Network Location Awareness 2 |6.2.19041.546 |71168 |2021-04-05 16:30:56|C:\Windows\System32\ | |73850000|pnrpnsp.dll |Поставщик пространства имен PNRP |6.2.19041.546 |70656 |2021-04-05 16:32:37|C:\Windows\System32\ | |73AF0000|NapiNSP.dll |Поставщик оболочки совместимости для имен электронной почты |6.2.19041.546 |54784 |2021-04-05 16:30:00|C:\Windows\System32\ | |73B10000|winmmbase.dll |Базовая библиотека API расширения мультимедиа |6.2.19041.1 |110720 |2019-12-07 12:09:11|C:\Windows\System32\ | |73B30000|msacm32.dll |Фильтр диспетчера аудиосжатия Microsoft |6.2.19041.1 |93472 |2019-12-07 12:09:11|C:\Windows\System32\ | |73B50000|bass.dll |BASS |2.4.14.0 |127669 |2019-01-16 14:34:32|C:\Users\NIKoloskova\AppData\Local\NSS\MyChat Client\ | |73BB0000|comctl32.dll |Библиотека общих элементов управления |5.82.19041.844 |568144 |2021-04-05 16:31:06|C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.844_none_89e26e970b35ab92\| |73C40000|resourcepolicyclient.dll|Resource Policy Client |6.2.19041.546 |52664 |2021-04-05 16:30:05|C:\Windows\System32\ | |73D20000|winsta.dll |Winstation Library |6.2.19041.546 |270640 |2021-04-05 16:29:50|C:\Windows\System32\ | |73D70000|uxtheme.dll |Библиотека тем UxTheme (Microsoft) |6.2.19041.746 |453632 |2021-04-05 16:29:49|C:\Windows\System32\ | |73DF0000|comctl32.dll |Библиотека элементов управления взаимодействия с пользователем|6.10.19041.844 |2152248 |2021-04-05 16:31:06|C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.844_none_11adecdf30011423\ | |74000000|wshbth.dll |Windows Sockets Helper DLL |6.2.19041.546 |50688 |2021-04-05 16:30:28|C:\Windows\System32\ | |74010000|mpr.dll |Библиотека маршрутизации для нескольких служб доступа |6.2.19041.546 |93488 |2021-04-05 16:30:44|C:\Windows\System32\ | |74030000|oleacc.dll |Active Accessibility Core Component |7.2.19041.746 |321024 |2021-04-05 16:30:56|C:\Windows\System32\ | |74090000|winmm.dll |MCI API DLL |6.2.19041.546 |149272 |2021-04-05 16:29:38|C:\Windows\System32\ | |740C0000|winspool.drv |Драйвер диспетчера очереди Windows |6.2.19041.746 |422912 |2021-04-05 16:29:40|C:\Windows\System32\ | |74130000|FWPUCLNT.DLL |API пользовательского режима FWP/IPsec |6.2.19041.546 |342016 |2021-04-05 16:30:19|C:\Windows\System32\ | |74190000|rasadhlp.dll |Remote Access AutoDial Helper |6.2.19041.546 |12800 |2021-04-05 16:30:58|C:\Windows\System32\ | |741A0000|wkscli.dll |Workstation Service Client DLL |6.2.19041.546 |58856 |2021-04-05 16:30:40|C:\Windows\System32\ | |741B0000|netutils.dll |Net Win32 API Helpers DLL |6.2.19041.546 |37176 |2021-04-05 16:30:39|C:\Windows\System32\ | |741C0000|netapi32.dll |Net Win32 API DLL |6.2.19041.546 |68680 |2021-04-05 16:29:51|C:\Windows\System32\ | |741F0000|sspicli.dll |Security Support Provider Interface |6.2.19041.906 |123480 |2021-04-14 09:14:58|C:\Windows\System32\ | |74220000|secur32.dll |Security Support Provider Interface |6.2.19041.546 |23040 |2021-04-05 16:30:56|C:\Windows\System32\ | |74460000|wldp.dll |Политика блокировки Windows |6.2.19041.662 |139960 |2021-04-05 16:30:38|C:\Windows\System32\ | |74490000|windows.storage.dll |API хранения Microsoft WinRT |6.2.19041.906 |6363232 |2021-04-14 09:15:04|C:\Windows\System32\ | |74AA0000|cscapi.dll |Offline Files Win32 API |6.2.19041.546 |40960 |2021-04-05 16:30:59|C:\Windows\System32\ | |74AD0000|msimg32.dll |GDIEXT Client DLL |6.2.19041.546 |7168 |2021-04-05 16:30:45|C:\Windows\System32\ | |74B10000|ntmarta.dll |Поставщик Windows NT MARTA |6.2.19041.546 |152904 |2021-04-05 16:30:39|C:\Windows\System32\ | |74B50000|devobj.dll |Device Information Set DLL |6.2.19041.546 |138936 |2021-04-05 16:30:40|C:\Windows\System32\ | |74B80000|dnsapi.dll |Динамическая библиотека API DNS-клиента |6.2.19041.928 |588312 |2021-04-14 09:15:08|C:\Windows\System32\ | |74C20000|dhcpcsvc6.dll |Клиент DHCPv6 |6.2.19041.546 |61440 |2021-04-05 16:30:38|C:\Windows\System32\ | |74C40000|mswsock.dll |Расширение поставщика службы API Microsoft Windows Sockets 2.0|6.2.19041.546 |324416 |2021-04-05 16:30:38|C:\Windows\System32\ | |74CB0000|kernel.appcore.dll |AppModel API Host |6.2.19041.546 |52672 |2021-04-05 16:30:16|C:\Windows\System32\ | |74CC0000|dhcpcsvc.dll |Служба DHCP-клиента |6.2.19041.546 |73728 |2021-04-05 16:30:38|C:\Windows\System32\ | |74CE0000|IPHLPAPI.DLL |API вспомогательного приложения IP |6.2.19041.546 |196784 |2021-04-05 16:30:38|C:\Windows\System32\ | |74D20000|CRYPTBASE.dll |Base cryptographic API DLL |6.2.19041.546 |31528 |2021-04-05 16:29:39|C:\Windows\System32\ | |74D30000|rsaenh.dll |Microsoft Enhanced Cryptographic Provider |6.2.19041.546 |185912 |2021-04-05 16:30:39|C:\Windows\System32\ | |74D60000|detoured.dll |Marks process affected by Microsoft Research Detours Package |2.1.317.0 |29832 |2018-02-22 05:18:38|C:\Program Files (x86)\Common Files\Crypto Pro\AppCompat\ | |74D70000|cpcrypt.dll |Модуль исправления функционирования crypt32 |4.0.5228.0 |105176 |2018-02-22 05:18:38|C:\Program Files (x86)\Common Files\Crypto Pro\AppCompat\ | |74D90000|cpadvai.dll |Модуль исправления функционирования advapi32 |4.0.5233.0 |64640 |2018-02-22 05:18:36|C:\Program Files (x86)\Common Files\Crypto Pro\AppCompat\ | |74DA0000|cryptsp.dll |Cryptographic Service Provider API |6.2.19041.546 |68192 |2021-04-05 16:30:38|C:\Windows\System32\ | |74DC0000|wtsapi32.dll |Windows Remote Desktop Session Host Server SDK APIs |6.2.19041.546 |52664 |2021-04-05 16:29:50|C:\Windows\System32\ | |74DD0000|dbgcore.dll |Windows Core Debugging Helpers |6.2.19041.546 |138752 |2021-04-05 16:30:44|C:\Windows\System32\ | |74E00000|dbghelp.dll |Windows Image Helper |6.2.19041.867 |1494016 |2021-04-05 16:30:40|C:\Windows\System32\ | |74F90000|wer.dll |Библиотека сообщений об ошибках Windows |6.2.19041.906 |700368 |2021-04-14 09:15:09|C:\Windows\System32\ | |75040000|version.dll |Version Checking and File Installation Libraries |6.2.19041.546 |27320 |2021-04-05 16:31:06|C:\Windows\System32\ | |75050000|wsock32.dll |Windows Socket 32-Bit DLL |6.2.19041.1 |16384 |2019-12-07 12:09:15|C:\Windows\System32\ | |750C0000|clbcatq.dll |COM+ Configuration Catalog |2001.12.10941.16384|504552 |2021-04-05 16:30:36|C:\Windows\System32\ | |75140000|KERNELBASE.dll |Библиотека клиента Windows NT BASE API |6.2.19041.906 |2178600 |2021-04-14 09:14:32|C:\Windows\System32\ | |757A0000|bcryptPrimitives.dll |Windows Cryptographic Primitives Library |6.2.19041.662 |375000 |2021-04-05 16:28:35|C:\Windows\System32\ | |75800000|win32u.dll |Win32u |6.2.19041.906 |92960 |2021-04-14 09:15:06|C:\Windows\System32\ | |75820000|user32.dll |Многопользовательская библиотека клиента USER API Windows |6.2.19041.906 |1663656 |2021-04-14 09:15:06|C:\Windows\System32\ | |759C0000|shell32.dll |Общая библиотека оболочки Windows |6.2.19041.906 |6002256 |2021-04-14 09:15:12|C:\Windows\System32\ | |75F80000|gdi32full.dll |GDI Client DLL |6.2.19041.928 |895072 |2021-04-14 09:15:10|C:\Windows\System32\ | |76060000|shlwapi.dll |Библиотека небольших программ оболочки |6.2.19041.746 |275808 |2021-04-05 16:31:06|C:\Windows\System32\ | |76140000|normaliz.dll |Unicode Normalization DLL |6.2.19041.546 |5120 |2021-04-05 16:30:45|C:\Windows\System32\ | |76150000|gdi32.dll |GDI Client DLL |6.2.19041.746 |136328 |2021-04-05 16:30:10|C:\Windows\System32\ | |76180000|nsi.dll |NSI User-mode interface DLL |6.2.19041.610 |20144 |2021-04-05 16:28:34|C:\Windows\System32\ | |76190000|msvcrt.dll |Windows NT CRT DLL |7.0.19041.546 |775256 |2021-04-05 16:29:39|C:\Windows\System32\ | |76250000|cfgmgr32.dll |Configuration Manager DLL |6.2.19041.546 |236520 |2021-04-05 16:30:40|C:\Windows\System32\ | |76290000|SHCore.dll |SHCORE |6.2.19041.746 |548528 |2021-04-05 16:30:28|C:\Windows\System32\ | |76320000|comdlg32.dll |Библиотека общих диалоговых окон |6.2.19041.906 |688128 |2021-04-14 09:15:12|C:\Windows\System32\ | |763D0000|psapi.dll |Process Status Helper |6.2.19041.546 |17016 |2021-04-05 16:30:35|C:\Windows\System32\ | |763E0000|ole32.dll |Microsoft OLE для Windows |6.2.19041.746 |924528 |2021-04-05 16:30:36|C:\Windows\System32\ | |764D0000|sechost.dll |Host for SCM/SDDL/LSA Lookup APIs |6.2.19041.906 |475712 |2021-04-14 09:14:58|C:\Windows\System32\ | |76550000|msctf.dll |Серверная библиотека MSCTF |6.2.19041.906 |859392 |2021-04-14 09:14:59|C:\Windows\System32\ | |76630000|crypt32.dll |API32 криптографии |6.2.19041.844 |1044304 |2021-04-05 16:30:38|C:\Windows\System32\ | |76740000|kernel32.dll |Библиотека клиента Windows NT BASE API |6.2.19041.928 |632536 |2021-04-14 09:15:00|C:\Windows\System32\ | |76830000|advapi32.dll |Расширенная библиотека API Windows 32 |6.2.19041.610 |489128 |2021-04-05 16:29:41|C:\Windows\System32\ | |768D0000|msvcp_win.dll |Microsoft® C Runtime Library |6.2.19041.789 |495840 |2021-04-05 16:30:37|C:\Windows\System32\ | |76950000|rpcrt4.dll |Библиотека удаленного вызова процедур |6.2.19041.928 |785568 |2021-04-14 09:14:58|C:\Windows\System32\ | |76A10000|ws2_32.dll |32-разрядная библиотека Windows Socket 2.0 |6.2.19041.546 |397728 |2021-04-05 16:29:39|C:\Windows\System32\ | |76AE0000|combase.dll |Microsoft COM для Windows |6.2.19041.928 |2637728 |2021-04-14 09:15:08|C:\Windows\System32\ | |76DD0000|imagehlp.dll |Windows NT Image Helper |6.2.19041.546 |95496 |2021-04-05 16:28:34|C:\Windows\System32\ | |76DF0000|oleaut32.dll |OLEAUT32.DLL |6.2.19041.804 |606872 |2021-04-05 16:30:40|C:\Windows\System32\ | |76E90000|imm32.dll |Multi-User Windows IMM32 API Client DLL |6.2.19041.546 |143056 |2021-04-05 16:30:45|C:\Windows\System32\ | |77080000|ucrtbase.dll |Microsoft® C Runtime Library |6.2.19041.789 |1181208 |2021-04-05 16:30:37|C:\Windows\System32\ | |771B0000|ntdll.dll |Системная библиотека NT |6.2.19041.928 |1696264 |2021-04-14 09:14:58|C:\Windows\System32\ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Processes Information: ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |ID |Name |Description |Version |Memory |Priority|Threads|Path |User |Session| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |572 |fontdrvhost.exe |Usermode Font Driver Host |6.2.19041.906 |0 |Normal |6 |C:\Windows\SysNative\ | |1 | |748 |csrss.exe |Процесс исполнения клиент-сервер |6.2.19041.546 |0 |High |15 |C:\Windows\SysNative\ | |1 | |812 |winlogon.exe |Программа входа в систему Windows |6.2.19041.906 |0 |High |6 |C:\Windows\SysNative\ | |1 | |1096 |dwm.exe |Диспетчер окон рабочего стола |6.2.19041.746 |0 |High |21 |C:\Windows\SysNative\ | |1 | |1152 |QtWebEngineProcess.exe |Qt Qtwebengineprocess |5.12.9.0 |32329728 |Normal |18 |C:\Program Files (x86)\Nextcloud\ |NIKoloskova|1 | |1348 |SystemSettingsBroker.exe |System Settings Broker |6.2.19041.746 |17690624 |Normal |11 |C:\Windows\SysNative\ |NIKoloskova|1 | |2796 |svchost.exe |Хост-процесс для служб Windows |6.2.19041.546 |18464768 |Normal |8 |C:\Windows\System32\ |NIKoloskova|1 | |2936 |rundll32.exe |Хост-процесс Windows (Rundll32) |6.2.19041.746 |0 |Normal |4 |C:\Windows\SysNative\ | |1 | |5512 |RuntimeBroker.exe |Runtime Broker |6.2.19041.746 |12660736 |Normal |6 |C:\Windows\SysNative\ |NIKoloskova|1 | |6208 |ctfmon.exe |CTF-загрузчик |6.2.19041.1 |20766720 |High |12 |C:\Windows\System32\ |NIKoloskova|1 | |6340 |YourPhone.exe |YourPhone |1.21022.168.0 |65867776 |Normal |16 |C:\Program Files\WindowsApps\Microsoft.YourPhone_1.21022.168.0_x64__8wekyb3d8bbwe\|NIKoloskova|1 | |6372 |dllhost.exe |COM Surrogate |6.2.19041.546 |13365248 |Normal |14 |C:\Windows\System32\ |NIKoloskova|1 | |6676 |svchost.exe |Хост-процесс для служб Windows |6.2.19041.546 |23826432 |Normal |12 |C:\Windows\System32\ |NIKoloskova|1 | |6708 |svchost.exe |Хост-процесс для служб Windows |6.2.19041.546 |42655744 |Normal |15 |C:\Windows\System32\ |NIKoloskova|1 | |6816 |sihost.exe |Shell Infrastructure Host |6.2.19041.746 |28848128 |Normal |20 |C:\Windows\SysNative\ |NIKoloskova|1 | |6836 |taskhostw.exe |Хост-процесс для задач Windows |6.2.19041.906 |17117184 |Normal |13 |C:\Windows\SysNative\ |NIKoloskova|1 | |7096 |igfxEM.exe |igfxEM Module |6.15.100.8682 |23531520 |Normal |13 |C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_2cec8fd58a80e6ea\|NIKoloskova|1 | |7236 |explorer.exe |Проводник |6.2.19041.928 |121044992|Normal |64 |C:\Windows\ |NIKoloskova|1 | |7548 |OneDrive.exe |Microsoft OneDrive |21.52.314.1 |53383168 |Normal |32 |C:\Users\NIKoloskova\AppData\Local\Microsoft\OneDrive\ |NIKoloskova|1 | |7644 |RtkNGUI64.exe |Диспетчер Realtek HD |1.0.683.1 |14581760 |Normal |8 |C:\Program Files\Realtek\Audio\HDA\ |NIKoloskova|1 | |8536 |StartMenuExperienceHost.exe| | |95875072 |Normal |57 |C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\ |NIKoloskova|1 | |8816 |RuntimeBroker.exe |Runtime Broker |6.2.19041.746 |33054720 |Normal |22 |C:\Windows\SysNative\ |NIKoloskova|1 | |8968 |RuntimeBroker.exe |Runtime Broker |6.2.19041.746 |35893248 |Normal |17 |C:\Windows\SysNative\ |NIKoloskova|1 | |9000 |rrit_client.exe | |6.5.1.0 |25825280 |Normal |8 |C:\rrit\client\ |NIKoloskova|1 | |9180 |SearchApp.exe |Search application |6.2.19041.844 |183689216|Normal |39 |C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\ |NIKoloskova|1 | |9236 |nextcloud.exe |Nextcloud |3.0.2.15836 |159543296|Normal |40 |C:\Program Files (x86)\Nextcloud\ |NIKoloskova|1 | |9312 |RuntimeBroker.exe |Runtime Broker |6.2.19041.746 |24788992 |Normal |6 |C:\Windows\SysNative\ |NIKoloskova|1 | |9664 |SecurityHealthSystray.exe |Windows Security notification icon|6.2.19041.1 |9453568 |Normal |7 |C:\Windows\SysNative\ |NIKoloskova|1 | |9804 |mcclient.exe |mcclient |8.3.0.1 |160530432|Normal |29 |C:\Users\NIKoloskova\AppData\Local\NSS\MyChat Client\ |NIKoloskova|1 | |9884 |svchost.exe |Хост-процесс для служб Windows |6.2.19041.546 |9023488 |Normal |4 |C:\Windows\System32\ |NIKoloskova|1 | |9944 |ShellExperienceHost.exe |Windows Shell Experience Host |6.2.19041.610 |84066304 |Normal |39 |C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ |NIKoloskova|1 | |10064|RuntimeBroker.exe |Runtime Broker |6.2.19041.746 |29532160 |Normal |28 |C:\Windows\SysNative\ |NIKoloskova|1 | |10348|Taskmgr.exe |Диспетчер задач |6.2.19041.844 |59437056 |Normal |22 |C:\Windows\System32\ |NIKoloskova|1 | |10644|TextInputHost.exe | |2001.22012.0.551|54231040 |Normal |16 |C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\ |NIKoloskova|1 | |10992|GfxDownloadWrapper.exe |Intel(R) Graphics Control Panel |8.15.100.8682 |24977408 |Normal |14 |C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_2cec8fd58a80e6ea\|NIKoloskova|1 | |11000|conhost.exe |Хост окна консоли |6.2.19041.746 |10981376 |Normal |3 |C:\Windows\SysNative\ |NIKoloskova|1 | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Assembler Information: ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ; Base Address: $8B8000, Allocation Base: $400000, Region Size: 12173312 ; Allocation Protect: PAGE_EXECUTE_WRITECOPY, Protect: PAGE_EXECUTE_READ ; State: MEM_COMMIT, Type: MEM_IMAGE ; ; ; Vcl.Imaging.JpegError (Line=0 - Offset=25) ; ------------------------------------------ 008B896D 648920 MOV FS:[EAX], ESP 008B8970 8B03 MOV EAX, [EBX] 008B8972 8B4014 MOV EAX, [EAX+$14] 008B8975 8945F8 MOV [EBP-8], EAX 008B8978 C645FC00 MOV BYTE PTR [EBP-4], 0 008B897C 8D45F8 LEA EAX, [EBP-8] 008B897F 50 PUSH EAX 008B8980 6A00 PUSH 0 008B8982 8D55F4 LEA EDX, [EBP-$0C] 008B8985 A104DF5001 MOV EAX, [$0150DF04] ; Data as ANSI: '46Q..ы'; Data as UNICODE: '㘴ő﬚' 008B898A E841ABB5FF CALL -$4A54BF ; ($004134D0) System.LoadResString 008B898F 8B4DF4 MOV ECX, [EBP-$0C] 008B8992 B201 MOV DL, 1 008B8994 A1A0888B00 MOV EAX, [$008B88A0] ; Delphi Class "EJPEG" 008B8999 E87EF1BCFF CALL -$430E82 ; ($00487B1C) System.Exception.CreateFmt ; ; Line=0 - Offset=74 ; ------------------ 008B899E E86930B5FF CALL -$4ACF97 ; ($0040BA0C) System._RaiseExcept ; <-- EXCEPTION 008B89A3 33C0 XOR EAX, EAX 008B89A5 5A POP EDX 008B89A6 59 POP ECX 008B89A7 59 POP ECX 008B89A8 648910 MOV FS:[EAX], EDX 008B89AB 68C0898B00 PUSH $8B89C0 ; ($008B89C0) Vcl.Imaging.JpegError (Line=0) Data as ANSI: '[‹е]ГЌ@'; Data as UNICODE: '譛工跃@跃@跃@跃@ႋ줳䪉㍬觀ᑂ...' Vcl.Imaging.JpegError (Line=0) 008B89B0 8D45F4 LEA EAX, [EBP-$0C] 008B89B3 E8D439B5FF CALL -$4AC62C ; ($0040C38C) System._UStrClr Registers: ----------------------------- EAX: 00198F98 EDI: 00000000 EBX: 001991A0 ESI: 001991A0 ECX: 00000007 EBP: 00198FF4 EDX: 00000000 ESP: 00198F98 EIP: 7526A6E2 FLG: 00200212 EXP: 008B899E STK: 00198F98 Stack: Memory Dump: ------------------ --------------------------------------------------------------------------- 00198FD4: CCCCCCCC 008B899E: E8 69 30 B5 FF 33 C0 5A 59 59 64 89 10 68 C0 89 .i0..3.ZYYd..h.. 00198FD0: CCCCCCCC 008B89AE: 8B 00 8D 45 F4 E8 D4 39 B5 FF C3 E9 AA 2E B5 FF ...E...9........ 00198FCC: CCCCCCCC 008B89BE: EB F0 5B 8B E5 5D C3 8D 40 00 C3 8D 40 00 C3 8D ..[..]..@...@... 00198FC8: CCCCCCCC 008B89CE: 40 00 C3 8D 40 00 8B 10 33 C9 89 4A 6C 33 C0 89 @...@...3..Jl3.. 00198FC4: 00199028 008B89DE: 42 14 C3 8D 40 00 53 56 E8 5D 21 B5 FF 8B DA 8B B...@.SV.]!..... 00198FC0: 00199044 008B89EE: F0 8B 46 08 E8 BD 19 B5 FF B2 FC 22 D3 8B C6 E8 ..F........".... 00198FBC: 00000000 008B89FE: 46 61 DA FF 84 DB 7E 07 8B C6 E8 E3 20 B5 FF 5E Fa....~..... ..^ 00198FB8: 001991A0 008B8A0E: 5B C3 C3 8D 40 00 53 56 57 84 D2 74 08 83 C4 F0 [...@.SVW..t.... 00198FB4: 001991A0 008B8A1E: E8 7D 20 B5 FF 8B DA 8B F8 BE 4C DD 48 01 33 D2 .} .......L.H.3. 00198FB0: 099BB010 008B8A2E: 8B C7 E8 AB 22 DA FF 8B C7 E8 D0 11 00 00 0F B6 ...."........... 00198FAC: 008B89A3 008B8A3E: 06 88 47 4C 0F B6 46 01 88 47 45 8B 46 04 89 47 ..GL..F..GE.F..G 00198FA8: 00000007 008B8A4E: 50 8B 46 08 89 47 48 0F B6 46 0C 88 47 4D 0F B6 P.F..GH..F..GM.. 00198FA4: 7526A6E2 008B8A5E: 46 0D 88 47 4E 8B 46 10 89 47 54 0F B6 46 14 88 F..GN.F..GT..F.. 00198FA0: 00000000 008B8A6E: 47 44 8B C7 84 DB 74 0F E8 7D 20 B5 FF 64 8F 05 GD....t..} ..d.. 00198F9C: 00000001 008B8A7E: 00 00 00 00 83 C4 0C 8B C7 5F 5E 5B C3 90 53 56 ........._^[..SV 00198F98: 0EEDFADE 008B8A8E: E8 B5 20 B5 FF 8B DA 8B F0 8B 46 40 85 C0 74 06 .. .......F@..t.