EurekaLog 6.1.03 Application: ------------------------------------------------------- 1.1 Start Date : Tue, 25 Jun 2013 08:03:59 +0400 1.2 Name/Description: SASPlanet.Debug.exe 1.3 Version Number : 13.6.25.7316 1.4 Parameters : 1.5 Compilation Date: Tue, 25 Jun 2013 04:02:31 +0400 1.6 Up Time : 3 hours, 12 minutes, 29 seconds Exception: --------------------------------------------------------------------------------------------------------------------- 2.1 Date : Tue, 25 Jun 2013 11:16:28 +0400 2.2 Address : 00574519 2.3 Module Name : SASPlanet.Debug.exe 2.4 Module Version: 13.6.25.7316 2.5 Type : EAccessViolation 2.6 Message : Access violation at address 00574519 in module 'SASPlanet.Debug.exe'. Read of address 00000000. 2.7 ID : 57A8 2.8 Count : 1 2.9 Status : New 2.10 Note : User: ------------------------------------------------------- 3.5 Privileges: SeIncreaseQuotaPrivilege - OFF SeSecurityPrivilege - OFF SeTakeOwnershipPrivilege - OFF SeLoadDriverPrivilege - OFF SeSystemProfilePrivilege - OFF SeSystemtimePrivilege - OFF SeProfileSingleProcessPrivilege - OFF SeIncreaseBasePriorityPrivilege - OFF SeCreatePagefilePrivilege - OFF SeBackupPrivilege - OFF SeRestorePrivilege - OFF SeShutdownPrivilege - OFF SeDebugPrivilege - OFF SeSystemEnvironmentPrivilege - OFF SeChangeNotifyPrivilege - ON SeRemoteShutdownPrivilege - OFF SeUndockPrivilege - OFF SeManageVolumePrivilege - OFF SeImpersonatePrivilege - ON SeCreateGlobalPrivilege - ON SeIncreaseWorkingSetPrivilege - OFF SeTimeZonePrivilege - OFF SeCreateSymbolicLinkPrivilege - OFF Computer: ----------------------------------------------------------------------------- 5.3 Free Memory : 1178 Mb 5.5 Free Disk : 7,22 Gb 5.7 Processor : Intel(R) Core(TM) i3-2100 CPU @ 3.10GHz 5.8 Display Mode: 1280 x 1024, 32 bit 5.9 Display DPI : 96 5.10 Video Card : NVIDIA GeForce 8600 GT (driver 8.17.12.7533 - RAM 256 MB) Operating System: ----------------------------------- 6.1 Type : Microsoft Windows 7 6.2 Build # : 7600 6.3 Update : 6.4 Language: Russian 6.5 Charset : 204 Call Stack Information: -------------------------------------------------------------------------------------------------------------------------------- |Address |Module |Unit |Class |Procedure/Method |Line | -------------------------------------------------------------------------------------------------------------------------------- |*Exception Thread: ID=2132; Priority=0; Class=TGarbageCollectorThread | |------------------------------------------------------------------------------------------------------------------------------| |00574519|SASPlanet.Debug.exe|u_BerkeleyDBPool.pas |TBerkeleyDBPool |Sync |260[12] | |0058B353|SASPlanet.Debug.exe|u_TileStorageBerkeleyDBHelper.pas|TTileStorageBerkeleyDBHelper|Sync |837[5] | |0058C4FD|SASPlanet.Debug.exe|u_TileStorageBerkeleyDB.pas |TTileStorageBerkeleyDB |OnSyncCall |247[9] | |771AF25E|kernel32.dll | | |GetCurrentThreadId | | |0056F959|SASPlanet.Debug.exe|u_SimpleFlagWithInterlock.pas |TSimpleFlagWithInterlock |CheckFlagAndReset |64[1] | |0056FC98|SASPlanet.Debug.exe|u_ListenerTime.pas |TListenerTTLCheck |Notification |79[9] | |005A9FCE|SASPlanet.Debug.exe|u_NotifierTime.pas |TNotifierTime |Notify |100[12] | |006D1E34|SASPlanet.Debug.exe|u_GarbageCollectorThread.pas |TGarbageCollectorThread |Execute |113[6] | |775956AA|ntdll.dll | | |ZwQueryVirtualMemory | | |7572853D|KERNELBASE.dll | | |VirtualQueryEx | | |771AF212|kernel32.dll | | |GetCurrentThreadId | | |77595A2A|ntdll.dll | | |ZwSetEvent | | |757267A4|KERNELBASE.dll | | |GetCurrentThreadId | | |771B1172|kernel32.dll | | |BaseThreadInitThunk | | |------------------------------------------------------------------------------------------------------------------------------| |Calling Thread: ID=6936; Priority=1; Class=; [Main] | |------------------------------------------------------------------------------------------------------------------------------| |006D1D41|SASPlanet.Debug.exe|u_GarbageCollectorThread.pas |TGarbageCollectorThread |Create |85[14] | |006D1CA0|SASPlanet.Debug.exe|u_GarbageCollectorThread.pas |TGarbageCollectorThread |Create |71[0] | |007D26CE|SASPlanet.Debug.exe|u_GlobalState.pas |TGlobalState |Create |512[169] | |007D1D2C|SASPlanet.Debug.exe|u_GlobalState.pas |TGlobalState |Create |343[0] | |0087E9E4|SASPlanet.Debug.exe|SASPlanet.dpr | | |1096[5] | |771B1172|kernel32.dll | | |BaseThreadInitThunk | | |------------------------------------------------------------------------------------------------------------------------------| | | |Running Thread: ID=6936; Priority=1; Class=; [Main] | |------------------------------------------------------------------------------------------------------------------------------| |773B93F1|USER32.dll | | |WaitMessage | | |773B93E7|USER32.dll | | |WaitMessage | | |0087EB2F|SASPlanet.Debug.exe|SASPlanet.dpr | | |1120[29] | |771B1172|kernel32.dll | | |BaseThreadInitThunk | | |------------------------------------------------------------------------------------------------------------------------------| | | |Running Thread: ID=3912; Priority=-15; Class=TThread4InterfacedThread | |------------------------------------------------------------------------------------------------------------------------------| |77595E4A|ntdll.dll | | |NtWaitForMultipleObjects| | |7572686C|KERNELBASE.dll | | |GetProcessHeap | | |757268C6|KERNELBASE.dll | | |WaitForMultipleObjectsEx| | |771AF09C|kernel32.dll | | |TlsGetValue | | |771AF299|kernel32.dll | | |GetCurrentThreadId | | |771AF286|kernel32.dll | | |GetCurrentThreadId | | |006AE51A|SASPlanet.Debug.exe|u_BackgroundTask.pas |TBackgroundTask |Execute |129[5] | |0063D35B|SASPlanet.Debug.exe|u_InterfacedThread.pas |TThread4InterfacedThread |Execute |228[7] | |771B1172|kernel32.dll | | |BaseThreadInitThunk | | |------------------------------------------------------------------------------------------------------------------------------| |Calling Thread: ID=6936; Priority=1; Class=; [Main] | |------------------------------------------------------------------------------------------------------------------------------| |0063D394|SASPlanet.Debug.exe|u_InterfacedThread.pas |TThread4InterfacedThread |Start |241[3] | |0063D37C|SASPlanet.Debug.exe|u_InterfacedThread.pas |TThread4InterfacedThread |Start |238[0] | |0063D225|SASPlanet.Debug.exe|u_InterfacedThread.pas |TInterfacedThread |Start |176[6] | |007D3436|SASPlanet.Debug.exe|u_GlobalState.pas |TGlobalState |StartThreads |784[5] | |007D33E4|SASPlanet.Debug.exe|u_GlobalState.pas |TGlobalState |StartThreads |779[0] | |00863BBD|SASPlanet.Debug.exe|frm_Main.pas |TfrmMain |FormActivate |1323[192]| |773ACC6C|USER32.dll | | |SendMessageA | | |773ACC28|USER32.dll | | |SendMessageA | | |773ACBB3|USER32.dll | | |SetFocus | | |773ACBA9|USER32.dll | | |SetFocus | | |773AE133|USER32.dll | | |DefWindowProcA | | |773B1484|USER32.dll | | |ShowWindow | | |773B147A|USER32.dll | | |ShowWindow | | |77596B40|ntdll.dll | | |RtlLeaveCriticalSection | | |773BF006|USER32.dll | | |IntersectRect | | |775AEB05|ntdll.dll | | |LdrGetProcedureAddressEx| | |775AEE3A|ntdll.dll | | |LdrGetProcedureAddress | | |773B593C|USER32.dll | | |MonitorFromWindow | | |773B5952|USER32.dll | | |MonitorFromWindow | | |0087EB2F|SASPlanet.Debug.exe|SASPlanet.dpr | | |1120[29] | |771B1172|kernel32.dll | | |BaseThreadInitThunk | | |------------------------------------------------------------------------------------------------------------------------------| | | |Running Thread: ID=9552; Priority=0; Class=TThread4InterfacedThread | |------------------------------------------------------------------------------------------------------------------------------| |77595E4A|ntdll.dll | | |NtWaitForMultipleObjects| | |7572686C|KERNELBASE.dll | | |GetProcessHeap | | |006C4470|SASPlanet.Debug.exe|u_TiledLayerWithThreadBase.pas |TTiledLayerWithThreadBase |PrepareTileMatrix |463[33] | |757268C6|KERNELBASE.dll | | |WaitForMultipleObjectsEx| | |006C4060|SASPlanet.Debug.exe|u_TiledLayerWithThreadBase.pas |TTiledLayerWithThreadBase |OnPrepareTileMatrix |364[46] | |771AF09C|kernel32.dll | | |TlsGetValue | | |771AF299|kernel32.dll | | |GetCurrentThreadId | | |771AF286|kernel32.dll | | |GetCurrentThreadId | | |006AE51A|SASPlanet.Debug.exe|u_BackgroundTask.pas |TBackgroundTask |Execute |129[5] | |0063D35B|SASPlanet.Debug.exe|u_InterfacedThread.pas |TThread4InterfacedThread |Execute |228[7] | |771B1172|kernel32.dll | | |BaseThreadInitThunk | | |------------------------------------------------------------------------------------------------------------------------------| |Calling Thread: ID=6936; Priority=1; Class=; [Main] | |------------------------------------------------------------------------------------------------------------------------------| |0063D394|SASPlanet.Debug.exe|u_InterfacedThread.pas |TThread4InterfacedThread |Start |241[3] | |0063D37C|SASPlanet.Debug.exe|u_InterfacedThread.pas |TThread4InterfacedThread |Start |238[0] | |0063D225|SASPlanet.Debug.exe|u_InterfacedThread.pas |TInterfacedThread |Start |176[6] | |006C4CE6|SASPlanet.Debug.exe|u_TiledLayerWithThreadBase.pas |TTiledLayerWithThreadBase |StartThreads |666[2] | |006C4CD4|SASPlanet.Debug.exe|u_TiledLayerWithThreadBase.pas |TTiledLayerWithThreadBase |StartThreads |664[0] | |00801D30|SASPlanet.Debug.exe|u_MapLayerBitmapMaps.pas |TMapLayerBitmapMaps |StartThreads |206[2] | |006C2772|SASPlanet.Debug.exe|u_WindowLayerBasic.pas |TWindowLayerAbstract |OnAppStarted |112[1] | |005703F2|SASPlanet.Debug.exe|u_ListenerByEvent.pas |TNotifyNoMmgEventListener |Notification |157[1] | |00584EBA|SASPlanet.Debug.exe|u_Notifier.pas |TNotifierBase |Notify |87[10] | |005A9B4A|SASPlanet.Debug.exe|u_NotifierOperation.pas |TNotifierOneOperation |ExecuteOperation |165[10] | |007D3404|SASPlanet.Debug.exe|u_GlobalState.pas |TGlobalState |StartThreads |780[1] | |007D33E4|SASPlanet.Debug.exe|u_GlobalState.pas |TGlobalState |StartThreads |779[0] | |00863BBD|SASPlanet.Debug.exe|frm_Main.pas |TfrmMain |FormActivate |1323[192]| |773ACC6C|USER32.dll | | |SendMessageA | | |773ACC28|USER32.dll | | |SendMessageA | | |773ACBB3|USER32.dll | | |SetFocus | | |773ACBA9|USER32.dll | | |SetFocus | | |773AE133|USER32.dll | | |DefWindowProcA | | |773B1484|USER32.dll | | |ShowWindow | | |773B147A|USER32.dll | | |ShowWindow | | |77596B40|ntdll.dll | | |RtlLeaveCriticalSection | | |773BF006|USER32.dll | | |IntersectRect | | |775AEB05|ntdll.dll | | |LdrGetProcedureAddressEx| | |775AEE3A|ntdll.dll | | |LdrGetProcedureAddress | | |773B593C|USER32.dll | | |MonitorFromWindow | | |773B5952|USER32.dll | | |MonitorFromWindow | | |0087EB2F|SASPlanet.Debug.exe|SASPlanet.dpr | | |1120[29] | |771B1172|kernel32.dll | | |BaseThreadInitThunk | | |------------------------------------------------------------------------------------------------------------------------------| | | |Running Thread: ID=6980; Priority=0; Class=TThread4InterfacedThread | |------------------------------------------------------------------------------------------------------------------------------| |77595E4A|ntdll.dll | | |NtWaitForMultipleObjects| | |7572686C|KERNELBASE.dll | | |GetProcessHeap | | |006C4470|SASPlanet.Debug.exe|u_TiledLayerWithThreadBase.pas |TTiledLayerWithThreadBase |PrepareTileMatrix |463[33] | |757268C6|KERNELBASE.dll | | |WaitForMultipleObjectsEx| | |006C4060|SASPlanet.Debug.exe|u_TiledLayerWithThreadBase.pas |TTiledLayerWithThreadBase |OnPrepareTileMatrix |364[46] | |771AF09C|kernel32.dll | | |TlsGetValue | | |771AF299|kernel32.dll | | |GetCurrentThreadId | | |771AF286|kernel32.dll | | |GetCurrentThreadId | | |006AE51A|SASPlanet.Debug.exe|u_BackgroundTask.pas |TBackgroundTask |Execute |129[5] | |0063D35B|SASPlanet.Debug.exe|u_InterfacedThread.pas |TThread4InterfacedThread |Execute |228[7] | |771B1172|kernel32.dll | | |BaseThreadInitThunk | | |------------------------------------------------------------------------------------------------------------------------------| |Calling Thread: ID=6936; Priority=1; Class=; [Main] | |------------------------------------------------------------------------------------------------------------------------------| |0063D394|SASPlanet.Debug.exe|u_InterfacedThread.pas |TThread4InterfacedThread |Start |241[3] | |0063D37C|SASPlanet.Debug.exe|u_InterfacedThread.pas |TThread4InterfacedThread |Start |238[0] | |0063D225|SASPlanet.Debug.exe|u_InterfacedThread.pas |TInterfacedThread |Start |176[6] | |006C4CE6|SASPlanet.Debug.exe|u_TiledLayerWithThreadBase.pas |TTiledLayerWithThreadBase |StartThreads |666[2] | |006C4CD4|SASPlanet.Debug.exe|u_TiledLayerWithThreadBase.pas |TTiledLayerWithThreadBase |StartThreads |664[0] | |007F6ACD|SASPlanet.Debug.exe|u_MapLayerGrids.pas |TMapLayerGrids |StartThreads |217[1] | |006C2772|SASPlanet.Debug.exe|u_WindowLayerBasic.pas |TWindowLayerAbstract |OnAppStarted |112[1] | |005703F2|SASPlanet.Debug.exe|u_ListenerByEvent.pas |TNotifyNoMmgEventListener |Notification |157[1] | |00584EBA|SASPlanet.Debug.exe|u_Notifier.pas |TNotifierBase |Notify |87[10] | |005A9B4A|SASPlanet.Debug.exe|u_NotifierOperation.pas |TNotifierOneOperation |ExecuteOperation |165[10] | |007D3404|SASPlanet.Debug.exe|u_GlobalState.pas |TGlobalState |StartThreads |780[1] | |007D33E4|SASPlanet.Debug.exe|u_GlobalState.pas |TGlobalState |StartThreads |779[0] | |00863BBD|SASPlanet.Debug.exe|frm_Main.pas |TfrmMain |FormActivate |1323[192]| |773ACC6C|USER32.dll | | |SendMessageA | | |773ACC28|USER32.dll | | |SendMessageA | | |773ACBB3|USER32.dll | | |SetFocus | | |773ACBA9|USER32.dll | | |SetFocus | | |773AE133|USER32.dll | | |DefWindowProcA | | |773B1484|USER32.dll | | |ShowWindow | | |773B147A|USER32.dll | | |ShowWindow | | |77596B40|ntdll.dll | | |RtlLeaveCriticalSection | | |773BF006|USER32.dll | | |IntersectRect | | |775AEB05|ntdll.dll | | |LdrGetProcedureAddressEx| | |775AEE3A|ntdll.dll | | |LdrGetProcedureAddress | | |773B593C|USER32.dll | | |MonitorFromWindow | | |773B5952|USER32.dll | | |MonitorFromWindow | | |0087EB2F|SASPlanet.Debug.exe|SASPlanet.dpr | | |1120[29] | |771B1172|kernel32.dll | | |BaseThreadInitThunk | | |------------------------------------------------------------------------------------------------------------------------------| | | |Running Thread: ID=4052; Priority=-2; Class=TThread4InterfacedThread | |------------------------------------------------------------------------------------------------------------------------------| |006C3D78|SASPlanet.Debug.exe|u_TiledLayerWithThreadBase.pas |TTiledLayerWithThreadBase |GetTileMatrix |287[0] | |006C3E66|SASPlanet.Debug.exe|u_TiledLayerWithThreadBase.pas |TTiledLayerWithThreadBase |OnPrepareTileMatrix |322[4] | |006C4060|SASPlanet.Debug.exe|u_TiledLayerWithThreadBase.pas |TTiledLayerWithThreadBase |OnPrepareTileMatrix |364[46] | |771AF09C|kernel32.dll | | |TlsGetValue | | |771AF299|kernel32.dll | | |GetCurrentThreadId | | |771AF286|kernel32.dll | | |GetCurrentThreadId | | |006AE51A|SASPlanet.Debug.exe|u_BackgroundTask.pas |TBackgroundTask |Execute |129[5] | |0063D35B|SASPlanet.Debug.exe|u_InterfacedThread.pas |TThread4InterfacedThread |Execute |228[7] | |771B1172|kernel32.dll | | |BaseThreadInitThunk | | |------------------------------------------------------------------------------------------------------------------------------| |Calling Thread: ID=6936; Priority=1; Class=; [Main] | |------------------------------------------------------------------------------------------------------------------------------| |0063D394|SASPlanet.Debug.exe|u_InterfacedThread.pas |TThread4InterfacedThread |Start |241[3] | |0063D37C|SASPlanet.Debug.exe|u_InterfacedThread.pas |TThread4InterfacedThread |Start |238[0] | |0063D225|SASPlanet.Debug.exe|u_InterfacedThread.pas |TInterfacedThread |Start |176[6] | |006C4CE6|SASPlanet.Debug.exe|u_TiledLayerWithThreadBase.pas |TTiledLayerWithThreadBase |StartThreads |666[2] | |006C4CD4|SASPlanet.Debug.exe|u_TiledLayerWithThreadBase.pas |TTiledLayerWithThreadBase |StartThreads |664[0] | |006CA345|SASPlanet.Debug.exe|u_MapLayerVectorMaps.pas |TMapLayerVectorMaps |StartThreads |505[1] | |006C2772|SASPlanet.Debug.exe|u_WindowLayerBasic.pas |TWindowLayerAbstract |OnAppStarted |112[1] | |005703F2|SASPlanet.Debug.exe|u_ListenerByEvent.pas |TNotifyNoMmgEventListener |Notification |157[1] | |00584EBA|SASPlanet.Debug.exe|u_Notifier.pas |TNotifierBase |Notify |87[10] | |005A9B4A|SASPlanet.Debug.exe|u_NotifierOperation.pas |TNotifierOneOperation |ExecuteOperation |165[10] | |007D3404|SASPlanet.Debug.exe|u_GlobalState.pas |TGlobalState |StartThreads |780[1] | |007D33E4|SASPlanet.Debug.exe|u_GlobalState.pas |TGlobalState |StartThreads |779[0] | |00863BBD|SASPlanet.Debug.exe|frm_Main.pas |TfrmMain |FormActivate |1323[192]| |773ACC6C|USER32.dll | | |SendMessageA | | |773ACC28|USER32.dll | | |SendMessageA | | |773ACBB3|USER32.dll | | |SetFocus | | |773ACBA9|USER32.dll | | |SetFocus | | |773AE133|USER32.dll | | |DefWindowProcA | | |773B1484|USER32.dll | | |ShowWindow | | |773B147A|USER32.dll | | |ShowWindow | | |77596B40|ntdll.dll | | |RtlLeaveCriticalSection | | |773BF006|USER32.dll | | |IntersectRect | | |775AEB05|ntdll.dll | | |LdrGetProcedureAddressEx| | |775AEE3A|ntdll.dll | | |LdrGetProcedureAddress | | |773B593C|USER32.dll | | |MonitorFromWindow | | |773B5952|USER32.dll | | |MonitorFromWindow | | |0087EB2F|SASPlanet.Debug.exe|SASPlanet.dpr | | |1120[29] | |771B1172|kernel32.dll | | |BaseThreadInitThunk | | |------------------------------------------------------------------------------------------------------------------------------| | | |Running Thread: ID=2040; Priority=-2; Class=TThread4InterfacedThread | |------------------------------------------------------------------------------------------------------------------------------| |006C3D78|SASPlanet.Debug.exe|u_TiledLayerWithThreadBase.pas |TTiledLayerWithThreadBase |GetTileMatrix |287[0] | |006C3E66|SASPlanet.Debug.exe|u_TiledLayerWithThreadBase.pas |TTiledLayerWithThreadBase |OnPrepareTileMatrix |322[4] | |006C4060|SASPlanet.Debug.exe|u_TiledLayerWithThreadBase.pas |TTiledLayerWithThreadBase |OnPrepareTileMatrix |364[46] | |771AF09C|kernel32.dll | | |TlsGetValue | | |771AF299|kernel32.dll | | |GetCurrentThreadId | | |771AF286|kernel32.dll | | |GetCurrentThreadId | | |006AE51A|SASPlanet.Debug.exe|u_BackgroundTask.pas |TBackgroundTask |Execute |129[5] | |0063D35B|SASPlanet.Debug.exe|u_InterfacedThread.pas |TThread4InterfacedThread |Execute |228[7] | |771B1172|kernel32.dll | | |BaseThreadInitThunk | | |------------------------------------------------------------------------------------------------------------------------------| |Calling Thread: ID=6936; Priority=1; Class=; [Main] | |------------------------------------------------------------------------------------------------------------------------------| |0063D394|SASPlanet.Debug.exe|u_InterfacedThread.pas |TThread4InterfacedThread |Start |241[3] | |0063D37C|SASPlanet.Debug.exe|u_InterfacedThread.pas |TThread4InterfacedThread |Start |238[0] | |0063D225|SASPlanet.Debug.exe|u_InterfacedThread.pas |TInterfacedThread |Start |176[6] | |006C4CE6|SASPlanet.Debug.exe|u_TiledLayerWithThreadBase.pas |TTiledLayerWithThreadBase |StartThreads |666[2] | |006C4CD4|SASPlanet.Debug.exe|u_TiledLayerWithThreadBase.pas |TTiledLayerWithThreadBase |StartThreads |664[0] | |00802061|SASPlanet.Debug.exe|u_MapLayerFillingMap.pas |TMapLayerFillingMap |StartThreads |132[1] | |006C2772|SASPlanet.Debug.exe|u_WindowLayerBasic.pas |TWindowLayerAbstract |OnAppStarted |112[1] | |005703F2|SASPlanet.Debug.exe|u_ListenerByEvent.pas |TNotifyNoMmgEventListener |Notification |157[1] | |00584EBA|SASPlanet.Debug.exe|u_Notifier.pas |TNotifierBase |Notify |87[10] | |005A9B4A|SASPlanet.Debug.exe|u_NotifierOperation.pas |TNotifierOneOperation |ExecuteOperation |165[10] | |007D3404|SASPlanet.Debug.exe|u_GlobalState.pas |TGlobalState |StartThreads |780[1] | |007D33E4|SASPlanet.Debug.exe|u_GlobalState.pas |TGlobalState |StartThreads |779[0] | |00863BBD|SASPlanet.Debug.exe|frm_Main.pas |TfrmMain |FormActivate |1323[192]| |77596B40|ntdll.dll | | |RtlLeaveCriticalSection | | |773ACC6C|USER32.dll | | |SendMessageA | | |773ACC28|USER32.dll | | |SendMessageA | | -------------------------------------------------------------------------------------------------------------------------------- Modules Information: ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |Handle |Name |Description |Version |Size |Modified |Path | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |001F0000|zlib1.dll |zlib data compression library |1.2.7.0 |66048 |2013-05-19 04:01:10|T:\GoogleMV | |00400000|SASPlanet.Debug.exe| |13.6.25.7316 |5687808 |2013-06-25 04:02:34|T:\GoogleMV | |01D10000|TileStorage_GE.dll | |1.0.0.9 |123392 |2012-11-05 20:39:18|T:\GoogleMV | |01D40000|f1ct.dll | | |127488 |2012-11-03 19:25:20|T:\GoogleMV | |02C70000|TileStorage_GC.dll | |1.0.0.8 |163840 |2012-11-05 20:39:12|T:\GoogleMV | |0E6D0000|libdb51.dll |Berkeley DB 5.1 DLL |5.0.1.29 |1088000 |2013-05-19 04:01:10|T:\GoogleMV | |0F000000|detoured.dll |Marks process affected by Microsoft Research Detours Package |2.1.0.207 |9728 |2009-04-02 00:58:34|C:\Program Files\Crypto Pro\CSP | |10000000|FreeImage.dll |FreeImage library |3.15.3.0 |322560 |2013-05-19 04:01:10|T:\GoogleMV | |611B0000|cpcrypt.dll |Модуль исправления функционирования crypt32 |3.6.4349.0 |80896 |2009-04-24 00:14:24|C:\Program Files\Crypto Pro\CSP | |61780000|cpwinet.dll |Модуль исправления функционирования wininet.dll |3.6.4228.0 |69120 |2009-04-24 00:16:38|C:\Program Files\Crypto Pro\CSP | |671B0000|mshtml.dll |Средство просмотра HTML Microsoft® |8.0.7600.16385 |5957632 |2009-07-14 05:15:46|C:\Windows\System32 | |6A4A0000|ieframe.dll |Интернет-обозреватель |8.0.7600.16385 |10973696|2009-07-14 05:15:30|C:\Windows\System32 | |6B2B0000|rasman.dll |Remote Access Connection Manager |6.1.7600.16385 |76800 |2009-07-14 05:16:14|C:\Windows\system32 | |6B980000|proj480.dll | | |193024 |2013-05-19 04:01:10|T:\GoogleMV | |6BAB0000|MSVCP90.dll |Microsoft® C++ Runtime Library |9.0.30729.6161 |569680 |2012-12-13 14:56:50|C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57 | |6C010000|libpng15.dll |PNG image compression library |1.5.12.0 |135680 |2013-05-19 04:01:10|T:\GoogleMV | |6C8F0000|msls31.dll |Microsoft Line Services library file |3.10.349.0 |157184 |2009-07-14 05:15:46|C:\Windows\System32 | |6CC90000|jpeg62.dll | | |244736 |2013-05-19 04:01:10|T:\GoogleMV | |6E7A0000|msimtf.dll |Active IMM Server DLL |6.1.7600.16385 |31232 |2009-07-14 05:15:46|C:\Windows\system32 | |6F2B0000|RASAPI32.dll |Remote Access API |6.1.7600.16385 |325120 |2009-07-14 05:16:14|C:\Windows\system32 | |723F0000|sensapi.dll |SENS Connectivity API DLL |6.1.7600.16385 |10752 |2009-07-14 05:16:14|C:\Windows\system32 | |725F0000|winspool.drv |Драйвер диспетчера очереди Windows |6.1.7600.16385 |319488 |2009-07-14 05:14:10|C:\Windows\system32 | |726A0000|wsock32.dll |Windows Socket 32-Bit DLL |6.1.7600.16385 |15360 |2009-07-14 05:16:22|C:\Windows\system32 | |72B50000|MSVCR90.dll |Microsoft® C Runtime Library |9.0.30729.6161 |653136 |2012-12-13 14:56:50|C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57 | |72C20000|rasadhlp.dll |Remote Access AutoDial Helper |6.1.7600.16385 |11776 |2009-07-14 05:16:14|C:\Windows\system32 | |73160000|fwpuclnt.dll |API пользовательского режима FWP/IPsec |6.1.7600.16385 |216576 |2009-07-14 05:15:22|C:\Windows\System32 | |73440000|iphlpapi.DLL |IP Helper API |6.1.7600.16385 |103936 |2009-07-14 05:15:34|C:\Windows\system32 | |73690000|WINNSI.DLL |Network Store Information RPC interface |6.1.7600.16385 |16896 |2009-07-14 05:16:20|C:\Windows\system32 | |73870000|NLAapi.dll |Network Location Awareness 2 |6.1.7600.16385 |51712 |2009-07-14 05:16:04|C:\Windows\system32 | |73960000|winmm.dll |MCI API DLL |6.1.7600.16385 |194048 |2009-07-14 05:16:20|C:\Windows\system32 | |739A0000|ntmarta.dll |Поставщик Windows NT MARTA |6.1.7600.16385 |121856 |2009-07-14 05:16:12|C:\Windows\system32 | |739D0000|msimg32.dll |GDIEXT Client DLL |6.1.7600.16385 |4608 |2009-07-14 05:15:46|C:\Windows\system32 | |73A70000|OLEACC.dll |Active Accessibility Core Component |7.0.0.0 |233472 |2009-07-14 05:16:14|C:\Windows\System32 | |73AB0000|rtutils.dll |Routing Utilities |6.1.7600.16385 |37376 |2009-07-14 05:16:14|C:\Windows\system32 | |73B00000|mlang.dll |Библиотека DLL многоязыковой поддержки |6.1.7600.16385 |177664 |2009-07-14 05:15:42|C:\Windows\system32 | |73C50000|olepro32.dll | |6.1.7600.16385 |90112 |2009-07-14 05:16:14|C:\Windows\system32 | |74140000|uxtheme.dll |Библиотека тем UxTheme (Microsoft) |6.1.7600.16385 |249856 |2009-07-14 05:16:18|C:\Windows\system32 | |74180000|propsys.dll |Система страниц свойств (Microsoft) |7.0.7600.16385 |988160 |2009-07-14 05:16:14|C:\Windows\system32 | |74770000|version.dll |Version Checking and File Installation Libraries |6.1.7600.16385 |21504 |2009-07-14 05:16:18|C:\Windows\system32 | |74800000|wshtcpip.dll |Библиотека DLL помощника службы Winsock2 (TL/IPv4) |6.1.7600.16385 |9216 |2009-07-14 05:16:22|C:\Windows\System32 | |74A80000|comctl32.dll |Библиотека элементов управления взаимодействия с пользователем|6.10.7600.16385 |1680896 |2009-07-14 05:03:52|C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc| |74D30000|dnsapi.DLL |Динамическая библиотека API DNS-клиента |6.1.7600.16385 |269824 |2009-07-14 05:15:14|C:\Windows\system32 | |74E60000|wship6.dll |Библиотека DLL помощника Winsock2 (TL/IPv6) |6.1.7600.16385 |10752 |2009-07-14 05:16:22|C:\Windows\System32 | |74E70000|mswsock.dll |Расширение поставщика службы API Microsoft Windows Sockets 2.0|6.1.7600.16385 |232448 |2009-07-14 05:15:52|C:\Windows\system32 | |75580000|SspiCli.dll |Security Support Provider Interface |6.1.7600.16385 |99840 |2009-07-14 05:16:16|C:\Windows\system32 | |755A0000|apphelp.dll |Клиентская библиотека совместимости приложений |6.1.7600.16385 |292352 |2009-07-14 05:14:54|C:\Windows\system32 | |755F0000|CRYPTBASE.dll |Base cryptographic API DLL |6.1.7600.16385 |36864 |2009-07-14 05:15:08|C:\Windows\system32 | |75600000|SXS.DLL |Fusion 2.5 |6.1.7600.16385 |380416 |2009-07-14 05:16:16|C:\Windows\system32 | |756A0000|profapi.dll |User Profile Basic API |6.1.7600.16385 |31744 |2009-07-14 05:16:14|C:\Windows\system32 | |75710000|MSASN1.dll |ASN.1 Runtime APIs |6.1.7600.16385 |33280 |2009-07-14 05:15:44|C:\Windows\system32 | |75720000|KERNELBASE.dll |Библиотека клиента Windows NT BASE API |6.1.7600.16385 |288256 |2009-07-14 05:15:36|C:\Windows\system32 | |75770000|CFGMGR32.dll |Configuration Manager DLL |6.1.7600.16385 |145920 |2009-07-14 05:15:04|C:\Windows\system32 | |757A0000|CRYPT32.dll |API32 криптографии |6.1.7600.16385 |1151488 |2009-07-14 05:15:08|C:\Windows\system32 | |75980000|DEVOBJ.dll |Device Information Set DLL |6.1.7600.16385 |64512 |2009-07-14 05:15:12|C:\Windows\system32 | |759A0000|iertutil.dll |Run time utility for Internet Explorer |8.0.7600.16385 |2058240 |2009-07-14 05:15:30|C:\Windows\system32 | |75BA0000|SHLWAPI.dll |Библиотека небольших программ оболочки |6.1.7600.16385 |350208 |2009-07-14 05:16:16|C:\Windows\system32 | |75C00000|shell32.dll |Общая библиотека оболочки Windows |6.1.7600.16385 |12866560|2009-07-14 05:16:16|C:\Windows\system32 | |76850000|MSCTF.dll |Серверная библиотека MSCTF |6.1.7600.16385 |828928 |2009-07-14 05:15:44|C:\Windows\system32 | |76920000|sechost.dll |Host for SCM/SDDL/LSA Lookup APIs |6.1.7600.16385 |92160 |2009-07-14 05:16:14|C:\Windows\SYSTEM32 | |769A0000|WLDAP32.dll |Win32 LDAP API DLL |6.1.7600.16385 |268800 |2009-07-14 05:16:20|C:\Windows\system32 | |769F0000|SETUPAPI.dll |Windows Setup API |6.1.7600.16385 |1668608 |2009-07-14 05:16:16|C:\Windows\system32 | |76B90000|GDI32.dll |GDI Client DLL |6.1.7600.16385 |304640 |2009-07-14 05:15:24|C:\Windows\system32 | |76BE0000|imm32.dll |Multi-User Windows IMM32 API Client DLL |6.1.7600.16385 |118272 |2009-07-14 05:15:34|C:\Windows\system32 | |76C00000|ole32.dll |Microsoft OLE для Windows |6.1.7600.16385 |1412608 |2009-07-14 05:16:14|C:\Windows\system32 | |76D60000|RPCRT4.dll |Библиотека удаленного вызова процедур |6.1.7600.16385 |652288 |2009-07-14 05:16:14|C:\Windows\system32 | |76E10000|CLBCatQ.DLL |COM+ Configuration Catalog |2001.12.8530.16385|522240 |2009-07-14 05:15:04|C:\Windows\system32 | |76EA0000|wininet.dll |Расширения Интернета для Win32 |8.0.7600.16385 |977920 |2009-07-14 05:16:20|C:\Windows\system32 | |76FA0000|USP10.dll |Uniscribe Unicode script processor |1.626.7600.16385 |627200 |2009-07-14 05:16:18|C:\Windows\system32 | |77040000|advapi32.dll |Расширенная библиотека API Windows 32 |6.1.7600.16385 |640000 |2009-07-14 05:14:54|C:\Windows\system32 | |770E0000|comdlg32.dll |Библиотека общих диалоговых окон |6.1.7600.16385 |486912 |2009-07-14 05:15:08|C:\Windows\system32 | |77160000|kernel32.dll |Библиотека клиента Windows NT BASE API |6.1.7600.16385 |857088 |2009-07-14 05:15:36|C:\Windows\system32 | |77240000|LPK.dll |Language Pack |6.1.7600.16385 |26624 |2009-07-14 05:15:38|C:\Windows\system32 | |77250000|Normaliz.dll |Unicode Normalization DLL |6.1.7600.16385 |2048 |2009-07-14 05:09:02|C:\Windows\system32 | |77260000|URLMON.DLL |Расширения OLE32 для Win32 |8.0.7600.16385 |1224704 |2009-07-14 05:16:18|C:\Windows\system32 | |773A0000|USER32.dll |Многопользовательская библиотека клиента USER API Windows |6.1.7600.16385 |811520 |2009-07-14 05:16:18|C:\Windows\system32 | |77470000|msvcrt.dll |Windows NT CRT DLL |7.0.7600.16385 |690688 |2009-07-14 05:15:52|C:\Windows\system32 | |77550000|ntdll.dll |Системная библиотека NT |6.1.7600.16385 |1286144 |2009-07-14 05:17:52|C:\Windows\SYSTEM32 | |77690000|NSI.dll |NSI User-mode interface DLL |6.1.7600.16385 |8704 |2009-07-14 05:16:12|C:\Windows\system32 | |776A0000|WS2_32.dll |32-разрядная библиотека Windows Socket 2.0 |6.1.7600.16385 |206336 |2009-07-14 05:16:22|C:\Windows\system32 | |776E0000|oleaut32.dll | |6.1.7600.16385 |571904 |2009-07-14 05:16:14|C:\Windows\system32 | |77770000|PSAPI.DLL |Process Status Helper |6.1.7600.16385 |6144 |2009-07-14 05:16:14|C:\Windows\system32 | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Processes Information: ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |ID |Name |Description |Version |Memory|Priority |Threads|Path | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |0 |[System Process] | | |0 | |4 | | |4 |System | | |0 |Normal |118 | | |260 |smss.exe |Диспетчер сеанса Windows |6.1.7600.16385|0 |Above-Normal|3 | | |308 |nvvsvc.exe |NVIDIA Driver Helper Service, Version 275.33|8.17.12.7533 |0 |Normal |5 | | |320 |NvXDSync.exe | | |0 |Normal |8 | | |348 |winvnc.exe | | |0 |Normal |6 | | |368 |csrss.exe |Процесс исполнения клиент-сервер |6.1.7600.16385|0 |High |9 | | |436 |wininit.exe |Автозагрузка приложений Windows |6.1.7600.16385|0 |High |3 | | |448 |csrss.exe |Процесс исполнения клиент-сервер |6.1.7600.16385|0 |High |15 | | |504 |winlogon.exe |Программа входа в систему Windows |6.1.7600.16385|0 |High |3 | | |548 |services.exe |Приложение служб и контроллеров |6.1.7600.16385|0 |Normal |7 | | |564 |lsass.exe |Local Security Authority Process |6.1.7600.16385|0 |Normal |10 | | |572 |lsm.exe |Служба диспетчера локальных сеансов |6.1.7600.16385|0 |Normal |9 | | |680 |svchost.exe |Хост-процесс для служб Windows |6.1.7600.16385|0 |Normal |11 | | |744 |nvvsvc.exe |NVIDIA Driver Helper Service, Version 275.33|8.17.12.7533 |0 |Normal |5 | | |784 |svchost.exe |Хост-процесс для служб Windows |6.1.7600.16385|0 |Normal |10 | | |872 |svchost.exe |Хост-процесс для служб Windows |6.1.7600.16385|0 |Normal |20 | | |916 |svchost.exe |Хост-процесс для служб Windows |6.1.7600.16385|0 |Normal |21 | | |956 |svchost.exe |Хост-процесс для служб Windows |6.1.7600.16385|0 |Normal |42 | | |976 |QUICKSTART.EXE | | |0 |Normal |3 |D:\Programs\QuickStart | |1116 |svchost.exe |Хост-процесс для служб Windows |6.1.7600.16385|0 |Normal |16 | | |1216 |svchost.exe |Хост-процесс для служб Windows |6.1.7600.16385|0 |Normal |27 | | |1252 |conhost.exe |Окно консоли узла |6.1.7600.16385|0 |Normal |2 |C:\Windows\system32 | |1364 |svchost.exe |Хост-процесс для служб Windows |6.1.7600.16385|0 |Normal |17 | | |1372 |uTorrent.exe |µTorrent |3.3.0.29625 |0 |Normal |50 |C:\Program Files\uTorrent | |1436 |spoolsv.exe |Диспетчер очереди печати |6.1.7600.16385|0 |Normal |20 | | |1472 |svchost.exe |Хост-процесс для служб Windows |6.1.7600.16385|0 |Normal |4 | | |1580 |armsvc.exe | | |0 |Normal |4 | | |1668 |MobileBalance.exe |Мониторинг баланса сотовых телефонов. |2.82.0.5114 |0 |Normal |15 |D:\Programs\mtsb | |1676 |dwservice.exe | | |0 |Normal |22 | | |1704 |frwl_svc.exe | | |0 |Normal |11 | | |1748 |svchost.exe |Хост-процесс для служб Windows |6.1.7600.16385|0 |Normal |19 | | |1780 |svchost.exe |Хост-процесс для служб Windows |6.1.7600.16385|0 |Normal |4 | | |1816 |svchost.exe |Хост-процесс для служб Windows |6.1.7600.16385|0 |Normal |4 | | |1836 |svchost.exe |Хост-процесс для служб Windows |6.1.7600.16385|0 |Normal |3 | | |1864 |nvSCPAPISvr.exe | | |0 |Normal |6 | | |1928 |spideragent.exe |SpIDer Agent for Windows |8.1.0.5140 |0 |Normal |16 |C:\Program Files\DrWeb | |2284 |OUTLOOK.EXE |Microsoft Office Outlook |12.0.6607.1000|0 |Normal |2 |C:\Program Files\Microsoft Office\Office12 | |2432 |dwengine.exe | | |0 |Normal |26 | | |2560 |svchost.exe |Хост-процесс для служб Windows |6.1.7600.16385|0 |Normal |5 | | |2768 |dwarkdaemon.exe | | |0 |Normal |5 | | |2880 |wmdc.exe |Центр устройств Microsoft Windows Mobile |6.1.6965.0 |0 |Normal |15 |C:\Windows\WindowsMobile | |2932 |dwengine.exe | | |0 |Normal |3 | | |3044 |Explorer.EXE |Проводник |6.1.7600.16385|0 |Normal |42 |C:\Windows | |3060 |taskhost.exe |Хост-процесс для задач Windows |6.1.7600.16385|0 |Normal |9 |C:\Windows\system32 | |3132 |Dwm.exe |Диспетчер окон рабочего стола |6.1.7600.16385|0 |Normal |6 |C:\Windows\system32 | |3224 |svchost.exe |Хост-процесс для служб Windows |6.1.7600.16385|0 |Normal |9 | | |3264 |taskeng.exe |Обработчик планировщика заданий |6.1.7600.16385|0 |Below-Normal|5 |C:\Windows\system32 | |3324 |TiltWheelMouse.exe |pximouse |1.0.0.2 |0 |Normal |3 |C:\Windows\System32 | |3336 |TortoiseHgOverlayServer.exe|TortoiseHg Overlay Icon Server |2.7.2.0 |0 |Normal |3 |C:\Program Files\TortoiseHg | |3340 |LMS.exe | | |0 |Normal |4 | | |3424 |ipoint.exe |IPoint.exe |8.20.468.0 |0 |Normal |9 |C:\Program Files\Microsoft IntelliPoint | |3432 |daemonu.exe | | |0 |Normal |10 | | |3460 |dpupdchk.exe |dpupdchk.exe |8.20.468.0 |0 |Normal |5 |C:\Program Files\Microsoft IntelliPoint | |3468 |frwl_notify.exe |Dr.Web Firewall for Windows notify module |7.0.1.11210 |0 |Normal |6 |C:\Program Files\DrWeb | |3504 |svchost.exe |Хост-процесс для служб Windows |6.1.7600.16385|0 |Normal |13 | | |3708 |UNS.exe | | |0 |Normal |14 | | |3828 |nvtray.exe |NVIDIA Settings |7.17.12.7533 |0 |Normal |5 |C:\Program Files\NVIDIA Corporation\Display| |3892 |cmd.exe |Обработчик команд Windows |6.1.7600.16385|0 |Normal |1 |C:\Windows\system32 | |4580 |cmd.exe |Обработчик команд Windows |6.1.7600.16385|0 |Below-Normal|1 |C:\Windows\SYSTEM32 | |4592 |mstsc.exe |Подключение к удаленному рабочему столу |6.1.7600.16385|0 |Normal |10 |C:\Windows\system32 | |4724 |tv_w32.exe | | |0 |Normal |2 | | |4864 |AsteriskMonitor.exe |AsteriskMonitor |1.0.0.0 |0 |Normal |14 |C:\AsteriskManager | |6200 |cmd.exe |Обработчик команд Windows |6.1.7600.16385|0 |Normal |1 |C:\Windows\system32 | |6248 |TeamViewer.exe |TeamViewer 8 |8.0.19045.0 |0 |Normal |17 |C:\Program Files\TeamViewer\Version8 | |6284 |notepad.exe |Блокнот |6.1.7600.16385|0 |Normal |1 |C:\WINDOWS\system32 | |6784 |rundll32.exe |Хост-процесс Windows (Rundll32) |6.1.7600.16385|0 |Normal |4 |C:\Windows\System32 | |6848 |Miranda32.exe |Miranda NG |0.94.2.4132 |0 |Normal |17 |D:\Programs\MirandaNG | |6932 |conhost.exe |Окно консоли узла |6.1.7600.16385|0 |Normal |2 |C:\Windows\system32 | |7280 |SearchFilterHost.exe |Microsoft Windows Search Filter Host |7.0.7600.16385|0 |Low |3 |C:\Windows\system32 | |7376 |audiodg.exe |Изоляция графов аудиоустройств Windows |6.1.7600.16385|0 |Normal |6 | | |7584 |winvnc.exe | | |0 |Normal |9 | | |7808 |TeamViewer_Service.exe | | |0 |Normal |13 | | |7952 |ndn.exe | | |0 |Low |4 |D:\Programs\NDN_W32 | |8352 |conhost.exe |Окно консоли узла |6.1.7600.16385|0 |Normal |2 |C:\Windows\system32 | |9288 |iexplore.exe |Internet Explorer |8.0.7600.16385|0 |Normal |47 |C:\Program Files\Internet Explorer | |9416 |SearchProtocolHost.exe |Microsoft Windows Search Protocol Host |7.0.7600.16385|0 |Low |5 | | |9544 |OUTLOOK.EXE |Microsoft Office Outlook |12.0.6607.1000|0 |Normal |38 |C:\Program Files\Microsoft Office\Office12 | |9584 |ndn.exe | | |0 |Normal |4 |D:\Programs\NDN_W32 | |9660 |infium.exe | |9.0.4.5 |0 |Normal |65 |D:\Programs\QIP Infium | |9816 |SASPlanet.Debug.exe | |13.6.25.7316 |0 |Normal |22 |T:\GoogleMV | |10192|SearchIndexer.exe |Индексатор службы Microsoft Windows Search |7.0.7600.16385|0 |Normal |14 | | |10220|opera.exe |Opera Internet Browser |12.15.1748.0 |0 |Normal |37 |C:\Program Files\Opera | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- Assembler Information: -------------------------------------------------------------------------------------------------------- ; u_BerkeleyDBPool.TBerkeleyDBPool.Sync (Line=257 - Offset=9) ; ----------------------------------------------------------- 005744F9 mov edx, [u_BerkeleyDBKey.TBerkeleyDBVersionedMetaKey.Create (Line=354)] 005744FF mov eax, ebx 00574501 call -$0016D29E ; ; Line=258 - Offset=10 ; -------------------- 00574506 mov eax, [ebp-$04] 00574509 mov eax, [eax+$2C] 0057450C xor ecx, ecx 0057450E mov edx, edi 00574510 call -$0014C62D 00574515 jmp u_BerkeleyDBPool.TBerkeleyDBPool.Sync (Line=263) ; ; Line=260 - Offset=12 ; -------------------- 00574517 mov eax, [ebx] 00574519 mov edx, [eax] ; <-- EXCEPTION 0057451B call dword ptr [edx+$3C] ; ; Line=263 - Offset=15 ; -------------------- 0057451E inc edi ; ; Line=252 - Offset=4 ; ------------------- 0057451F dec esi 00574520 jnz u_BerkeleyDBPool.TBerkeleyDBPool.Sync (Line=253) 00574522 xor eax, eax 00574524 pop edx 00574525 pop ecx 00574526 pop ecx 00574527 mov fs:[eax], edx 0057452A push $00574542 ; '3АZYYd‰.hbEW' Registers: ----------------------------- EAX: 00000000 EDI: 00000000 EBX: 12F45F70 ESI: 00000001 ECX: 00000854 ESP: 032FFD2C EDX: 00000000 EIP: 00574519 Stack: Memory Dump: ------------------ --------------------------------------------------------------------------- 032FFD2C: 032FFD38 12FE3430: 8B 10 FF 52 3C 47 4E 75 A7 33 C0 5A 59 59 64 89 ...R