T
tmatthews
We are trying to open an Excel file on several different PCs and it crashes
every time. Hoping someone has seen this before or can help me decipher the
Dr. Watson log.
Thank you in advance.
Excel 2000 9.0.6926 SP-3
Application exception occurred:
App: (pid=2356)
When: 01/17/2005 @ 10:59:11.584
Exception number: c0000005 (access violation)
*----> System Information <----*
Computer Name: ********
User Name: ********
Number of Processors: 1
Processor Type: x86 Family 15 Model 2 Stepping 4
Windows 2000 Version: 5.0
Current Build: 2195
Service Pack: 4
Current Type: Uniprocessor Free
Registered Organization: ********
Registered Owner: ********
*----> Task List <----*
0 Idle.exe
8 System.exe
180 SMSS.exe
204 CSRSS.exe
224 WINLOGON.exe
252 SERVICES.exe
264 LSASS.exe
424 svchost.exe
472 svchost.exe
524 spoolsv.exe
576 cvpnd.exe
592 DefWatch.exe
648 Rtvscan.exe
680 nvsvc32.exe
696 regsvc.exe
708 mstask.exe
756 THotkey.exe
804 wuser32.exe
844 TIRemoteService.exe
884 tmesbs3.exe
900 TMESRV3.exe
976 WinMgmt.exe
988 MsPMSPSv.exe
1004 svchost.exe
1116 TMEDevRm.exe
1320 explorer.exe
1428 TosHKCW.exe
1436 TFNF5.exe
1036 TPWRTRAY.exe
1444 EM_EXEC.exe
1448 CreateCD50.exe
1368 Directcd.exe
1404 VPTray.exe
1516 jusched.exe
1536 MAPISP32.exe
1636 rundll32.exe
1696 netdevsw.exe
1716 WZQKPICK.exe
1640 IEXPLORE.exe
2080 svchost.exe
2236 ADMIN.exe
1832 AcroRd32.exe
1996 jucheck.exe
2536 IEXPLORE.exe
1908 notepad.exe
1788 CMD.exe
2480 OUTLOOK.exe
1600 aruser.exe
1964 DesktopMgr.exe
2404 RIMDeviceManage.exe
2244 BbDevMgr.exe
2472 IEXPLORE.exe
2556 IEXPLORE.exe
2304 IEXPLORE.exe
476 IEXPLORE.exe
1896 IEXPLORE.exe
1112 notepad.exe
1976 IEXPLORE.exe
2356 EXCEL.exe
2348 DRWTSN32.exe
0 _Total.exe
(30000000 - 306D9000)
(77F80000 - 77FFD000)
(7C2D0000 - 7C332000)
(7C570000 - 7C623000)
(77D30000 - 77DA1000)
(77F40000 - 77F7B000)
(77E10000 - 77E75000)
(308C0000 - 30E1D000)
(77A50000 - 77B3F000)
(10000000 - 100D4000)
(70A70000 - 70AD9000)
(78000000 - 78045000)
(782F0000 - 78535000)
(71710000 - 71794000)
(690A0000 - 690AB000)
(77820000 - 77827000)
(759B0000 - 759B6000)
(695E0000 - 69609000)
(779B0000 - 77A4B000)
(51000000 - 51047000)
(728A0000 - 728A6000)
(775A0000 - 77630000)
(01780000 - 01984000)
(77840000 - 7787E000)
(770C0000 - 770E3000)
(02150000 - 02158000)
(65000000 - 65263000)
(65300000 - 65327000)
(76710000 - 76718000)
(76FA0000 - 76FAF000)
(773E0000 - 773F5000)
(75170000 - 751BF000)
(7C340000 - 7C34F000)
(77BF0000 - 77C01000)
(77980000 - 779A4000)
(75050000 - 75058000)
(75030000 - 75044000)
(75020000 - 75028000)
(77950000 - 7797A000)
(751C0000 - 751C6000)
(75150000 - 7515F000)
(772B0000 - 7731C000)
(28B70000 - 28B87000)
(76DF0000 - 76E01000)
(02F50000 - 03098000)
State Dump for Thread Id 0x4d4
eax=306e0d88 ebx=00000061 ecx=0012b4f4 edx=306c5988 esi=000101a5 edi=0012b500
eip=300dfc76 esp=0012b3f0 ebp=0012b4e4 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000206
function: <nosymbols>
300dfc50 57 push edi
300dfc51 8b3d08346a30 mov edi,[306a3408]
ds:306a3408=0012b500
300dfc57 e913ffffff jmp Ordinal44+0xdfb6f (300dfb6f)
300dfc5c 89bd6cffffff mov [ebp+0xffffff6c],edi
ss:0012b450=0012b500
300dfc62 33c0 xor eax,eax
300dfc64 8a06 mov al,[esi]
ds:000101a5=00
300dfc66 8a6601 mov ah,[esi+0x1]
ds:0140a08b=??
300dfc69 8d14c588f16830 lea edx,[3068f188+eax*8]
ds:306e0d88=????????
300dfc70 8d0482 lea eax,[edx+eax*4]
ds:306e0d88=????????
300dfc73 83c602 add esi,0x2
FAULT ->300dfc76 8b08 mov ecx,[eax]
ds:306e0d88=????????
300dfc78 83e11f and ecx,0x1f
300dfc7b 49 dec ecx
300dfc7c e9a4feffff jmp Ordinal44+0xdfb25 (300dfb25)
300dfc81 c7053c366a3000000000
ds:306a363c=00000000
mov dword ptr [306a363c],0x0
300dfc8b 8b5df0 mov ebx,[ebp+0xf0]
ss:015253ca=????????
300dfc8e 81fbff000000 cmp ebx,0xff
300dfc94 0f843f320a00 je Ordinal44+0x182ed9 (30182ed9)
300dfc9a ff149d1c466a30 call dword ptr [306a461c+ebx*4]
ds:00000061=????????
300dfca1 c70554476a3000000000
ds:306a4754=00000000
mov dword ptr [306a4754],0x0
300dfcab 8b7dfc mov edi,[ebp+0xfc]
ss:015253ca=????????
300dfcae 3b7df8 cmp edi,[ebp+0xf8]
ss:015253ca=????????
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0012B4E4 30066EC9 0012B4F4 00000008 0000001D 0012B6F0 !Ordinal44
0012B760 30232AEA 0012B7F0 000100A1 00004600 00000008 !Ordinal44
0012B7F8 300E6C40 0012B9A4 0012B9A0 0000000A 0012B99C !Ordinal44
0012B9A8 30052CAD 00000001 0001005B 00000150 00000103 !Ordinal44
00000103 00000000 00000000 00000000 00000000 00000000 !Ordinal44
*----> Raw Stack Dump <----*
0012b3f0 a4 b9 12 00 02 00 00 00 - 00 00 00 00 00 10 00 00 ................
0012b400 00 40 00 00 84 18 00 00 - ff 03 00 00 7c a7 74 00 .@..........|.t.
0012b410 00 00 74 00 00 00 00 00 - f7 0a 8e 30 e4 b4 12 00 ..t........0....
0012b420 fc 79 74 00 b4 b7 74 00 - 64 b7 74 00 ec b3 12 00 .yt...t.d.t.....
0012b430 93 2d 18 30 00 00 00 00 - 00 00 00 00 64 b9 12 00 .-.0........d...
0012b440 7c a7 00 00 4c 08 00 00 - ff ff 00 00 90 00 74 00 |...L.........t.
0012b450 00 b5 12 00 d4 b6 12 00 - ac 79 74 00 a1 46 01 00 .........yt..F..
0012b460 a2 01 01 00 dc ea 8d 30 - 00 00 00 00 00 00 00 00 .......0........
0012b470 00 00 00 00 02 20 00 00 - 00 00 12 24 30 6f d6 30 ..... .....$0o.0
0012b480 00 30 00 80 45 e8 58 7c - 3f e6 8d 30 84 00 74 00 .0..E.X|?..0..t.
0012b490 d4 b4 12 00 00 00 00 00 - 1f 35 8c 30 30 6f d6 30 .........5.00o.0
0012b4a0 d4 b4 12 00 08 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012b4b0 00 00 00 00 08 b6 12 00 - 31 05 00 00 00 00 00 00 ........1.......
0012b4c0 f4 b5 12 00 80 00 00 00 - 80 00 00 00 00 00 00 00 ................
0012b4d0 24 b6 12 00 f0 89 76 08 - 80 00 00 00 e7 03 00 00 $.....v.........
0012b4e0 80 00 00 00 60 b7 12 00 - c9 6e 06 30 f4 b4 12 00 ....`....n.0....
0012b4f0 08 00 00 00 1d 00 00 00 - f0 b6 12 00 10 00 00 00 ................
0012b500 70 00 00 00 73 00 00 00 - 80 00 00 00 d4 b6 12 00 p...s...........
0012b510 99 77 a6 77 30 b5 12 00 - 70 00 00 00 8c 40 0a 03 .w.w0...p....@..
0012b520 6e 02 0a 03 00 00 00 00 - 71 00 00 00 01 00 00 00 n.......q.......
State Dump for Thread Id 0x584
eax=77d358be ebx=001426c0 ecx=0012e2c0 edx=00000000 esi=001425d8 edi=00000100
eip=77f83310 esp=01a9fe28 ebp=01a9ff74 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202
function: ZwReplyWaitReceivePortEx
77f83305 b8ac000000 mov eax,0xac
77f8330a 8d542404 lea edx,[esp+0x4]
ss:02e99d0f=????????
77f8330e cd2e int 2e
77f83310 c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
01A9FF74 77D37B4C 77D35924 001425D8 77D33E01 00130000
ntdll!ZwReplyWaitReceivePortEx
01A9FFA8 77D358D6 00141EE0 01A9FFEC 7C57B388 001426C0
rpcrt4!NdrCorrelationInitialize
01A9FFB4 7C57B388 001426C0 77D33E01 00130000 001426C0 rpcrt4!RpcBindingFree
01A9FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!lstrcmpiW
State Dump for Thread Id 0xa94
eax=77ab502c ebx=00000102 ecx=01a0019e edx=00000000 esi=77f82826 edi=01b9ff74
eip=77f82831 esp=01b9ff60 ebp=01b9ff7c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000206
function: NtDelayExecution
77f82826 b832000000 mov eax,0x32
77f8282b 8d542404 lea edx,[esp+0x4]
ss:02f99e47=fffff99d
77f8282f cd2e int 2e
77f82831 c20800 ret 0x8
77f82834 53 push ebx
77f82835 51 push ecx
77f82836 6a00 push 0x0
77f82838 c70701000000 mov dword ptr [edi],0x1
ds:01b9ff74=dc3cba00
77f8283e ff750c push dword ptr [ebp+0xc]
ss:02f99e62=e8fc4d8b
77f82841 50 push eax
77f82842 e879fdffff call RtlMultiByteToUnicodeN (77f825c0)
77f82847 e928fcffff jmp RtlConsoleMultiByteToUnicodeN+0x333
(77f82474)
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
01B9FF7C 7C59A20E 0000EA60 00000000 77AB8FFB 0000EA60 ntdll!NtDelayExecution
00007530 00000000 00000000 00000000 00000000 00000000 kernel32!Sleep
*----> Raw Stack Dump <----*
01b9ff60 43 a2 59 7c 00 00 00 00 - 74 ff b9 01 73 9f 59 7c C.Y|....t...s.Y|
01b9ff70 58 4a 14 00 00 ba 3c dc - ff ff ff ff 30 75 00 00 XJ....<.....0u..
01b9ff80 0e a2 59 7c 60 ea 00 00 - 00 00 00 00 fb 8f ab 77 ..Y|`..........w
01b9ff90 60 ea 00 00 ee 50 ab 77 - 00 00 00 00 00 00 a5 77 `....P.w.......w
01b9ffa0 58 4a 14 00 ec ff b9 01 - 58 4a 14 00 46 50 ab 77 XJ......XJ..FP.w
01b9ffb0 45 7d a6 77 30 7d a6 77 - 88 b3 57 7c 58 4a 14 00 E}.w0}.w..W|XJ..
01b9ffc0 45 7d a6 77 30 7d a6 77 - 58 4a 14 00 00 c0 fd 7f E}.w0}.wXJ......
01b9ffd0 9e 01 a0 01 c0 ff b9 01 - 9e 01 a0 01 ff ff ff ff ................
01b9ffe0 44 1f 5c 7c 08 2b 57 7c - 00 00 00 00 00 00 00 00 D.\|.+W|........
01b9fff0 00 00 00 00 2c 50 ab 77 - 58 4a 14 00 00 00 00 00 ....,P.wXJ......
01ba0000 00 00 00 00 00 00 ff ff - 00 00 00 00 00 20 00 00 ............. ..
01ba0010 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01ba0020 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01ba0030 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01ba0040 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01ba0050 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01ba0060 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01ba0070 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01ba0080 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01ba0090 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
State Dump for Thread Id 0xaac
eax=650210a8 ebx=00000000 ecx=006c006f edx=00000000 esi=77f82826 edi=0293ff98
eip=77f82831 esp=0293ff84 ebp=0293ffa0 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202
function: NtDelayExecution
77f82826 b832000000 mov eax,0x32
77f8282b 8d542404 lea edx,[esp+0x4]
ss:03d39e6b=00410041
77f8282f cd2e int 2e
77f82831 c20800 ret 0x8
77f82834 53 push ebx
77f82835 51 push ecx
77f82836 6a00 push 0x0
77f82838 c70701000000 mov dword ptr [edi],0x1
ds:0293ff98=ffe17b80
77f8283e ff750c push dword ptr [ebp+0xc]
ss:03d39e86=41004100
77f82841 50 push eax
77f82842 e879fdffff call RtlMultiByteToUnicodeN (77f825c0)
77f82847 e928fcffff jmp RtlConsoleMultiByteToUnicodeN+0x333
(77f82474)
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0293FFA0 7C59A20E 000000C8 00000000 650210B3 000000C8 ntdll!NtDelayExecution
0293FFEC 00000000 650210A8 00000000 00000000 00000000 kernel32!Sleep
*----> Raw Stack Dump <----*
0293ff84 43 a2 59 7c 00 00 00 00 - 98 ff 93 02 73 00 2e 00 C.Y|........s...
0293ff94 2e 00 2e 00 80 7b e1 ff - ff ff ff ff ec ff 93 02 .....{..........
0293ffa4 0e a2 59 7c c8 00 00 00 - 00 00 00 00 b3 10 02 65 ..Y|...........e
0293ffb4 c8 00 00 00 88 b3 57 7c - 00 00 00 00 73 00 2e 00 ......W|....s...
0293ffc4 2e 00 2e 00 00 00 00 00 - 00 b0 fd 7f 6f 00 6c 00 ............o.l.
0293ffd4 c0 ff 93 02 6f 00 6c 00 - ff ff ff ff 44 1f 5c 7c ....o.l.....D.\|
0293ffe4 08 2b 57 7c 00 00 00 00 - 00 00 00 00 00 00 00 00 .+W|............
0293fff4 a8 10 02 65 00 00 00 00 - 00 00 00 00 00 00 00 00 ...e............
02940004 00 00 00 00 e8 0f 00 00 - 00 00 00 00 00 00 00 00 ................
02940014 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
02940024 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
02940034 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
02940044 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
02940054 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
02940064 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
02940074 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
02940084 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
02940094 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
029400a4 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
029400b4 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
every time. Hoping someone has seen this before or can help me decipher the
Dr. Watson log.
Thank you in advance.
Excel 2000 9.0.6926 SP-3
Application exception occurred:
App: (pid=2356)
When: 01/17/2005 @ 10:59:11.584
Exception number: c0000005 (access violation)
*----> System Information <----*
Computer Name: ********
User Name: ********
Number of Processors: 1
Processor Type: x86 Family 15 Model 2 Stepping 4
Windows 2000 Version: 5.0
Current Build: 2195
Service Pack: 4
Current Type: Uniprocessor Free
Registered Organization: ********
Registered Owner: ********
*----> Task List <----*
0 Idle.exe
8 System.exe
180 SMSS.exe
204 CSRSS.exe
224 WINLOGON.exe
252 SERVICES.exe
264 LSASS.exe
424 svchost.exe
472 svchost.exe
524 spoolsv.exe
576 cvpnd.exe
592 DefWatch.exe
648 Rtvscan.exe
680 nvsvc32.exe
696 regsvc.exe
708 mstask.exe
756 THotkey.exe
804 wuser32.exe
844 TIRemoteService.exe
884 tmesbs3.exe
900 TMESRV3.exe
976 WinMgmt.exe
988 MsPMSPSv.exe
1004 svchost.exe
1116 TMEDevRm.exe
1320 explorer.exe
1428 TosHKCW.exe
1436 TFNF5.exe
1036 TPWRTRAY.exe
1444 EM_EXEC.exe
1448 CreateCD50.exe
1368 Directcd.exe
1404 VPTray.exe
1516 jusched.exe
1536 MAPISP32.exe
1636 rundll32.exe
1696 netdevsw.exe
1716 WZQKPICK.exe
1640 IEXPLORE.exe
2080 svchost.exe
2236 ADMIN.exe
1832 AcroRd32.exe
1996 jucheck.exe
2536 IEXPLORE.exe
1908 notepad.exe
1788 CMD.exe
2480 OUTLOOK.exe
1600 aruser.exe
1964 DesktopMgr.exe
2404 RIMDeviceManage.exe
2244 BbDevMgr.exe
2472 IEXPLORE.exe
2556 IEXPLORE.exe
2304 IEXPLORE.exe
476 IEXPLORE.exe
1896 IEXPLORE.exe
1112 notepad.exe
1976 IEXPLORE.exe
2356 EXCEL.exe
2348 DRWTSN32.exe
0 _Total.exe
(30000000 - 306D9000)
(77F80000 - 77FFD000)
(7C2D0000 - 7C332000)
(7C570000 - 7C623000)
(77D30000 - 77DA1000)
(77F40000 - 77F7B000)
(77E10000 - 77E75000)
(308C0000 - 30E1D000)
(77A50000 - 77B3F000)
(10000000 - 100D4000)
(70A70000 - 70AD9000)
(78000000 - 78045000)
(782F0000 - 78535000)
(71710000 - 71794000)
(690A0000 - 690AB000)
(77820000 - 77827000)
(759B0000 - 759B6000)
(695E0000 - 69609000)
(779B0000 - 77A4B000)
(51000000 - 51047000)
(728A0000 - 728A6000)
(775A0000 - 77630000)
(01780000 - 01984000)
(77840000 - 7787E000)
(770C0000 - 770E3000)
(02150000 - 02158000)
(65000000 - 65263000)
(65300000 - 65327000)
(76710000 - 76718000)
(76FA0000 - 76FAF000)
(773E0000 - 773F5000)
(75170000 - 751BF000)
(7C340000 - 7C34F000)
(77BF0000 - 77C01000)
(77980000 - 779A4000)
(75050000 - 75058000)
(75030000 - 75044000)
(75020000 - 75028000)
(77950000 - 7797A000)
(751C0000 - 751C6000)
(75150000 - 7515F000)
(772B0000 - 7731C000)
(28B70000 - 28B87000)
(76DF0000 - 76E01000)
(02F50000 - 03098000)
State Dump for Thread Id 0x4d4
eax=306e0d88 ebx=00000061 ecx=0012b4f4 edx=306c5988 esi=000101a5 edi=0012b500
eip=300dfc76 esp=0012b3f0 ebp=0012b4e4 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000206
function: <nosymbols>
300dfc50 57 push edi
300dfc51 8b3d08346a30 mov edi,[306a3408]
ds:306a3408=0012b500
300dfc57 e913ffffff jmp Ordinal44+0xdfb6f (300dfb6f)
300dfc5c 89bd6cffffff mov [ebp+0xffffff6c],edi
ss:0012b450=0012b500
300dfc62 33c0 xor eax,eax
300dfc64 8a06 mov al,[esi]
ds:000101a5=00
300dfc66 8a6601 mov ah,[esi+0x1]
ds:0140a08b=??
300dfc69 8d14c588f16830 lea edx,[3068f188+eax*8]
ds:306e0d88=????????
300dfc70 8d0482 lea eax,[edx+eax*4]
ds:306e0d88=????????
300dfc73 83c602 add esi,0x2
FAULT ->300dfc76 8b08 mov ecx,[eax]
ds:306e0d88=????????
300dfc78 83e11f and ecx,0x1f
300dfc7b 49 dec ecx
300dfc7c e9a4feffff jmp Ordinal44+0xdfb25 (300dfb25)
300dfc81 c7053c366a3000000000
ds:306a363c=00000000
mov dword ptr [306a363c],0x0
300dfc8b 8b5df0 mov ebx,[ebp+0xf0]
ss:015253ca=????????
300dfc8e 81fbff000000 cmp ebx,0xff
300dfc94 0f843f320a00 je Ordinal44+0x182ed9 (30182ed9)
300dfc9a ff149d1c466a30 call dword ptr [306a461c+ebx*4]
ds:00000061=????????
300dfca1 c70554476a3000000000
ds:306a4754=00000000
mov dword ptr [306a4754],0x0
300dfcab 8b7dfc mov edi,[ebp+0xfc]
ss:015253ca=????????
300dfcae 3b7df8 cmp edi,[ebp+0xf8]
ss:015253ca=????????
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0012B4E4 30066EC9 0012B4F4 00000008 0000001D 0012B6F0 !Ordinal44
0012B760 30232AEA 0012B7F0 000100A1 00004600 00000008 !Ordinal44
0012B7F8 300E6C40 0012B9A4 0012B9A0 0000000A 0012B99C !Ordinal44
0012B9A8 30052CAD 00000001 0001005B 00000150 00000103 !Ordinal44
00000103 00000000 00000000 00000000 00000000 00000000 !Ordinal44
*----> Raw Stack Dump <----*
0012b3f0 a4 b9 12 00 02 00 00 00 - 00 00 00 00 00 10 00 00 ................
0012b400 00 40 00 00 84 18 00 00 - ff 03 00 00 7c a7 74 00 .@..........|.t.
0012b410 00 00 74 00 00 00 00 00 - f7 0a 8e 30 e4 b4 12 00 ..t........0....
0012b420 fc 79 74 00 b4 b7 74 00 - 64 b7 74 00 ec b3 12 00 .yt...t.d.t.....
0012b430 93 2d 18 30 00 00 00 00 - 00 00 00 00 64 b9 12 00 .-.0........d...
0012b440 7c a7 00 00 4c 08 00 00 - ff ff 00 00 90 00 74 00 |...L.........t.
0012b450 00 b5 12 00 d4 b6 12 00 - ac 79 74 00 a1 46 01 00 .........yt..F..
0012b460 a2 01 01 00 dc ea 8d 30 - 00 00 00 00 00 00 00 00 .......0........
0012b470 00 00 00 00 02 20 00 00 - 00 00 12 24 30 6f d6 30 ..... .....$0o.0
0012b480 00 30 00 80 45 e8 58 7c - 3f e6 8d 30 84 00 74 00 .0..E.X|?..0..t.
0012b490 d4 b4 12 00 00 00 00 00 - 1f 35 8c 30 30 6f d6 30 .........5.00o.0
0012b4a0 d4 b4 12 00 08 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012b4b0 00 00 00 00 08 b6 12 00 - 31 05 00 00 00 00 00 00 ........1.......
0012b4c0 f4 b5 12 00 80 00 00 00 - 80 00 00 00 00 00 00 00 ................
0012b4d0 24 b6 12 00 f0 89 76 08 - 80 00 00 00 e7 03 00 00 $.....v.........
0012b4e0 80 00 00 00 60 b7 12 00 - c9 6e 06 30 f4 b4 12 00 ....`....n.0....
0012b4f0 08 00 00 00 1d 00 00 00 - f0 b6 12 00 10 00 00 00 ................
0012b500 70 00 00 00 73 00 00 00 - 80 00 00 00 d4 b6 12 00 p...s...........
0012b510 99 77 a6 77 30 b5 12 00 - 70 00 00 00 8c 40 0a 03 .w.w0...p....@..
0012b520 6e 02 0a 03 00 00 00 00 - 71 00 00 00 01 00 00 00 n.......q.......
State Dump for Thread Id 0x584
eax=77d358be ebx=001426c0 ecx=0012e2c0 edx=00000000 esi=001425d8 edi=00000100
eip=77f83310 esp=01a9fe28 ebp=01a9ff74 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202
function: ZwReplyWaitReceivePortEx
77f83305 b8ac000000 mov eax,0xac
77f8330a 8d542404 lea edx,[esp+0x4]
ss:02e99d0f=????????
77f8330e cd2e int 2e
77f83310 c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
01A9FF74 77D37B4C 77D35924 001425D8 77D33E01 00130000
ntdll!ZwReplyWaitReceivePortEx
01A9FFA8 77D358D6 00141EE0 01A9FFEC 7C57B388 001426C0
rpcrt4!NdrCorrelationInitialize
01A9FFB4 7C57B388 001426C0 77D33E01 00130000 001426C0 rpcrt4!RpcBindingFree
01A9FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!lstrcmpiW
State Dump for Thread Id 0xa94
eax=77ab502c ebx=00000102 ecx=01a0019e edx=00000000 esi=77f82826 edi=01b9ff74
eip=77f82831 esp=01b9ff60 ebp=01b9ff7c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000206
function: NtDelayExecution
77f82826 b832000000 mov eax,0x32
77f8282b 8d542404 lea edx,[esp+0x4]
ss:02f99e47=fffff99d
77f8282f cd2e int 2e
77f82831 c20800 ret 0x8
77f82834 53 push ebx
77f82835 51 push ecx
77f82836 6a00 push 0x0
77f82838 c70701000000 mov dword ptr [edi],0x1
ds:01b9ff74=dc3cba00
77f8283e ff750c push dword ptr [ebp+0xc]
ss:02f99e62=e8fc4d8b
77f82841 50 push eax
77f82842 e879fdffff call RtlMultiByteToUnicodeN (77f825c0)
77f82847 e928fcffff jmp RtlConsoleMultiByteToUnicodeN+0x333
(77f82474)
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
01B9FF7C 7C59A20E 0000EA60 00000000 77AB8FFB 0000EA60 ntdll!NtDelayExecution
00007530 00000000 00000000 00000000 00000000 00000000 kernel32!Sleep
*----> Raw Stack Dump <----*
01b9ff60 43 a2 59 7c 00 00 00 00 - 74 ff b9 01 73 9f 59 7c C.Y|....t...s.Y|
01b9ff70 58 4a 14 00 00 ba 3c dc - ff ff ff ff 30 75 00 00 XJ....<.....0u..
01b9ff80 0e a2 59 7c 60 ea 00 00 - 00 00 00 00 fb 8f ab 77 ..Y|`..........w
01b9ff90 60 ea 00 00 ee 50 ab 77 - 00 00 00 00 00 00 a5 77 `....P.w.......w
01b9ffa0 58 4a 14 00 ec ff b9 01 - 58 4a 14 00 46 50 ab 77 XJ......XJ..FP.w
01b9ffb0 45 7d a6 77 30 7d a6 77 - 88 b3 57 7c 58 4a 14 00 E}.w0}.w..W|XJ..
01b9ffc0 45 7d a6 77 30 7d a6 77 - 58 4a 14 00 00 c0 fd 7f E}.w0}.wXJ......
01b9ffd0 9e 01 a0 01 c0 ff b9 01 - 9e 01 a0 01 ff ff ff ff ................
01b9ffe0 44 1f 5c 7c 08 2b 57 7c - 00 00 00 00 00 00 00 00 D.\|.+W|........
01b9fff0 00 00 00 00 2c 50 ab 77 - 58 4a 14 00 00 00 00 00 ....,P.wXJ......
01ba0000 00 00 00 00 00 00 ff ff - 00 00 00 00 00 20 00 00 ............. ..
01ba0010 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01ba0020 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01ba0030 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01ba0040 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01ba0050 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01ba0060 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01ba0070 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01ba0080 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
01ba0090 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
State Dump for Thread Id 0xaac
eax=650210a8 ebx=00000000 ecx=006c006f edx=00000000 esi=77f82826 edi=0293ff98
eip=77f82831 esp=0293ff84 ebp=0293ffa0 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202
function: NtDelayExecution
77f82826 b832000000 mov eax,0x32
77f8282b 8d542404 lea edx,[esp+0x4]
ss:03d39e6b=00410041
77f8282f cd2e int 2e
77f82831 c20800 ret 0x8
77f82834 53 push ebx
77f82835 51 push ecx
77f82836 6a00 push 0x0
77f82838 c70701000000 mov dword ptr [edi],0x1
ds:0293ff98=ffe17b80
77f8283e ff750c push dword ptr [ebp+0xc]
ss:03d39e86=41004100
77f82841 50 push eax
77f82842 e879fdffff call RtlMultiByteToUnicodeN (77f825c0)
77f82847 e928fcffff jmp RtlConsoleMultiByteToUnicodeN+0x333
(77f82474)
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0293FFA0 7C59A20E 000000C8 00000000 650210B3 000000C8 ntdll!NtDelayExecution
0293FFEC 00000000 650210A8 00000000 00000000 00000000 kernel32!Sleep
*----> Raw Stack Dump <----*
0293ff84 43 a2 59 7c 00 00 00 00 - 98 ff 93 02 73 00 2e 00 C.Y|........s...
0293ff94 2e 00 2e 00 80 7b e1 ff - ff ff ff ff ec ff 93 02 .....{..........
0293ffa4 0e a2 59 7c c8 00 00 00 - 00 00 00 00 b3 10 02 65 ..Y|...........e
0293ffb4 c8 00 00 00 88 b3 57 7c - 00 00 00 00 73 00 2e 00 ......W|....s...
0293ffc4 2e 00 2e 00 00 00 00 00 - 00 b0 fd 7f 6f 00 6c 00 ............o.l.
0293ffd4 c0 ff 93 02 6f 00 6c 00 - ff ff ff ff 44 1f 5c 7c ....o.l.....D.\|
0293ffe4 08 2b 57 7c 00 00 00 00 - 00 00 00 00 00 00 00 00 .+W|............
0293fff4 a8 10 02 65 00 00 00 00 - 00 00 00 00 00 00 00 00 ...e............
02940004 00 00 00 00 e8 0f 00 00 - 00 00 00 00 00 00 00 00 ................
02940014 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
02940024 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
02940034 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
02940044 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
02940054 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
02940064 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
02940074 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
02940084 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
02940094 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
029400a4 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
029400b4 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................