date/time

: 2016-05-20, 18:49:52, 515ms

computer name
: OURHOST
user name
: ahmed <admin>
registered owner : Ahmad
operating system : Windows XP Service Pack 3 build 2600
system language
: Arabic
system up time
: 24 days 9 hours
program up time
: 2 minutes 55 seconds
processors
: 2x Pentium(R) Dual-Core CPU E5300 @ 2.60GHz
physical memory
: 1174/2044 MB (free/total)
free disk space
: (C:) 8.85 GB
display mode
: 1280x1024, 32 bit
process id
: $dc0
allocated memory : 187.50 MB
largest free block : 556.43 MB
command line
: "C:\Program Files\DAUM\PotPlayer\PotPlayerMini.exe" "F:\Goo
sebumps (2015) 720p BluRay.x265 HEVC SUJAIDR\Goosebumps (2015) 720p BluRay.x265
HEVC SUJAIDR.mkv"
executable
: PotPlayerMini.exe
current module
: MADHCNET32.DLL
module date/time : 2014-12-02 16:15
version
: 1.0.17.0
compiled with
: Delphi XE
madExcept version : 4.0.11
madVR version
: 0.87.11
callstack crc
: $105b4a6f, $6a2c488e, $589d5543
exception number : 1
exception class
: Exception
exception message : Access violation at address $105b4a6f in module 'PotPlayer.
dll'. Read of address $0.
CFrameQueue::RenderThread ($11bc): <priority:2>
105b4a6f +000 PotPlayer.dll
4a446bec +06c madVR.ax
osd.cpp
2190 +9 COsd.DeviceResetDone
4a40beb9 +028 madVR.ax
direct3d.cpp 3203 +5 CDirect3D.ResetDeviceIfNeed
ed.@label
4a4877b0 +000 madVR.ax
pesect.c
195 +0 _NLG_Call
4a484123 +07b madVR.ax
memset.asm
150 +0 _local_unwind4
4a40be7f +9df madVR.ax
direct3d.cpp 3192 +292 CDirect3D.ResetDeviceIfNeed
ed
4a42914c +62c madVR.ax
framequeue.cpp 9814 +194 CFrameQueue.RenderThread
4a42c3c4 +004 madVR.ax
framequeue.cpp 181 +0 Queue_RenderThread
main thread ($168c):
7c90df58 +0a ntdll.dll
NtWaitForSingleObject
7c919b1e +87 ntdll.dll
RtlpWaitForCriticalSection
7c901041 +41 ntdll.dll
RtlEnterCriticalSection
4a4475e8 +d8 madVR.ax osd.cpp
2552 +12 COsd.MouseEvent
4a409635 +f5 madVR.ax direct3d.cpp 403 +30 CDirect3D.ParentWindowProc
4a4096e9 +29 madVR.ax direct3d.cpp 417 +2 CDirect3D.GlobalWindowMethod
7e4292de +44 USER32.dll
SendMessageW
7e418a0b +0a USER32.dll
DispatchMessageW
thread $1644:
7c90df48 +a ntdll.dll
NtWaitForMultipleObjects
7c80958a +0 kernel32.dll WaitForMultipleObjectsEx
thread $1db0:
7c90df48 +a ntdll.dll NtWaitForMultipleObjects

thread $1298:
7c90df48 +0a ntdll.dll
NtWaitForMultipleObjects
7c80958a +00 kernel32.dll WaitForMultipleObjectsEx
7c80a110 +13 kernel32.dll WaitForMultipleObjects
thread $1818: <priority:15>
7c90df48 +0a ntdll.dll
NtWaitForMultipleObjects
7c80958a +00 kernel32.dll WaitForMultipleObjectsEx
7c80a110 +13 kernel32.dll WaitForMultipleObjects
thread $19d8:
7c90d218 +a ntdll.dll NtDelayExecution
thread $188c:
7c90df48 +0a ntdll.dll
NtWaitForMultipleObjects
7c80958a +00 kernel32.dll WaitForMultipleObjectsEx
7c80a110 +13 kernel32.dll WaitForMultipleObjects
thread $1924:
7e4191ec +26 USER32.dll GetMessageW
thread $1ec4: <priority:1>
7c90da48 +a ntdll.dll NtRemoveIoCompletion
thread $1664:
7c90daa8 +a ntdll.dll NtReplyWaitReceivePortEx
thread $5ac:
7c90df48 +a ntdll.dll NtWaitForMultipleObjects
thread $1e88:
7e4191ec +26 USER32.dll GetMessageW
KeyboardThreadProc ($150c):
7c90df48 +0a ntdll.dll
7c80958a +00 kernel32.dll
7e4195f3 +00 USER32.dll
7e4196a3 +1a USER32.dll
4a4464e0 +a0 madVR.ax
osd.cpp 1784 +7
4a448f0e +5e madVR.ax
osd.cpp 1771 +3

NtWaitForMultipleObjects
WaitForMultipleObjectsEx
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
COsd.KeyboardThreadMethod
KeyboardThreadProc

WindowQueueThread ($1c54): <priority:2>

7e4191ec +026 USER32.dll
GetMessageW
059f4976 +102 MADHCNET32.DLL madNetTools 1309 +17 WindowQueueThread
thread $fe0:
7c90d9d8 +00a ntdll.dll
NtReadFile
7c801873 +061 kernel32.dll
ReadFile
059f04f3 +1eb MADHCNET32.DLL madCodeHook PipedIpcThread1
CheckWindowConnectionThread ($19d4):
7c90df58 +0a ntdll.dll
7c8025d5 +85 kernel32.dll
7c80253d +0d kernel32.dll
059f4291 +41 MADHCNET32.DLL madNetTools 1160 +6

NtWaitForSingleObject
WaitForSingleObjectEx
WaitForSingleObject
CheckWindowConnectionThread

thread $1288:
7c90df48 +0a ntdll.dll
NtWaitForMultipleObjects
7c80958a +00 kernel32.dll WaitForMultipleObjectsEx
7c80a110 +13 kernel32.dll WaitForMultipleObjects

thread $1d60: <priority:15>

7c90df48 +0a ntdll.dll
NtWaitForMultipleObjects
7c80958a +00 kernel32.dll WaitForMultipleObjectsEx
7c80a110 +13 kernel32.dll WaitForMultipleObjects
thread $15f8:
7c90d218 +0a ntdll.dll
NtDelayExecution
7c8023eb +4b kernel32.dll SleepEx
7c802450 +0a kernel32.dll Sleep
CVSync::CollectThreadMethod ($1cc8): <priority:15>
7c90d218 +00a ntdll.dll
NtDelayExecution
4a471591 +071 madVR.ax tools.cpp 791 +14 SleepMicro
4a4824ce +3de madVR.ax vsync.cpp 522 +136 CVSync.CollectThreadMethod
4a483a84 +004 madVR.ax vsync.cpp 78 +0 VSync_CollectThreadProc
CVSync::EvaluateThreadMethod ($18c8):
7c90df58 +0a ntdll.dll
NtWaitForSingleObject
7c8025d5 +85 kernel32.dll
WaitForSingleObjectEx
7c80253d +0d kernel32.dll
WaitForSingleObject
4a483af0 +60 madVR.ax
vsync.cpp 931 +5 CVSync.EvaluateThreadMethod
4a483be4 +04 madVR.ax
vsync.cpp 85 +0 VSync_EvaluateThreadProc
CFrameQueue::IvtcThread ($1970):
7c90df58 +0a ntdll.dll
7c8025d5 +85 kernel32.dll
7c80253d +0d kernel32.dll
4a426ada +7a madVR.ax
framequeue.cpp 8794 +7
4a428954 +04 madVR.ax
framequeue.cpp 176 +0

NtWaitForSingleObject
WaitForSingleObjectEx
WaitForSingleObject
CFrameQueue.IvtcThread
Queue_IvtcThread

CFrameQueue::InteropThread ($1f08): <priority:1>

7c90df58 +0a ntdll.dll
7c8025d5 +85 kernel32.dll
7c80253d +0d kernel32.dll
4a42217a +7a madVR.ax
framequeue.cpp 8908 +7
4a423d54 +04 madVR.ax
framequeue.cpp 180 +0

NtWaitForSingleObject
WaitForSingleObjectEx
WaitForSingleObject
CFrameQueue.InteropThread
Queue_InteropThread

CFrameQueue::SubtitleThread ($1314):
7c90df58 +0a ntdll.dll
7c8025d5 +85 kernel32.dll
7c80253d +0d kernel32.dll
4a42248a +7a madVR.ax
framequeue.cpp 9017 +7
4a423d84 +04 madVR.ax
framequeue.cpp 184 +0

NtWaitForSingleObject
WaitForSingleObjectEx
WaitForSingleObject
CFrameQueue.SubtitleThread
Queue_SubtitleThread

CFrameQueue::UploadThread ($1634): <priority:1>

7c90df58 +0a ntdll.dll
7c8025d5 +85 kernel32.dll
7c80253d +0d kernel32.dll
4a42540a +7a madVR.ax
framequeue.cpp 5936 +7
4a428964 +04 madVR.ax
framequeue.cpp 177 +0

NtWaitForSingleObject
WaitForSingleObjectEx
WaitForSingleObject
CFrameQueue.UploadThread
Queue_UploadThread

CFrameQueue::DxvaProcessThread ($16f8):
7c90df58 +0a ntdll.dll
7c8025d5 +85 kernel32.dll
7c80253d +0d kernel32.dll
4a42644a +7a madVR.ax
framequeue.cpp 6348 +7
4a428974 +04 madVR.ax
framequeue.cpp 178 +0

NtWaitForSingleObject
WaitForSingleObjectEx
WaitForSingleObject
CFrameQueue.DxvaProcessThread
Queue_DxvaProcessThread

CFrameQueue::SplitThread ($1e1c):

7c90df58
7c8025d5
7c80253d
4a42675a
4a428984

+0a
+85
+0d
+7a
+04

ntdll.dll
NtWaitForSingleObject
kernel32.dll
WaitForSingleObjectEx
kernel32.dll
WaitForSingleObject
madVR.ax
framequeue.cpp 6837 +7 CFrameQueue.SplitThread
madVR.ax
framequeue.cpp 179 +0 Queue_SplitThread

CDirect3D::ResetThread ($1b34):
7c90df58 +0a ntdll.dll
7c919b1e +87 ntdll.dll
7c901041 +41 ntdll.dll
4a40b369 +89 madVR.ax direct3d.cpp 2851 +7
4a40b494 +04 madVR.ax direct3d.cpp 2895 +0

NtWaitForSingleObject
RtlpWaitForCriticalSection
RtlEnterCriticalSection
CDirect3D.ResetThread
CDirect3D_ResetThread

thread $79c:
7c90d218 +0a ntdll.dll
NtDelayExecution
7c8023eb +4b kernel32.dll SleepEx
7c802450 +0a kernel32.dll Sleep
thread $1770:
7c90daa8 +a ntdll.dll NtReplyWaitReceivePortEx
thread $1a8c:
7c90df58 +0a ntdll.dll
NtWaitForSingleObject
7c8025d5 +85 kernel32.dll WaitForSingleObjectEx
7c80253d +0d kernel32.dll WaitForSingleObject
thread $a2c:
7c90df58 +0a
7c8025d5 +85
7c80253d +0d
77c3a3ad +ad

ntdll.dll
kernel32.dll
kernel32.dll
msvcrt.dll dtoxtime.c 61 +0

NtWaitForSingleObject
WaitForSingleObjectEx
WaitForSingleObject
_j1

thread $1b88: <priority:15>

7c90df48 +0a ntdll.dll
NtWaitForMultipleObjects
7c80958a +00 kernel32.dll WaitForMultipleObjectsEx
7c80a110 +13 kernel32.dll WaitForMultipleObjects
thread $1f24: <priority:15>
7c90df48 +0a ntdll.dll
NtWaitForMultipleObjects
7c80958a +00 kernel32.dll WaitForMultipleObjectsEx
7c80a110 +13 kernel32.dll WaitForMultipleObjects
thread $1b18:
7c90dc28 +0a ntdll.dll NtSetEventBoostPriority
7c919b7c +1d ntdll.dll RtlpUnWaitCriticalSection
thread $1d6c: <priority:1>
7c90df58 +0a ntdll.dll
NtWaitForSingleObject
7c8025d5 +85 kernel32.dll WaitForSingleObjectEx
7c80253d +0d kernel32.dll WaitForSingleObject
thread $10e8:
7c90d218 +0a ntdll.dll
NtDelayExecution
7c8023eb +4b kernel32.dll SleepEx
7c802450 +0a kernel32.dll Sleep
thread $c24:
7c90d218 +0a ntdll.dll
NtDelayExecution
7c8023eb +4b kernel32.dll SleepEx
7c802450 +0a kernel32.dll Sleep

thread $1e14: <priority:-1>

7c90d218 +0a ntdll.dll
7c8023eb +4b kernel32.dll
7c802450 +0a kernel32.dll
4a49ad3b +3b madVR.ax
_freebuf.c 58 +0
4a49b989 +19 madVR.ax
_freebuf.c 58 +0
modules:
00400000 PotPlayerMini.exe
00900000 Normaliz.dll
00fb0000 xpsp2res.dll
019f0000 DesktopHook.dll
05960000 MADHCNET32.DLL
05a50000 MVRSETTINGS.DLL
089f0000 LAVAudio.ax
09320000 IDMShellExt.dll
d Manager
0bef0000 Mfplat.dll
10000000 PotPlayer.dll
11820000 wmadmod.dll
14de0000 wmspdmod.dll
3d930000 WININET.dll
3dfd0000 iertutil.dll
4a400000 madVR.ax
4d4f0000 WINHTTP.dll
4fdd0000 d3d9.dll
5ad70000 uxtheme.dll
5b860000 netapi32.dll
5e760000 perfos.dll
629c0000 LPK.DLL
64000000 mdnsNSP.dll
65100000 avresample-lav-1.dll
662b0000 hnetcfg.dll
68000000 rsaenh.dll
68580000 ffcodec.dll
6cd00000 avcodec-lav-54.dll
6d990000 d3d8thk.dll
6f540000 avutil-lav-52.dll
70d00000 avformat-lav-54.dll
71a50000 mswsock.dll
71a90000 wshtcpip.dll
71aa0000 WS2HELP.dll
71ab0000 WS2_32.dll
71ad0000 wsock32.dll
71bf0000 SAMLIB.dll
722b0000 SensApi.dll
72d10000 msacm32.drv
72d20000 wdmaud.drv
732e0000 RICHED32.DLL
736b0000 msdmo.dll
73ee0000 KsUser.dll
73f10000 DSOUND.DLL
74810000 quartz.dll
74d90000 USP10.dll
74e30000 RICHED20.dll
755c0000 msctfime.ime
75e60000 cryptnet.dll
75f40000 devenum.dll
76360000 WINSTA.dll

NtDelayExecution
SleepEx
Sleep
CEnumPins.Release
CBasePin.NonDelegatingRelease

0, 0, 0, 0
6.0.5441.0
5.1.2600.5512
1.0.17.0
1.1.4.0
0.55.1.0
6.0.6.4
11.0.5721.5145
1.6.49951.0
11.0.5721.5145
11.0.5721.5263
8.0.6001.19019
8.0.6001.19019
0.87.11.0
5.1.2600.5868
5.3.2600.5512
6.0.2900.5512
5.1.2600.5694
5.1.2600.5512
5.1.2600.5512
3.0.0.10

C:\Program Files\DAUM\PotPlayer
C:\WINDOWS\system32
C:\WINDOWS\system32
C:\Program Files\DAUM\PotPlayer
C:\Program Files\New Folder
C:\Program Files\New Folder
C:\Program Files\LAV Filters\x86
C:\Program Files\Internet Downloa

C:\WINDOWS\system32
C:\Program Files\DAUM\PotPlayer
C:\WINDOWS\system32
C:\WINDOWS\system32
C:\WINDOWS\system32
C:\WINDOWS\system32
C:\Program Files\New Folder
C:\WINDOWS\system32
C:\WINDOWS\system32
C:\WINDOWS\system32
C:\WINDOWS\system32
C:\WINDOWS\system32
C:\WINDOWS\system32
C:\Program Files\Bonjour
C:\Program Files\LAV Filters\x86
5.1.2600.5512
C:\WINDOWS\system32
5.1.2600.5507
C:\WINDOWS\system32
C:\Program Files\DAUM\PotPlayer
C:\Program Files\LAV Filters\x86
5.3.2600.5512
C:\WINDOWS\system32
C:\Program Files\LAV Filters\x86
C:\Program Files\LAV Filters\x86
5.1.2600.5625
C:\WINDOWS\System32
5.1.2600.5512
C:\WINDOWS\System32
5.1.2600.5512
C:\WINDOWS\system32
5.1.2600.5512
C:\WINDOWS\system32
5.1.2600.5512
C:\WINDOWS\system32
5.1.2600.5512
C:\WINDOWS\system32
5.1.2600.5512
C:\WINDOWS\system32
5.1.2600.0
C:\WINDOWS\system32
5.1.2600.5512
C:\WINDOWS\system32
5.1.2600.0
C:\WINDOWS\system32
6.5.2600.5512
C:\WINDOWS\system32
5.3.2600.5512
C:\WINDOWS\system32
5.3.2600.5512
C:\WINDOWS\system32
6.5.2600.5933
C:\WINDOWS\system32
1.420.2600.5969 C:\WINDOWS\system32
5.30.23.1230
C:\WINDOWS\system32
5.1.2600.5768
C:\WINDOWS\system32
5.131.2600.5512 C:\WINDOWS\system32
6.5.2600.5512
C:\WINDOWS\system32
5.1.2600.5512
C:\WINDOWS\system32

76390000 IMM32.DLL
5.1.2600.5512
C:\WINDOWS\system32
763b0000 comdlg32.dll
6.0.2900.5512
C:\WINDOWS\system32
76790000 cryptdll.dll
5.1.2600.5512
C:\WINDOWS\system32
769c0000 userenv.dll
5.1.2600.5512
C:\WINDOWS\system32
76b40000 WINMM.dll
5.1.2600.5512
C:\WINDOWS\system32
76bf0000 PSAPI.DLL
5.1.2600.5512
C:\WINDOWS\system32
76c30000 WINTRUST.dll
5.131.2600.5922 C:\WINDOWS\system32
76c90000 imagehlp.dll
5.1.2600.5512
C:\WINDOWS\system32
76d60000 iphlpapi.dll
5.1.2600.5512
C:\WINDOWS\system32
76e80000 rtutils.dll
5.1.2600.5512
C:\WINDOWS\system32
76e90000 rasman.dll
5.1.2600.5512
C:\WINDOWS\system32
76eb0000 TAPI32.dll
5.1.2600.5512
C:\WINDOWS\system32
76ee0000 RASAPI32.dll
5.1.2600.5512
C:\WINDOWS\system32
76f20000 DNSAPI.dll
5.1.2600.5625
C:\WINDOWS\system32
76f50000 WTSAPI32.dll
5.1.2600.5512
C:\WINDOWS\system32
76f60000 WLDAP32.dll
5.1.2600.5512
C:\WINDOWS\system32
76fc0000 rasadhlp.dll
5.1.2600.5512
C:\WINDOWS\system32
76fd0000 CLBCATQ.DLL
2001.12.4414.700 C:\WINDOWS\system32
77050000 COMRes.dll
2001.12.4414.700 C:\WINDOWS\system32
77120000 OLEAUT32.dll
5.1.2600.5512
C:\WINDOWS\system32
773d0000 comctl32.dll
6.0.2900.6028
C:\WINDOWS\WinSxS\x86_Microsoft.W
indows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202
774e0000 ole32.dll
5.1.2600.6010
C:\WINDOWS\system32
77690000 NTMARTA.DLL
5.1.2600.5512
C:\WINDOWS\system32
77920000 SETUPAPI.dll
5.1.2600.5512
C:\WINDOWS\system32
77a80000 CRYPT32.dll
5.131.2600.5709 C:\WINDOWS\system32
77b20000 MSASN1.dll
5.1.2600.5875
C:\WINDOWS\system32
77b40000 appHelp.dll
5.1.2600.5512
C:\WINDOWS\system32
77bd0000 midimap.dll
5.1.2600.5512
C:\WINDOWS\system32
77be0000 MSACM32.dll
5.1.2600.5512
C:\WINDOWS\system32
77c00000 VERSION.dll
5.1.2600.5512
C:\WINDOWS\system32
77c10000 msvcrt.dll
7.0.2600.5512
C:\WINDOWS\system32
77c70000 msv1_0.dll
5.1.2600.5876
C:\WINDOWS\system32
77dd0000 ADVAPI32.dll
5.1.2600.5755
C:\WINDOWS\system32
77e70000 RPCRT4.dll
5.1.2600.6022
C:\WINDOWS\system32
77f10000 GDI32.dll
5.1.2600.5698
C:\WINDOWS\system32
77f60000 SHLWAPI.dll
6.0.2900.5912
C:\WINDOWS\system32
77fe0000 Secur32.dll
5.1.2600.5834
C:\WINDOWS\system32
78130000 urlmon.dll
8.0.6001.19019 C:\WINDOWS\system32
7c800000 kernel32.dll
5.1.2600.5781
C:\WINDOWS\system32
7c900000 ntdll.dll
5.1.2600.6055
C:\WINDOWS\system32
7c9c0000 SHELL32.dll
6.0.2900.6072
C:\WINDOWS\system32
7e410000 USER32.dll
5.1.2600.5512
C:\WINDOWS\system32
processes:
0000 Idle
0004 System
027c smss.exe
02ac csrss.exe
02c4 winlogon.exe
02f0 services.exe
02fc lsass.exe
03a4 svchost.exe
03d0 svchost.exe
03f8 svchost.exe
0420 svchost.exe
0450 svchost.exe
0494 svchost.exe
0668 spoolsv.exe
069c Explorer.EXE

0
0
0
63
46
4
4
4
4
11
4
4
4
6
667

0
0
0
64
14
2
1
1
2
43
1
1
4
5
425

normal
normal
normal
high
normal
normal
normal
normal
normal
normal
normal
normal
normal
normal

C:\WINDOWS\system32
C:\WINDOWS\system32
C:\WINDOWS\system32
C:\WINDOWS\system32
C:\WINDOWS\system32
C:\WINDOWS\system32
C:\WINDOWS\system32
C:\WINDOWS\System32
C:\WINDOWS\system32
C:\WINDOWS\system32
C:\WINDOWS\system32
C:\WINDOWS\system32
C:\WINDOWS

0708 svchost.exe
4 1 normal C:\WINDOWS\system32
072c AppleMobileDeviceService.exe 4 2 normal C:\Program Files\Common Files\A
pple\Mobile Device Support
0738 BlueSoleilCS.exe
23 7 normal C:\Program Files\IVT Corporatio
n\BlueSoleil
0754 mDNSResponder.exe
4 2 normal C:\Program Files\Bonjour
0778 BsMobileCS.exe
4 2 normal C:\Program Files\IVT Corporatio
n\BlueSoleil
07f4 Veoh_GirafficWatchdog.exe
4 3 normal C:\Program Files\Giraffic
00f4 HWDeviceService.exe
4 2 normal C:\Documents and Settings\All U
sers\Application Data\DatacardService
0114 jqs.exe
4 2 idle C:\Program Files\Java\jre7\bin
01e4 nvsvc32.exe
23 5 normal C:\WINDOWS\system32
0208 daemonu.exe
4 2 normal C:\Program Files\NVIDIA Corpora
tion\NVIDIA Update Core
0234 rndlresolversvc.exe
4 3 normal C:\Program Files\RealNetworks\R
ealDownloader
0270 svchost.exe
4 2 normal C:\WINDOWS\system32
0380 WLIDSVC.EXE
8 8 normal C:\Program Files\Common Files\M
icrosoft Shared\Windows Live
0a5c SteelSeriesEngine3.exe
24 16 normal C:\Program Files\SteelSeries\St
eelSeries Engine 3
0de8 ouc.exe
11 4 normal C:\Documents and Settings\All U
sers\Application Data\Zain Broadband\OnlineUpdate
0f28 WLIDSvcM.exe
4 1 normal C:\Program Files\Common Files\M
icrosoft Shared\Windows Live
0b18 BrCcUxSys.exe
29 10 normal C:\Program Files\ControlCenter4
0d6c BsHelpCS.exe
4 2 normal C:\Program Files\IVT Corporatio
n\BlueSoleil
0dcc wscntfy.exe
23 7 normal C:\WINDOWS\system32
0e24 svchost.exe
4 1 normal C:\WINDOWS\System32
0e34 iPodService.exe
4 4 normal C:\Program Files\iPod\bin
093c WMPNetwk.exe
10 8 normal C:\Program Files\Windows Media
Player
0264 BrYNSvc.exe
4 5 normal C:\Program Files\Browny02
1680 BrStMonW.exe
104 60 normal C:\Program Files\Browny02\Broth
er
11fc IDMan.exe
181 82 normal C:\Program Files\Internet Downl
oad Manager
09f8 uTorrent.exe
300 147 normal C:\Documents and Settings\ahmed
\Application Data\uTorrent
0530 Veoh_Giraffic.exe
4 10 normal C:\Program Files\Giraffic
0a54 FOXIT READER.EXE
393 214 normal C:\PROGRAM FILES\FOXIT SOFTWARE
\FOXIT READER
1988 realsched.exe
11 5 normal C:\program files\real\realplaye
r\update
1624 firefox.exe
121 57 normal C:\Program Files\Mozilla Firefo
x
0dc0 PotPlayerMini.exe
300 110 high C:\Program Files\DAUM\PotPlayer
0ce0 madHcCtrl.exe
68 26 normal C:\Program Files\New Folder
hardware:
+ Bluetooth Device
- Bluetooth HID Bus (driver 6.2.51.134)
- Bluetooth PAN Bus (driver 6.1.37.107)
- Bluetooth VComm Manager (driver 6.2.51.136)
- IVT Bluetooth Bus Device (driver 6.1.30.94)
+ Computer
- ACPI Multiprocessor PC
+ Disk drives

- WDC WD5000AAKS-00A7B2
+ Display adapters
- NVIDIA GeForce 9400 GT (driver 6.14.12.9573)
+ DVD/CD-ROM drives
- HL-DT-ST DVD-RAM GH22NP20
- HUPMXY RK5YBOLY SCSI CdRom Device
+ Floppy disk controllers
- Standard floppy disk controller
+ Human Interface Devices
- HID-compliant consumer control device
- HID-compliant consumer control device
- HID-compliant device
- HID-compliant device
- SteelSeries Kinzu v3 (driver 2.2.0.0)
- USB Human Interface Device
- USB Human Interface Device
- USB Human Interface Device
+ IDE ATA/ATAPI controllers
- Intel(R) 82801G (ICH7 Family) Ultra ATA Storage Controllers - 27DF (driver 8
.2.1.1011)
- Intel(R) 82801GB/GR/GH (ICH7 Family) Serial ATA Storage Controller - 27C0 (d
river 8.2.1.1011)
- Primary IDE Channel
- Primary IDE Channel
- Secondary IDE Channel
+ Keyboards
- HID Keyboard Device
- HID Keyboard Device
+ Mice and other pointing devices
- HID-compliant mouse
+ Modems
- Bluetooth DUN Modem (driver 6.0.12.56)
+ Monitors
- Plug and Play Monitor
+ Network adapters
- Bluetooth PAN Network Adapter (driver 6.1.37.107)
- Bluetooth PAN Network Adapter - Packet Scheduler Miniport
- Direct Parallel
- Hamachi Network Interface (driver 6.0.1.0)
- HUAWEI Mobile Connect - 3G Network Card #2 - Packet Scheduler Miniport
- HUAWEI Mobile Connect - 3G Network Card #3 - Packet Scheduler Miniport
- HUAWEI Mobile Connect - 3G Network Card #4 - Packet Scheduler Miniport
- HUAWEI Mobile Connect - 3G Network Card #5 - Packet Scheduler Miniport
- HUAWEI Mobile Connect - 3G Network Card #6 - Packet Scheduler Miniport
- HUAWEI Mobile Connect - 3G Network Card - Packet Scheduler Miniport
- Realtek PCIe GBE Family Controller (driver 5.760.503.2010)
- Realtek RTL8139 Family PCI Fast Ethernet NIC - Packet Scheduler Miniport
- Realtek RTL8139/810x Family Fast Ethernet NIC (driver 5.719.325.2009)
- Realtek RTL8168D(P)/8111D(P) PCI-E Gigabit Ethernet NIC - Packet Scheduler M
iniport
- TP-LINK 150Mbps Wireless Lite N Adapter (driver 7.7.0.75)
- TP-LINK 150Mbps Wireless Lite N Adapter #2 - Packet Scheduler Miniport
- TP-LINK 150Mbps Wireless Lite N Adapter - Packet Scheduler Miniport
- WAN Miniport (IP)
- WAN Miniport (IP) - Packet Scheduler Miniport
- WAN Miniport (L2TP)
- WAN Miniport (PPPOE)
- WAN Miniport (PPTP)
+ Portable Devices
- C3-00 (driver 7.0.56.0)

+ Ports (COM & LPT)

- Bluetooth Serial Port (COM16) (driver 6.1.25.84)
- Bluetooth Serial Port (COM17) (driver 6.1.25.84)
- Bluetooth Serial Port (COM3) (driver 6.1.25.84)
- Bluetooth Serial Port (COM4) (driver 6.1.25.84)
- Bluetooth Serial Port (COM5) (driver 6.1.25.84)
- Bluetooth Serial Port (COM6) (driver 6.1.25.84)
- Bluetooth Serial Port (COM7) (driver 6.1.25.84)
- Communications Port (COM1)
- ECP Printer Port (LPT1)
+ Processors
- Pentium(R) Dual-Core CPU
E5300 @ 2.60GHz
- Pentium(R) Dual-Core CPU
E5300 @ 2.60GHz
+ SCSI and RAID controllers
- AIXU6HFU IDE Controller
+ Sound, video and game controllers
- Audio Codecs
- Legacy Audio Drivers
- Legacy Video Capture Devices
- Media Control Devices
- Realtek High Definition Audio (driver 5.10.0.5764)
- Video Codecs
+ System devices
- ACPI Fixed Feature Button
- ACPI Power Button
- Direct memory access controller
- Extended IO Bus
- High precision event timer
- Intel(R) 4 Series Chipset PCI Express Root Port - 2E31 (driver 9.0.0.1009)
- Intel(R) 4 Series Chipset Processor to I/O Controller - 2E30 (driver 9.0.0.1
009)
- Intel(R) 82801 PCI Bridge - 244E
- Intel(R) 82801G (ICH7 Family) PCI Express Root Port - 27D0 (driver 8.6.1.100
2)
- Intel(R) 82801G (ICH7 Family) PCI Express Root Port - 27D2 (driver 8.6.1.100
2)
- Intel(R) 82801G (ICH7 Family) SMBus Controller - 27DA (driver 8.6.1.1002)
- Intel(R) 82801GB/GR (ICH7 Family) LPC Interface Controller - 27B8 (driver 8.
6.1.1002)
- ISAPNP Read Data Port
- Logical Disk Manager
- Microcode Update Device
- Microsoft ACPI-Compliant System
- Microsoft System Management BIOS Driver
- Microsoft UAA Bus Driver for High Definition Audio
- Motherboard resources
- Motherboard resources
- Motherboard resources
- Motherboard resources
- Numeric data processor
- PCI bus
- Plug and Play Software Device Enumerator
- Printer Port Logical Interface
- Programmable interrupt controller
- System board
- System board
- System CMOS/real time clock
- System speaker
- System timer
- Terminal Server Device Redirector

- Terminal Server Keyboard Driver

- Terminal Server Mouse Driver
- Volume Manager
+ Universal Serial Bus controllers
- HUAWEI Mobile Connect - Bus Enumerate Device (driver 2.6.2.1605)
- Intel(R) 82801G (ICH7 Family) USB Universal Host Controller - 27C8
.0.1.1008)
- Intel(R) 82801G (ICH7 Family) USB Universal Host Controller - 27C9
.0.1.1008)
- Intel(R) 82801G (ICH7 Family) USB Universal Host Controller - 27CA
.0.1.1008)
- Intel(R) 82801G (ICH7 Family) USB Universal Host Controller - 27CB
.0.1.1008)
- Intel(R) 82801G (ICH7 Family) USB2 Enhanced Host Controller - 27CC
.0.1.1008)
- USB Composite Device
- USB Composite Device
- USB Root Hub
- USB Root Hub
- USB Root Hub
- USB Root Hub
- USB Root Hub
cpu
eax
ebx
ecx
edx
esi
edi
eip
esp
ebp

(driver 8
(driver 8
(driver 8
(driver 8
(driver 8

registers:
= 00000000
= 05158928
= 7ff97000
= 0e8ce8e4
= 0daf4050
= 001944f8
= 105b4a6f
= 0e8ce8cc
= 0d8c9920

stack dump:
0e8ce8cc 00
0e8ce8dc 50
0e8ce8ec 00
0e8ce8fc 00
0e8ce90c 00
0e8ce91c 00
0e8ce92c 30
0e8ce93c f0
0e8ce94c 10
0e8ce95c 18
0e8ce96c 0f
0e8ce97c df
0e8ce98c fb
0e8ce99c 00
0e8ce9ac 18
0e8ce9bc 05
0e8ce9cc 00
0e8ce9dc 7b
0e8ce9ec e4
0e8ce9fc 28

00
40
00
00
00
00
00
38
39
00
31
79
35
05
00
39
00
0f
80
ee

00
af
00
00
00
00
00
0f
0f
00
96
90
96
00
00
96
00
00
8b
8c

00
0d
00
00
00
00
00
bd
bd
00
bf
bf
bf
00
00
bf
00
00
0d
0e

disassembling:
[...]
4a446ba6
push
4a446ba7
lea

00
00
00
00
00
00
ff
a0
20
0e
85
1c
75
00
0d
69
d8
00
1a
28

00
00
00
00
00
00
03
4c
39
00
4b
00
36
04
00
38
80
00
00
ee

00
00
00
00
00
00
00
0f
0f
00
8f
00
96
00
00
96
8b
00
00
8c

00
00
00
00
00
00
00
bd
bd
00
bf
00
bf
00
00
bf
0d
00
00
0e

e4
00
00
00
00
00
c0
e0
30
00
0c
1f
f2
3c
70
d8
00
78
44
02

eax
eax, [ebp-$10]

e8
00
00
00
00
00
38
38
39
00
00
00
36
00
38
80
00
ed
ec
09

8c
00
00
00
00
00
0f
0f
0f
00
00
00
96
00
0f
8b
00
8c
8c
00

0e
00
00
00
00
00
bd
bd
bd
00
00
00
bf
00
bd
0d
00
0e
0e
00

96
00
00
00
00
00
d0
00
40
9f
01
81
6f
16
00
d8
b2
00
00
00

76
00
00
00
00
00
38
39
39
3a
00
35
37
00
00
80
00
00
00
00

ed
00
00
00
00
00
0f
0f
0f
96
00
96
96
00
00
8b
00
00
00
00

f6
00
00
00
00
00
bd
bd
bd
bf
00
bf
bf
00
00
0d
80
00
00
00

.............v..
P@..............
................
................
................
................
0........8...8..
.8...L...8...9..
.9.. 9..09..@9..
.............:..
.1...K..........
.y...........5..
.5..u6...6..o7..
........<.......
........p8......
.9..i8..........
................
{.......x.......
........D.......
(...(...........

4a446baa
4a446bb0
4a446bb2
4a446bb5
4a446bbc
4a446bbe
4a446bc4
4a446bc5
dll)
4a446bcb
4a446bd2
4a446bd8
4a446bda
4a446bdc
4a446bdf
4a446be1
4a446be7
4a446be8
4a446be9
4a446bec
4a446bee
4a446bf1
4a446bf3
4a446bfa
4a446bff
4a446c01
4a446c04
4a446c0b
4a446c0c
4a446c0d
4a446c0e
4a446c0f
4a446c11
4a446c12

2184

2185
2187
2188

mov
mov
mov
cmp
jz
lea
push
call

mov
mov
test
jz
2190 mov
mov
mov
push
push
mov
> call
2191 mov
2192 jmp
2194 mov
call
2201 mov
2202 mov
mov
pop
pop
pop
pop
mov
pop
ret

fs:[0], eax
edi, ecx
[ebp-$1c], edi
byte ptr [edi+$36ec], 0
loc_4a446bcb
eax, [edi+$36d4]
eax
dword ptr [$4a4c80e0] ; RtlEnterCriticalSection (ntdll.
dword ptr [ebp-4], 0
esi, [edi+$36cc]
esi, esi
loc_4a446bf3
eax, [esi+4]
ecx, [eax]
edx, [edi+$2838]
edx
eax
eax, [ecx+$c]
eax
esi, [esi+8]
loc_4a446bd8
dword ptr [ebp-4], $fffffffe
+$17 ($4a446c16)
al, 1
ecx, [ebp-$10]
fs:[0], ecx
ecx
edi
esi
ebx
esp, ebp
ebp