|
@@ -1,3349 +0,0 @@
|
|
|
----
|
|
|
-created: '2022-05-04T14:29:34.800765Z'
|
|
|
-creator: sentry
|
|
|
-source: tests/symbolicator/test_unreal_full.py
|
|
|
----
|
|
|
-contexts:
|
|
|
- device:
|
|
|
- arch: x86_64
|
|
|
- memory_size: 6896832512
|
|
|
- type: device
|
|
|
- gpu:
|
|
|
- name: Parallels Display Adapter (WDDM)
|
|
|
- type: gpu
|
|
|
- os:
|
|
|
- name: Windows 10
|
|
|
- type: os
|
|
|
- version: 10.0.17134
|
|
|
- unreal:
|
|
|
- app_default_locate: en-US
|
|
|
- base_dir: //Mac/Home/Desktop/WindowsNoEditor/YetAnother/Binaries/Win64/
|
|
|
- build_configuration: Development
|
|
|
- build_version: ++UE4+Release-4.20-CL-4369336
|
|
|
- crash_guid: UE4CC-Windows-63456D684167A2659DE73EA3517BEDC4_0000
|
|
|
- crash_type: Crash
|
|
|
- custom:
|
|
|
- CommandLine: ''
|
|
|
- CrashDumpMode: '0'
|
|
|
- CrashVersion: '3'
|
|
|
- DeploymentName: ''
|
|
|
- EngineModeEx: Unset
|
|
|
- GameSessionID: ''
|
|
|
- IsPerforceBuild: 'false'
|
|
|
- MemoryStats.AvailablePhysical: '0'
|
|
|
- MemoryStats.AvailableVirtual: '0'
|
|
|
- MemoryStats.OOMAllocationAlignment: '0'
|
|
|
- MemoryStats.OOMAllocationSize: '0'
|
|
|
- MemoryStats.PeakUsedPhysical: '0'
|
|
|
- MemoryStats.PeakUsedVirtual: '0'
|
|
|
- MemoryStats.UsedPhysical: '0'
|
|
|
- MemoryStats.UsedVirtual: '0'
|
|
|
- MemoryStats.bIsOOM: '0'
|
|
|
- PlatformFullName: Win64 [Windows 10 64b]
|
|
|
- PlatformNameIni: Windows
|
|
|
- SourceContext: ''
|
|
|
- UserActivityHint: ''
|
|
|
- engine_mode: Game
|
|
|
- engine_version: 4.20.3-4369336+++UE4+Release-4.20
|
|
|
- executable_name: YetAnother
|
|
|
- game_name: UE4-YetAnother
|
|
|
- is_assert: false
|
|
|
- is_ensure: false
|
|
|
- is_internal_build: false
|
|
|
- is_source_distribution: false
|
|
|
- is_ue4_release: false
|
|
|
- language_lcid: 1033
|
|
|
- legacy_call_stack: 'YetAnother!AActor::IsPendingKillPending()
|
|
|
-
|
|
|
- YetAnother!AActor::Destroy()
|
|
|
-
|
|
|
- YetAnother!FActorComponentTickFunction::ExecuteTickHelper<<lambda_e8384def656dc646af48282ce274db64>
|
|
|
- >()
|
|
|
-
|
|
|
- YetAnother!FActorComponentTickFunction::ExecuteTick()
|
|
|
-
|
|
|
- YetAnother!FTickFunctionTask::DoTask()
|
|
|
-
|
|
|
- YetAnother!TGraphTask<FTickFunctionTask>::ExecuteTask()
|
|
|
-
|
|
|
- YetAnother!FNamedTaskThread::ProcessTasksNamedThread()
|
|
|
-
|
|
|
- YetAnother!FNamedTaskThread::ProcessTasksUntilIdle()
|
|
|
-
|
|
|
- YetAnother!FTickTaskSequencer::ReleaseTickGroup()
|
|
|
-
|
|
|
- YetAnother!FTickTaskManager::RunTickGroup()
|
|
|
-
|
|
|
- YetAnother!UWorld::RunTickGroup()
|
|
|
-
|
|
|
- YetAnother!UWorld::Tick()
|
|
|
-
|
|
|
- YetAnother!UGameEngine::Tick()
|
|
|
-
|
|
|
- YetAnother!FEngineLoop::Tick()
|
|
|
-
|
|
|
- YetAnother!GuardedMain()
|
|
|
-
|
|
|
- YetAnother!GuardedMainWrapper()
|
|
|
-
|
|
|
- YetAnother!WinMain()
|
|
|
-
|
|
|
- YetAnother!__scrt_common_main_seh() [f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:288]
|
|
|
-
|
|
|
- kernel32
|
|
|
-
|
|
|
- ntdll'
|
|
|
- login_id: 9776d4844cc893f55395dbbefb0eb6d7
|
|
|
- machine_id: 9776D4844CC893F55395DBBEFB0EB6D7
|
|
|
- memory_stats_page_size: 4096
|
|
|
- memory_stats_total_phsysical_gb: 7
|
|
|
- memory_stats_total_virtual: 140737488224256
|
|
|
- misc_cpu_brand: Intel(R) Core(TM) i7-7920HQ CPU @ 3.10GHz
|
|
|
- misc_cpu_vendor: GenuineIntel
|
|
|
- misc_number_of_cores: 6
|
|
|
- misc_number_of_cores_inc_hyperthread: 6
|
|
|
- platform_name: WindowsNoEditor
|
|
|
- portable_call_stack: YetAnother 0x00000000544e0000 + 703394 YetAnother 0x00000000544e0000
|
|
|
- + 281f2ee YetAnother 0x00000000544e0000 + 2a26dd3 YetAnother 0x00000000544e0000
|
|
|
- + 2a4f984 YetAnother 0x00000000544e0000 + 355e77e YetAnother 0x00000000544e0000
|
|
|
- + 3576186 YetAnother 0x00000000544e0000 + 8acc56 YetAnother 0x00000000544e0000
|
|
|
- + 8acf00 YetAnother 0x00000000544e0000 + 35c121d YetAnother 0x00000000544e0000
|
|
|
- + 35cfb58 YetAnother 0x00000000544e0000 + 2eb082f YetAnother 0x00000000544e0000
|
|
|
- + 2eb984f YetAnother 0x00000000544e0000 + 2d1cd39 YetAnother 0x00000000544e0000
|
|
|
- + 325258 YetAnother 0x00000000544e0000 + 334e4c YetAnother 0x00000000544e0000
|
|
|
- + 334eaa YetAnother 0x00000000544e0000 + 3429e6 YetAnother 0x00000000544e0000
|
|
|
- + 44e73c6 KERNEL32 0x000000000fd40000 + 13034 ntdll 0x0000000010060000 + 71471
|
|
|
- process_id: 9444
|
|
|
- root_dir: /Mac/Home/Desktop/WindowsNoEditor/
|
|
|
- seconds_since_start: 8
|
|
|
- time_of_crash: 636783112433190000
|
|
|
- type: unreal
|
|
|
-exception:
|
|
|
- values:
|
|
|
- - mechanism:
|
|
|
- handled: false
|
|
|
- synthetic: true
|
|
|
- type: minidump
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff7548229e5'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff754814ea9'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff754814e4b'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff75480faff'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff754802a17'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff754808327'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0c94e265'
|
|
|
- package: C:\Windows\System32\bcryptPrimitives.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0c94e4ac'
|
|
|
- package: C:\Windows\System32\bcryptPrimitives.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff754805257'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff75483137f'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff7548149a7'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff75480facf'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff7548221de'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff75480faef'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff75481f05c'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: AActor::IsPendingKillPending
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff754be3394'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: AActor::IsPendingKillPending()
|
|
|
- symbol: AActor::IsPendingKillPending()
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ffef000'
|
|
|
- r11: '0x23d82c75ab0'
|
|
|
- r12: '0x23d82c7d000'
|
|
|
- r13: '0x3'
|
|
|
- r14: '0x23df8f48bc0'
|
|
|
- r15: '0x23df9a35d48'
|
|
|
- r8: '0x8c3f2cd401'
|
|
|
- r9: '0x7ffe03a9c86e'
|
|
|
- rax: '0x64'
|
|
|
- rbp: '0x8c3f2cd650'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x0'
|
|
|
- rdi: '0x1'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ff754be3394'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c3f2cd4c0'
|
|
|
- thread_id: 6900
|
|
|
- type: EXCEPTION_ACCESS_VIOLATION_READ
|
|
|
- value: 'Fatal Error: EXCEPTION_ACCESS_VIOLATION_READ'
|
|
|
-extra: null
|
|
|
-sdk:
|
|
|
- name: unreal.crashreporter
|
|
|
- version: '1.0'
|
|
|
-stacktrace: null
|
|
|
-threads:
|
|
|
- values:
|
|
|
- - id: 248
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff7548229e5'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff754814ea9'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe10066c86'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100fed3d'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff754814ea9'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff754814ea9'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe03a9bf10'
|
|
|
- package: C:\Windows\System32\VCRUNTIME140.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ff7544e0000'
|
|
|
- r11: '0x7ff7589ca88b'
|
|
|
- r12: '0x7ff7544e0000'
|
|
|
- r13: '0x8c3f2cf910'
|
|
|
- r14: '0x26c'
|
|
|
- r15: '0x8c3f2cc670'
|
|
|
- r8: '0x8c3f2cccc0'
|
|
|
- r9: '0x8c3f2cc670'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c3f2cf910'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x26c'
|
|
|
- rdi: '0x26c'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c3f2cc448'
|
|
|
- rsp: '0x8c3f2cc418'
|
|
|
- - id: 9772
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe10083140'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe1007f856'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100fd854'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x6c'
|
|
|
- r11: '0x8c3f79f140'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df7323810'
|
|
|
- r14: '0x7ffe10080a60'
|
|
|
- r15: '0x7ffe10081350'
|
|
|
- r8: '0x8c3f79f3a0'
|
|
|
- r9: '0x23df732ca30'
|
|
|
- rax: '0x1cb'
|
|
|
- rbp: '0x0'
|
|
|
- rbx: '0x23df7325070'
|
|
|
- rcx: '0x50'
|
|
|
- rdi: '0x10'
|
|
|
- rdx: '0x23df7325070'
|
|
|
- rip: '0x7ffe100fd854'
|
|
|
- rsi: '0x7ffe10083140'
|
|
|
- rsp: '0x8c3f79fb48'
|
|
|
- - id: 8188
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe10083140'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe1007f856'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100fd854'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x23d833cc5b0'
|
|
|
- r11: '0x23d833ce4b0'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df7323810'
|
|
|
- r14: '0x7ffe10080a60'
|
|
|
- r15: '0x7ffe10081350'
|
|
|
- r8: '0x8'
|
|
|
- r9: '0x1'
|
|
|
- rax: '0x1cb'
|
|
|
- rbp: '0x0'
|
|
|
- rbx: '0x23df7326fd0'
|
|
|
- rcx: '0x50'
|
|
|
- rdi: '0x10'
|
|
|
- rdx: '0x23df7326fd0'
|
|
|
- rip: '0x7ffe100fd854'
|
|
|
- rsi: '0x7ffe10083140'
|
|
|
- rsp: '0x8c3fc6f838'
|
|
|
- - id: 10188
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe10083140'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe1007f856'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100fd854'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x23df7290cc0'
|
|
|
- r11: '0x7ffe10178b20'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df7323810'
|
|
|
- r14: '0x7ffe10080a60'
|
|
|
- r15: '0x7ffe10081350'
|
|
|
- r8: '0x23d83413970'
|
|
|
- r9: '0x1b0'
|
|
|
- rax: '0x1cb'
|
|
|
- rbp: '0x0'
|
|
|
- rbx: '0x23df7327370'
|
|
|
- rcx: '0x50'
|
|
|
- rdi: '0x10'
|
|
|
- rdx: '0x23df7327370'
|
|
|
- rip: '0x7ffe100fd854'
|
|
|
- rsi: '0x7ffe10083140'
|
|
|
- rsp: '0x8c4013f6b8'
|
|
|
- - crashed: true
|
|
|
- id: 6900
|
|
|
- - id: 5200
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0cab443b'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ffef000'
|
|
|
- r11: '0x1'
|
|
|
- r12: '0x1'
|
|
|
- r13: '0x23df8d19f20'
|
|
|
- r14: '0x2a0'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x1'
|
|
|
- r9: '0x8c3ebbf410'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c3ebbf5a9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x2a0'
|
|
|
- rdi: '0x2a0'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c3ebbf438'
|
|
|
- - id: 9648
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0cab443b'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x246'
|
|
|
- r12: '0x1'
|
|
|
- r13: '0x23df8d19f60'
|
|
|
- r14: '0x2a4'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x8c4068f738'
|
|
|
- r9: '0x8c4068f8a9'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c4068f8a9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x2a4'
|
|
|
- rdi: '0x2a4'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c4068f738'
|
|
|
- - id: 4372
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0cab443b'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x23d8e930000'
|
|
|
- r12: '0x1'
|
|
|
- r13: '0x23df8d19800'
|
|
|
- r14: '0x2a8'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x10000'
|
|
|
- r9: '0xcdcdcdcdcdcdcdcd'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c4070f8e9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x2a8'
|
|
|
- rdi: '0x2a8'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c4070f778'
|
|
|
- - id: 10628
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ff758ce10a8'
|
|
|
- r11: '0x23d8d30edc0'
|
|
|
- r12: '0x1'
|
|
|
- r13: '0x23df8d197a0'
|
|
|
- r14: '0x2ac'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x1240'
|
|
|
- r9: '0xdddddddddddddddd'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c4078f9c9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x2ac'
|
|
|
- rdi: '0x2ac'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c4078f858'
|
|
|
- - id: 11280
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0cab443b'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1450'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ff758ce10a8'
|
|
|
- r11: '0x23d8d48edc0'
|
|
|
- r12: '0x1'
|
|
|
- r13: '0x23df8d197e0'
|
|
|
- r14: '0x2b0'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x1240'
|
|
|
- r9: '0xdddddddddddddddd'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c4080f5d9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x2b0'
|
|
|
- rdi: '0x2b0'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c4080f468'
|
|
|
- - id: 2432
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0cab443b'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x23df732f648'
|
|
|
- r11: '0x23df732f638'
|
|
|
- r12: '0x1'
|
|
|
- r13: '0x23df8d19860'
|
|
|
- r14: '0x2b4'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x0'
|
|
|
- r9: '0x0'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c4088f979'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x2b4'
|
|
|
- rdi: '0x2b4'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c4088f808'
|
|
|
- - id: 6680
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0cab443b'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1450'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x23df7346090'
|
|
|
- r11: '0x23d829847a0'
|
|
|
- r12: '0x1'
|
|
|
- r13: '0x23df8d19cc0'
|
|
|
- r14: '0x2b8'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x0'
|
|
|
- r9: '0x1'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c4090fac9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x2b8'
|
|
|
- rdi: '0x2b8'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c4090f958'
|
|
|
- - id: 6492
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0cab443b'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1450'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x23d8d180000'
|
|
|
- r12: '0x1'
|
|
|
- r13: '0x23df8d19c80'
|
|
|
- r14: '0x2bc'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x60000'
|
|
|
- r9: '0xcdcdcdcdcdcdcdcd'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c4098fbd9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x2bc'
|
|
|
- rdi: '0x2bc'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c4098fa68'
|
|
|
- - id: 6080
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0cab443b'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1450'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x23d8d180000'
|
|
|
- r12: '0x1'
|
|
|
- r13: '0x23df8d19c40'
|
|
|
- r14: '0x2c0'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x23d8d077638'
|
|
|
- r9: '0x40'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c40a0f469'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x2c0'
|
|
|
- rdi: '0x2c0'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c40a0f2f8'
|
|
|
- - id: 6984
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0cab443b'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1450'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x246'
|
|
|
- r12: '0x1'
|
|
|
- r13: '0x23df8d19c00'
|
|
|
- r14: '0x2c4'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x23df8f10000'
|
|
|
- r9: '0x10000'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c40a8f9d9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x2c4'
|
|
|
- rdi: '0x2c4'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c40a8f868'
|
|
|
- - id: 10192
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1450'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x23df7346090'
|
|
|
- r11: '0x8c40b0eef0'
|
|
|
- r12: '0x1'
|
|
|
- r13: '0x23df8d19bc0'
|
|
|
- r14: '0x2c8'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x2'
|
|
|
- r9: '0x2'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c40b0f739'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x2c8'
|
|
|
- rdi: '0x2c8'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c40b0f5c8'
|
|
|
- - id: 11120
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1450'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ffef000'
|
|
|
- r11: '0x23d82351d80'
|
|
|
- r12: '0x1'
|
|
|
- r13: '0x23df8d19b80'
|
|
|
- r14: '0x2cc'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x1'
|
|
|
- r9: '0x18'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c40b8fbe9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x2cc'
|
|
|
- rdi: '0x2cc'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c40b8fa78'
|
|
|
- - id: 4872
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ff758ce10a8'
|
|
|
- r11: '0x8c40c0f4a8'
|
|
|
- r12: '0x1'
|
|
|
- r13: '0x23df8d1a380'
|
|
|
- r14: '0x2d0'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x6'
|
|
|
- r9: '0x8'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c40c0fbe9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x2d0'
|
|
|
- rdi: '0x2d0'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c40c0fa78'
|
|
|
- - id: 4160
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1450'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ff758ce10a8'
|
|
|
- r11: '0x8c40c8f268'
|
|
|
- r12: '0x1'
|
|
|
- r13: '0x23df8d1a340'
|
|
|
- r14: '0x2d4'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x23df8fb6b80'
|
|
|
- r9: '0x2'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c40c8f9a9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x2d4'
|
|
|
- rdi: '0x2d4'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c40c8f838'
|
|
|
- - id: 11048
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1450'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ff758ce10a8'
|
|
|
- r11: '0x23d8d490080'
|
|
|
- r12: '0x1'
|
|
|
- r13: '0x23df8d1a300'
|
|
|
- r14: '0x2d8'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x1240'
|
|
|
- r9: '0xdddddddddddddddd'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c40d0fa19'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x2d8'
|
|
|
- rdi: '0x2d8'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c40d0f8a8'
|
|
|
- - id: 7512
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0cab443b'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x23d8e630000'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df8d19840'
|
|
|
- r14: '0x6c'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x10000'
|
|
|
- r9: '0xdddddddddddddddd'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c40d8fb69'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x6c'
|
|
|
- rdi: '0x6c'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c40d8f9f8'
|
|
|
- - id: 8684
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x246'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df918ca40'
|
|
|
- r14: '0x308'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x8c3ebdfa88'
|
|
|
- r9: '0x8c3ebdfbf9'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c3ebdfbf9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x308'
|
|
|
- rdi: '0x308'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c3ebdfab8'
|
|
|
- rsp: '0x8c3ebdfa88'
|
|
|
- - id: 5444
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x246'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df918cac0'
|
|
|
- r14: '0x310'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x8c3ebff458'
|
|
|
- r9: '0x8c3ebff5c9'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c3ebff5c9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x310'
|
|
|
- rdi: '0x310'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c3ebff488'
|
|
|
- rsp: '0x8c3ebff458'
|
|
|
- - id: 12064
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff75482017a'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ffef000'
|
|
|
- r11: '0x1'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df918cbc0'
|
|
|
- r14: '0x318'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x0'
|
|
|
- r9: '0xfffffffffe7f6361'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c40dafc69'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x318'
|
|
|
- rdi: '0x318'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c40dafb28'
|
|
|
- rsp: '0x8c40dafaf8'
|
|
|
- - id: 468
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff75482017a'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ffef000'
|
|
|
- r11: '0x1'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df918cba0'
|
|
|
- r14: '0x320'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x0'
|
|
|
- r9: '0xfffffffffe7f6361'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c40dcf809'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x320'
|
|
|
- rdi: '0x320'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c40dcf6c8'
|
|
|
- rsp: '0x8c40dcf698'
|
|
|
- - id: 8276
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff75482017a'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ffef000'
|
|
|
- r11: '0x8c40def4b8'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df918cc40'
|
|
|
- r14: '0x328'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x0'
|
|
|
- r9: '0xfffffffffe7f6361'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c40def589'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x328'
|
|
|
- rdi: '0x328'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c40def448'
|
|
|
- rsp: '0x8c40def418'
|
|
|
- - id: 7604
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ffef000'
|
|
|
- r11: '0x1'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df918cb00'
|
|
|
- r14: '0x330'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x0'
|
|
|
- r9: '0xfffffffffe7f6361'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c40e0f6c9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x330'
|
|
|
- rdi: '0x330'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c40e0f588'
|
|
|
- rsp: '0x8c40e0f558'
|
|
|
- - id: 8056
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ffef000'
|
|
|
- r11: '0x8c40e2f8d8'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df918ccc0'
|
|
|
- r14: '0x338'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x0'
|
|
|
- r9: '0xfffffffffe7f6361'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c40e2f9a9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x338'
|
|
|
- rdi: '0x338'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c40e2f868'
|
|
|
- rsp: '0x8c40e2f838'
|
|
|
- - id: 7540
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0caa5e9a'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100fa584'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x246'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x0'
|
|
|
- r14: '0x0'
|
|
|
- r15: '0x0'
|
|
|
- r8: '0x8c412ff828'
|
|
|
- r9: '0x0'
|
|
|
- rax: '0x34'
|
|
|
- rbp: '0x0'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x0'
|
|
|
- rdi: '0xa'
|
|
|
- rdx: '0x8c412ff850'
|
|
|
- rip: '0x7ffe100fa584'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c412ff828'
|
|
|
- - id: 9920
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0caa5e9a'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100fa584'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x246'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x0'
|
|
|
- r14: '0x0'
|
|
|
- r15: '0x0'
|
|
|
- r8: '0x8c4131fd08'
|
|
|
- r9: '0x0'
|
|
|
- rax: '0x34'
|
|
|
- rbp: '0x0'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x0'
|
|
|
- rdi: '0x21'
|
|
|
- rdx: '0x8c4131fd30'
|
|
|
- rip: '0x7ffe100fa584'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c4131fd08'
|
|
|
- - id: 4264
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff754b6efc5'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x246'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df90dfa80'
|
|
|
- r14: '0x3d4'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x8c4133f6f8'
|
|
|
- r9: '0x8c4133f869'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c4133f869'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x3d4'
|
|
|
- rdi: '0x3d4'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c4133f728'
|
|
|
- rsp: '0x8c4133f6f8'
|
|
|
- - id: 2548
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x23d8e5b0000'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df90decc0'
|
|
|
- r14: '0x460'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x10000'
|
|
|
- r9: '0xcdcdcdcdcdcdcdcd'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c4135fcd9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x460'
|
|
|
- rdi: '0x460'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c4135fb98'
|
|
|
- rsp: '0x8c4135fb68'
|
|
|
- - id: 3060
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ffef000'
|
|
|
- r11: '0x8c4137fa88'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df90deee0'
|
|
|
- r14: '0x46c'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x8c4137fa18'
|
|
|
- r9: '0xfffffffffe7f6361'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c4137fb59'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x46c'
|
|
|
- rdi: '0x46c'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c4137fa18'
|
|
|
- rsp: '0x8c4137f9e8'
|
|
|
- - id: 664
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x246'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df90dd3e0'
|
|
|
- r14: '0x474'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x8c4139fa83'
|
|
|
- r9: '0xfffffffffe7f6361'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c4139fb79'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x474'
|
|
|
- rdi: '0x474'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c4139fa38'
|
|
|
- rsp: '0x8c4139fa08'
|
|
|
- - id: 3028
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x246'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df90df340'
|
|
|
- r14: '0x47c'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x8c413bf8c8'
|
|
|
- r9: '0x8c413bfa39'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c413bfa39'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x47c'
|
|
|
- rdi: '0x47c'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c413bf8f8'
|
|
|
- rsp: '0x8c413bf8c8'
|
|
|
- - id: 964
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe1007f856'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100fd854'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x23df7327fc8'
|
|
|
- r11: '0x7ffe10178b20'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df7320b30'
|
|
|
- r14: '0x7ffe10080a60'
|
|
|
- r15: '0x7ffe10081350'
|
|
|
- r8: '0x1'
|
|
|
- r9: '0x23d83380000'
|
|
|
- rax: '0x1cb'
|
|
|
- rbp: '0x0'
|
|
|
- rbx: '0x23dfa7338e0'
|
|
|
- rcx: '0x10'
|
|
|
- rdi: '0x10'
|
|
|
- rdx: '0x23dfa7338e0'
|
|
|
- rip: '0x7ffe100fd854'
|
|
|
- rsi: '0x7ffe10083140'
|
|
|
- rsp: '0x8c4223f9f8'
|
|
|
- - id: 9124
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ffef000'
|
|
|
- r11: '0x1'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23d8235b880'
|
|
|
- r14: '0x694'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x8c418bfb83'
|
|
|
- r9: '0xfffffffffe7f6361'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c418bfd49'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x694'
|
|
|
- rdi: '0x694'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c418bfc08'
|
|
|
- rsp: '0x8c418bfbd8'
|
|
|
- - id: 9264
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x246'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23d821716c0'
|
|
|
- r14: '0x4f4'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x8c4270fc08'
|
|
|
- r9: '0x0'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c4270fb89'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x4f4'
|
|
|
- rdi: '0x4f4'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c4270fa48'
|
|
|
- rsp: '0x8c4270fa18'
|
|
|
- - id: 7528
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe10083140'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe1007f856'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100fd854'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x7ffe00d599b6'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df7320b30'
|
|
|
- r14: '0x7ffe10080a60'
|
|
|
- r15: '0x7ffe10081350'
|
|
|
- r8: '0x50'
|
|
|
- r9: '0x0'
|
|
|
- rax: '0x1cb'
|
|
|
- rbp: '0x0'
|
|
|
- rbx: '0x23d833a5830'
|
|
|
- rcx: '0x10'
|
|
|
- rdi: '0x10'
|
|
|
- rdx: '0x23d833a5830'
|
|
|
- rip: '0x7ffe100fd854'
|
|
|
- rsi: '0x7ffe10083140'
|
|
|
- rsp: '0x8c42bdfa78'
|
|
|
- - id: 4136
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0e526d4c'
|
|
|
- package: C:\Windows\System32\combase.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0e4f102e'
|
|
|
- package: C:\Windows\System32\combase.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0e491671'
|
|
|
- package: C:\Windows\System32\combase.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0e4b8b37'
|
|
|
- package: C:\Windows\System32\combase.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0e48dff0'
|
|
|
- package: C:\Windows\System32\combase.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe10072b55'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99be3'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100a70e0'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe10073755'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100795c8'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe10077f34'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe101ba460'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe10078044'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100793e8'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0e494217'
|
|
|
- package: C:\Windows\System32\combase.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0caa75f9'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe10072b55'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100a70e0'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d305b'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d311e'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe10091b96'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe10091b76'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe07679bf0'
|
|
|
- package: C:\Windows\System32\RTWorkQ.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe10091bae'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe07679bf0'
|
|
|
- package: C:\Windows\System32\RTWorkQ.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0caa6099'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100faa54'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x0'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x8c430af960'
|
|
|
- r14: '0x0'
|
|
|
- r15: '0x0'
|
|
|
- r8: '0x97'
|
|
|
- r9: '0x0'
|
|
|
- rax: '0x5b'
|
|
|
- rbp: '0x650'
|
|
|
- rbx: '0x1'
|
|
|
- rcx: '0x1'
|
|
|
- rdi: '0x1'
|
|
|
- rdx: '0x8c430af960'
|
|
|
- rip: '0x7ffe100faa54'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c430af608'
|
|
|
- - id: 10520
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff7549e3f3c'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ffef000'
|
|
|
- r11: '0x1'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23d8235c4e0'
|
|
|
- r14: '0x5a0'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x8c418df683'
|
|
|
- r9: '0xfffffffffe7f6361'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c418df7c9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x5a0'
|
|
|
- rdi: '0x5a0'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c418df688'
|
|
|
- rsp: '0x8c418df658'
|
|
|
- - id: 10828
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff7549e3f3c'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ffef000'
|
|
|
- r11: '0x1'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23d823598a0'
|
|
|
- r14: '0x4e0'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x8c418ff983'
|
|
|
- r9: '0xfffffffffe7f6361'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c418ffad9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x4e0'
|
|
|
- rdi: '0x4e0'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c418ff998'
|
|
|
- rsp: '0x8c418ff968'
|
|
|
- - id: 6428
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff7549e3f3c'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x246'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23d82359820'
|
|
|
- r14: '0x4d4'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x8c4191f683'
|
|
|
- r9: '0x8c4191f7b9'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c4191f7b9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x4d4'
|
|
|
- rdi: '0x4d4'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c4191f678'
|
|
|
- rsp: '0x8c4191f648'
|
|
|
- - id: 11276
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff7549e3f3c'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x246'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23d823597e0'
|
|
|
- r14: '0x64c'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x8c4193f788'
|
|
|
- r9: '0x8c4193f8f9'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c4193f8f9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x64c'
|
|
|
- rdi: '0x64c'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c4193f7b8'
|
|
|
- rsp: '0x8c4193f788'
|
|
|
- - id: 11076
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff7549e3f3c'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ffef000'
|
|
|
- r11: '0x8c4195f7a8'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23d823597a0'
|
|
|
- r14: '0x804'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x0'
|
|
|
- r9: '0xfffffffffe7f6361'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c4195f879'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x804'
|
|
|
- rdi: '0x804'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c4195f738'
|
|
|
- rsp: '0x8c4195f708'
|
|
|
- - id: 9748
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff7549e3f3c'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x246'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23d82359000'
|
|
|
- r14: '0x80c'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x8c4197f9c8'
|
|
|
- r9: '0x8c4197fb39'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c4197fb39'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x80c'
|
|
|
- rdi: '0x80c'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c4197f9f8'
|
|
|
- rsp: '0x8c4197f9c8'
|
|
|
- - id: 6820
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff7549e3f3c'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ffef000'
|
|
|
- r11: '0x1'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23d82359760'
|
|
|
- r14: '0x814'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x8c4199fa83'
|
|
|
- r9: '0xfffffffffe7f6361'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c4199fc09'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x814'
|
|
|
- rdi: '0x814'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c4199fac8'
|
|
|
- rsp: '0x8c4199fa98'
|
|
|
- - id: 5932
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: symbolicated
|
|
|
- function: truncated
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ff7549e3f3c'
|
|
|
- package: \\Mac\Home\Desktop\WindowsNoEditor\YetAnother\Binaries\Win64\YetAnother.exe
|
|
|
- raw_function: <truncated>
|
|
|
- symbol: <truncated>
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ffef000'
|
|
|
- r11: '0x1'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23d823592c0'
|
|
|
- r14: '0x81c'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x8c419bf683'
|
|
|
- r9: '0xfffffffffe7f6361'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c419bf819'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x81c'
|
|
|
- rdi: '0x81c'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c419bf6d8'
|
|
|
- rsp: '0x8c419bf6a8'
|
|
|
- - id: 10672
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x23df7346090'
|
|
|
- r11: '0x8c419df480'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23dfc965440'
|
|
|
- r14: '0x54c'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x23d82170c60'
|
|
|
- r9: '0x20'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c419df769'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x54c'
|
|
|
- rdi: '0x54c'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x8c419df628'
|
|
|
- rsp: '0x8c419df5f8'
|
|
|
- - id: 3096
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0caa5e9a'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100fa584'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x0'
|
|
|
- r11: '0x246'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x0'
|
|
|
- r14: '0x0'
|
|
|
- r15: '0x23df9a31050'
|
|
|
- r8: '0x8c419efd38'
|
|
|
- r9: '0x0'
|
|
|
- rax: '0x34'
|
|
|
- rbp: '0x8c419efcc9'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x0'
|
|
|
- rdi: '0x3e8'
|
|
|
- rdx: '0x8c419efb80'
|
|
|
- rip: '0x7ffe100fa584'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c419efb58'
|
|
|
- - id: 10944
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffdd9762b8a'
|
|
|
- package: C:\Windows\System32\XAudio2_7.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0caa5f8e'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffdd9762891'
|
|
|
- package: C:\Windows\System32\XAudio2_7.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffdd97635b6'
|
|
|
- package: C:\Windows\System32\XAudio2_7.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0caa5f8e'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffdde41bf48'
|
|
|
- package: C:\Windows\System32\AudioSes.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffdde31468b'
|
|
|
- package: C:\Windows\System32\AudioSes.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca886f2'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffdde314507'
|
|
|
- package: C:\Windows\System32\AudioSes.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca886f2'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffdde41bf48'
|
|
|
- package: C:\Windows\System32\AudioSes.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffdde3128e1'
|
|
|
- package: C:\Windows\System32\AudioSes.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0caa6099'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100faa54'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ffef000'
|
|
|
- r11: '0x23d8d4b3848'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23d8d4b1088'
|
|
|
- r14: '0x0'
|
|
|
- r15: '0x0'
|
|
|
- r8: '0x0'
|
|
|
- r9: '0x8c4357f730'
|
|
|
- rax: '0x5b'
|
|
|
- rbp: '0x8c4357f940'
|
|
|
- rbx: '0x3'
|
|
|
- rcx: '0x3'
|
|
|
- rdi: '0x3'
|
|
|
- rdx: '0x23d8d4b1088'
|
|
|
- rip: '0x7ffe100faa54'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c4357f4f8'
|
|
|
- - id: 7648
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x23df7346090'
|
|
|
- r11: '0x8c43a4eff0'
|
|
|
- r12: '0x1'
|
|
|
- r13: '0x23df8d19d60'
|
|
|
- r14: '0x288'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x0'
|
|
|
- r9: '0x1'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c43a4f649'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x288'
|
|
|
- rdi: '0x288'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c43a4f4d8'
|
|
|
- - id: 612
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0ca99252'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100f9f84'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ffef000'
|
|
|
- r11: '0x1'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x23df8d19ea0'
|
|
|
- r14: '0x298'
|
|
|
- r15: '0x23df9a304c8'
|
|
|
- r8: '0x1'
|
|
|
- r9: '0x7ff75a3e20d0'
|
|
|
- rax: '0x4'
|
|
|
- rbp: '0x8c4188f919'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x298'
|
|
|
- rdi: '0x298'
|
|
|
- rdx: '0x0'
|
|
|
- rip: '0x7ffe100f9f84'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c4188f7a8'
|
|
|
- - id: 10900
|
|
|
- stacktrace:
|
|
|
- frames:
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100d1471'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0fd53034'
|
|
|
- package: C:\Windows\System32\kernel32.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe0caa5e9a'
|
|
|
- package: C:\Windows\System32\KERNELBASE.dll
|
|
|
- trust: scan
|
|
|
- - data:
|
|
|
- orig_in_app: -1
|
|
|
- symbolicator_status: missing
|
|
|
- in_app: false
|
|
|
- instruction_addr: '0x7ffe100fa584'
|
|
|
- package: C:\Windows\System32\ntdll.dll
|
|
|
- trust: context
|
|
|
- registers:
|
|
|
- r10: '0x7ffef000'
|
|
|
- r11: '0x1'
|
|
|
- r12: '0x0'
|
|
|
- r13: '0x7ff758a67a48'
|
|
|
- r14: '0x0'
|
|
|
- r15: '0x23df9a31050'
|
|
|
- r8: '0xff'
|
|
|
- r9: '0xfffffffffe7f6361'
|
|
|
- rax: '0x34'
|
|
|
- rbp: '0x8c4189fd19'
|
|
|
- rbx: '0x0'
|
|
|
- rcx: '0x0'
|
|
|
- rdi: '0x6'
|
|
|
- rdx: '0x8c4189fbd0'
|
|
|
- rip: '0x7ffe100fa584'
|
|
|
- rsi: '0x0'
|
|
|
- rsp: '0x8c4189fba8'
|