EurekaLog Exception Access violation at address 00401E19 Write of address 00000001. #8
Description
EurekaLog 6.0.23
Application:
1.1 Start Date : Fri, 6 May 2016 17:26:12 +0800
1.2 Name/Description: ALTRun.exe - (Run shortcut with limited keystroke)
1.3 Version Number : 1.0.0.0
1.4 Parameters : Restart
1.5 Compilation Date: Mon, 21 Jul 2014 22:08:56 +0800
1.6 Up Time : 50 minutes, 22 seconds
Exception:
2.1 Date : Fri, 6 May 2016 18:16:34 +0800
2.2 Address : 00401E19
2.3 Module Name : ALTRun.exe - (Run shortcut with limited keystroke)
2.4 Module Version: 1.0.0.0
2.5 Type : EAccessViolation
2.6 Message : Access violation at address 00401E19 in module 'ALTRun.exe'. Write of address 00000001.
2.7 ID : E95C
2.8 Count : 1
2.9 Status : New
2.10 Note :
User:
3.1 ID : AsionTang
3.2 Name :
3.3 Email :
3.4 Company :
3.5 Privileges: SeIncreaseQuotaPrivilege - OFF
SeSecurityPrivilege - OFF
SeTakeOwnershipPrivilege - OFF
SeLoadDriverPrivilege - OFF
SeSystemProfilePrivilege - OFF
SeSystemtimePrivilege - OFF
SeProfileSingleProcessPrivilege - OFF
SeIncreaseBasePriorityPrivilege - OFF
SeCreatePagefilePrivilege - OFF
SeBackupPrivilege - OFF
SeRestorePrivilege - OFF
SeShutdownPrivilege - OFF
SeDebugPrivilege - OFF
SeSystemEnvironmentPrivilege - OFF
SeChangeNotifyPrivilege - ON
SeRemoteShutdownPrivilege - OFF
SeUndockPrivilege - OFF
SeManageVolumePrivilege - OFF
SeImpersonatePrivilege - ON
SeCreateGlobalPrivilege - ON
SeIncreaseWorkingSetPrivilege - OFF
SeTimeZonePrivilege - OFF
SeCreateSymbolicLinkPrivilege - OFF
Active Controls:
4.1 Form Class : TApplication
4.2 Form Text : ALTRun
4.3 Control Class: TApplication
4.4 Control Text : ALTRun
Computer:
5.1 Name : ASIONTANG-PC
5.2 Total Memory : 20271 Mb
5.3 Free Memory : 13371 Mb
5.4 Total Disk : 111.79 Gb
5.5 Free Disk : 28.16 Gb
5.6 System Up Time: 8 hours, 44 minutes, 59 seconds
5.7 Processor : Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz
5.8 Display Mode : 1920 x 1080, 32 bit
5.9 Display DPI : 96
5.10 Video Card : Intel(R) HD Graphics 530 (driver 20.19.15.4380 - RAM 1024 MB)
5.11 Printer :
Operating System:
6.1 Type : Microsoft Windows 7 (64 bit)
6.2 Build # : 7601
6.3 Update : Service Pack 1
6.4 Language: Chinese (Simplified)
6.5 Charset : 134
Network:
7.1 IP Address: 000.000.000.000 - 192.168.001.018 - 192.168.241.001 - 192.168.112.001
7.2 Submask : 000.000.000.000 - 255.255.255.000 - 255.255.255.000 - 255.255.255.000
7.3 Gateway : 000.000.000.000 - 192.168.001.001 - 000.000.000.000 - 000.000.000.000
7.4 DNS 1 : 000.000.000.000 - 223.005.005.005 - 000.000.000.000 - 000.000.000.000
7.5 DNS 2 : 000.000.000.000 - 223.006.006.006 - 000.000.000.000 - 000.000.000.000
7.6 DHCP : ON - ON - OFF - OFF
Call Stack Information:
|Address |Module |Unit |Class |Procedure/Method |Line |
| Running Thread: ID=3444; Priority=0; Class=; [Main] |
|---|
| 773C25A0 |
| 773C25E9 |
| 773A012E |
| 004C1F3E |
| 0048B50A |
| 0052539B |
| 0052684E |
| 004C7070 |
| 004C6FC0 |
| 004DDC7A |
| 004DDC44 |
| 004DEBCC |
| 004DC5CA |
Modules Information:
|Handle |Name |Description |Version |Size |Modified |Path |
|00400000|ALTRun.exe |Run shortcut with limited keystroke |1.0.0.0 |2426368 |2014-07-21 22:16:54|D:\0-YeTools |
|64780000|imesupport_hook_x86.dll | | |45880 |2014-10-06 10:16:40|D:\0-YeTools\YeTools\SublimeText\bin\Data\Packages\IMESupport |
|6D5D0000|apphelp.dll |应用程序兼容性客户端库 |6.1.7601.17514 |295936 |2010-11-21 11:24:16|C:\Windows\system32 |
|72E10000|DWMAPI.DLL |Microsoft Desktop Window Manager API |6.1.7600.16385 |67072 |2009-07-14 09:15:14|C:\Windows\system32 |
|73100000|slc.dll |软件授权客户端 Dll |6.1.7600.16385 |27136 |2009-07-14 09:16:16|C:\Windows\system32 |
|73150000|cscapi.dll |Offline Files Win32 API |6.1.7601.17514 |34816 |2010-11-21 11:24:04|C:\Windows\system32 |
|73310000|srvcli.dll |Server Service Client DLL |6.1.7601.17514 |90112 |2010-11-21 11:24:18|C:\Windows\system32 |
|73330000|ntshrui.dll |用于共享的外壳扩展 |6.1.7601.17514 |442880 |2010-11-21 11:24:02|C:\Windows\system32 |
|733E0000|LINKINFO.dll |Windows Volume Tracking |6.1.7600.16385 |22016 |2009-07-14 09:15:38|C:\Windows\system32 |
|73440000|ntmarta.dll |Windows NT MARTA 提供程序 |6.1.7600.16385 |121856 |2009-07-14 09:16:12|C:\Windows\system32 |
|73470000|propsys.dll |Microsoft 属性系统 |7.0.7601.17514 |988160 |2010-11-21 11:24:10|C:\Windows\system32 |
|73570000|uxtheme.dll |Microsoft UxTheme 库 |6.1.7600.16385 |245760 |2009-07-14 09:11:26|C:\Windows\system32 |
|735F0000|profapi.dll |User Profile Basic API |6.1.7600.16385 |31744 |2009-07-14 09:16:14|C:\Windows\system32 |
|73610000|comctl32.dll |用户体验控件库 |6.10.7601.17514 |1680896 |2010-11-21 11:23:56|C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2 |
|737B0000|nvdxgiwrap.dll |NVIDIA dxgiwrap dll, Version 364.72 |10.18.13.6472 |105840 |2016-03-22 12:13:00|C:\Program Files (x86)\NVIDIA Corporation\CoProcManager |
|737D0000|nvd3d9wrap.dll |NVIDIA d3d9wrap dll, Version 364.72 |10.18.13.6472 |154768 |2016-03-22 12:13:00|C:\Program Files (x86)\NVIDIA Corporation\CoProcManager |
|73800000|detoured.dll | | |20536 |2016-03-22 12:13:00|C:\Program Files (x86)\NVIDIA Corporation\CoProcManager |
|73810000|nvinit.dll |NVIDIA shim initialization dll, Version 364.72 |10.18.13.6472 |153392 |2016-03-22 12:13:00|C:\Windows\SysWOW64 |
|73840000|winspool.drv |Windows 后台处理程序驱动程序 |6.1.7601.17514 |320000 |2010-11-21 11:24:10|C:\Windows\system32 |
|738A0000|winmm.dll |MCI API DLL |6.1.7601.17514 |194048 |2010-11-21 11:24:18|C:\Windows\system32 |
|738E0000|version.dll |Version Checking and File Installation Libraries|6.1.7600.16385 |21504 |2009-07-14 09:16:18|C:\Windows\system32 |
|738F0000|comctl32.dll |公用控件库 |5.82.7601.17514 |530432 |2010-11-21 11:24:10|C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af|
|74120000|DNSAPI.dll |DNS 客户端 API DLL |6.1.7601.17514 |270336 |2010-11-21 11:24:28|C:\Windows\system32 |
|74320000|dhcpcsvc.DLL |DHCP 客户端服务 |6.1.7600.16385 |61952 |2009-07-14 09:15:12|C:\Windows\system32 |
|743B0000|dhcpcsvc6.DLL |DHCPv6 客户端 |6.1.7600.16385 |43008 |2009-07-14 09:15:12|C:\Windows\system32 |
|744B0000|WINNSI.DLL |Network Store Information RPC interface |6.1.7600.16385 |16896 |2009-07-14 09:16:20|C:\Windows\system32 |
|744C0000|iphlpapi.dll |IP Helper API |6.1.7601.17514 |103936 |2010-11-21 11:24:34|C:\Windows\system32 |
|744E0000|wsock32.dll |Windows Socket 32-Bit DLL |6.1.7600.16385 |15360 |2009-07-14 09:16:22|C:\Windows\system32 |
|74590000|Secur32.dll |Security Support Provider Interface |6.1.7601.17514 |22016 |2010-11-21 11:24:18|C:\Windows\system32 |
|74DA0000|CRYPTBASE.dll |Base cryptographic API DLL |6.1.7600.16385 |36864 |2009-07-14 09:15:08|C:\Windows\syswow64 |
|74DB0000|SspiCli.dll |Security Support Provider Interface |6.1.7601.17514 |96768 |2010-11-21 11:24:18|C:\Windows\syswow64 |
|74E10000|CLBCatQ.DLL |COM+ Configuration Catalog |2001.12.8530.16385|522240 |2009-07-14 09:15:04|C:\Windows\syswow64 |
|74EA0000|api-ms-win-downlevel-shlwapi-l1-1-0.dll |ApiSet Stub DLL |6.2.9200.16492 |9728 |2013-01-14 05:17:04|C:\Windows\syswow64 |
|74EB0000|iertutil.dll |Run time utility for Internet Explorer |11.0.9600.16428 |2166272 |2016-04-24 12:27:10|C:\Windows\syswow64 |
|750D0000|normaliz.DLL |Unicode Normalization DLL |6.1.7600.16385 |2048 |2009-07-14 09:09:02|C:\Windows\syswow64 |
|750E0000|SETUPAPI.dll |Windows 安装程序 API |6.1.7601.17514 |1667584 |2010-11-21 11:23:52|C:\Windows\syswow64 |
|75280000|LPK.dll |Language Pack |6.1.7600.16385 |25600 |2009-07-14 09:11:24|C:\Windows\syswow64 |
|753B0000|KERNELBASE.dll |Windows NT 基本 API 客户端 DLL |6.1.7601.18015 |274944 |2012-11-30 12:54:00|C:\Windows\syswow64 |
|75400000|oleaut32.dll | |6.1.7601.17514 |571904 |2010-11-21 11:24:02|C:\Windows\syswow64 |
|75490000|comdlg32.dll |Common Dialogs DLL |6.1.7601.17514 |485888 |2010-11-21 11:23:50|C:\Windows\syswow64 |
|75510000|SHLWAPI.dll |外壳简易实用工具库 |6.1.7601.17514 |350208 |2010-11-21 11:23:50|C:\Windows\syswow64 |
|75570000|NSI.dll |NSI User-mode interface DLL |6.1.7600.16385 |8704 |2009-07-14 09:16:12|C:\Windows\syswow64 |
|75580000|DEVOBJ.dll |Device Information Set DLL |6.1.7600.16385 |64512 |2009-07-14 09:15:12|C:\Windows\syswow64 |
|755A0000|WS2_32.dll |Windows Socket 2.0 32 位 DLL |6.1.7601.17514 |206848 |2010-11-21 11:23:56|C:\Windows\syswow64 |
|755F0000|PSAPI.DLL |Process Status Helper |6.1.7600.16385 |6144 |2009-07-14 09:16:14|C:\Windows\syswow64 |
|75600000|api-ms-win-downlevel-version-l1-1-0.dll |ApiSet Stub DLL |6.2.9200.16492 |3072 |2013-01-14 05:11:08|C:\Windows\syswow64 |
|75610000|msvcrt.dll |Windows NT CRT DLL |7.0.7600.16385 |690688 |2009-07-14 09:15:52|C:\Windows\syswow64 |
|756C0000|ole32.dll |用于 Windows 的 Microsoft OLE |6.1.7601.17514 |1414144 |2010-11-21 11:24:02|C:\Windows\syswow64 |
|75820000|WLDAP32.dll |Win32 LDAP API DLL |6.1.7601.17514 |269824 |2010-11-21 11:24:18|C:\Windows\syswow64 |
|75870000|IMM32.DLL |Multi-User Windows IMM32 API Client DLL |6.1.7601.17514 |119808 |2010-11-21 11:24:26|C:\Windows\system32 |
|758D0000|api-ms-win-downlevel-ole32-l1-1-0.dll |ApiSet Stub DLL |6.2.9200.16492 |5632 |2013-01-14 05:11:10|C:\Windows\syswow64 |
|758E0000|api-ms-win-downlevel-user32-l1-1-0.dll |ApiSet Stub DLL |6.2.9200.16492 |4096 |2013-01-14 05:11:22|C:\Windows\syswow64 |
|758F0000|USER32.dll |多用户 Windows 用户 API 客户端 DLL |6.1.7601.17514 |833024 |2010-11-21 11:24:22|C:\Windows\syswow64 |
|759F0000|urlmon.dll |Win32 的 OLE32 扩展 |11.0.9600.16428 |1156608 |2016-04-24 12:27:10|C:\Windows\SysWOW64 |
|75B20000|sechost.dll |Host for SCM/SDDL/LSA Lookup APIs |6.1.7600.16385 |92160 |2009-07-14 09:16:14|C:\Windows\SysWOW64 |
|75B40000|shell32.dll |Windows 外壳公用 DLL |6.1.7601.17514 |12872192|2010-11-21 11:24:04|C:\Windows\syswow64 |
|76790000|kernel32.dll |Windows NT 基本 API 客户端 DLL |6.1.7601.18015 |1114112 |2012-11-30 12:54:00|C:\Windows\syswow64 |
|76930000|api-ms-win-downlevel-advapi32-l1-1-0.dll|ApiSet Stub DLL |6.2.9200.16492 |10752 |2013-01-14 05:16:44|C:\Windows\syswow64 |
|76940000|MSCTF.dll |MSCTF 服务器 DLL |6.1.7600.16385 |828928 |2009-07-14 09:15:44|C:\Windows\syswow64 |
|76A10000|USP10.dll |Uniscribe Unicode script processor |1.626.7601.17514 |626176 |2010-11-21 11:24:18|C:\Windows\syswow64 |
|76AB0000|CFGMGR32.dll |Configuration Manager DLL |6.1.7601.17514 |145920 |2010-11-21 11:24:10|C:\Windows\syswow64 |
|76B40000|ADVAPI32.dll |高级 Windows 32 基本 API |6.1.7601.18247 |640512 |2013-08-29 09:48:18|C:\Windows\syswow64 |
|76BE0000|GDI32.dll |GDI Client DLL |6.1.7601.17514 |311296 |2010-11-21 11:24:16|C:\Windows\syswow64 |
|76C70000|WININET.dll |Win32 的 Internet 扩展 |11.0.9600.16428 |1818112 |2016-04-24 12:27:10|C:\Windows\syswow64 |
|76E70000|RPCRT4.dll |远程过程调用运行时 |6.1.7601.17514 |663040 |2010-11-21 11:24:12|C:\Windows\syswow64 |
|77360000|api-ms-win-downlevel-normaliz-l1-1-0.dll|ApiSet Stub DLL |6.2.9200.16492 |2560 |2013-01-14 05:17:04|C:\Windows\syswow64 |
|77390000|ntdll.dll |NT 层 DLL |6.1.7601.18247 |1292192 |2013-08-29 09:50:32|C:\Windows\SysWOW64 |
Processes Information:
|ID |Name |Description |Version |Memory|Priority |Threads|Path |
|0 |[System Process] | | |0 | |8 | |
|4 |System | | |0 |Normal |146 | |
|176 |svchost.exe |Windows 服务主进程 |6.1.7600.16385|0 |Normal |12 | |
|320 |vmware-authd.exe | | |0 |Normal |6 | |
|432 |smss.exe | | |0 |Above-Normal|3 | |
|448 |svchost.exe |Windows 服务主进程 |6.1.7600.16385|0 |Normal |18 | |
|508 |svchost.exe |Windows 服务主进程 |6.1.7600.16385|0 |Normal |4 | |
|512 |conhost.exe | | |0 |Normal |1 | |
|608 |csrss.exe | | |0 |High |9 | |
|712 |wininit.exe |Windows 启动应用程序 |6.1.7600.16385|0 |High |3 | |
|720 |csrss.exe | | |0 |High |16 | |
|768 |services.exe | | |0 |Normal |7 | |
|784 |lsass.exe | | |0 |Normal |6 | |
|792 |lsm.exe | | |0 |Normal |10 | |
|892 |svchost.exe |Windows 服务主进程 |6.1.7600.16385|0 |Normal |11 | |
|968 |svchost.exe |Windows 服务主进程 |6.1.7600.16385|0 |Normal |7 | |
|984 |SamsungRapidSvc.exe | | |0 |Normal |6 | |
|1084|svchost.exe |Windows 服务主进程 |6.1.7600.16385|0 |Normal |6 | |
|1144|winlogon.exe | | |0 |High |3 | |
|1268|svchost.exe |Windows 服务主进程 |6.1.7600.16385|0 |Normal |16 | |
|1392|taskhost.exe | | |0 |Normal |11 | |
|1656|sublime_text.exe |Sublime Text |1.0.0.1 |0 |Normal |12 |D:\0-YeTools\YeTools\SublimeText\bin |
|1664|QQ.exe |腾讯QQ |7.9.14308.0 |0 |Normal |67 |C:\Program Files (x86)\Tencent\QQLite\Bin |
|1668|HoeKey.exe |System-wide hotkey utility |1.18.0.0 |0 |Normal |1 |D:\0-YeTools\YeTools\HoeKey\bin |
|1724|svchost.exe |Windows 服务主进程 |6.1.7600.16385|0 |Normal |7 | |
|1736|ManicTime.exe | | |0 |Normal |28 | |
|1952|chrome.exe | | |0 |Normal |13 | |
|2152|POPPeeper.exe |POP Peeper Email Notifier |4.1.1.0 |0 |Normal |4 |D:\Program Files\POP Peeper\bin |
|2220|explorer.exe |Windows 资源管理器 |6.1.7601.17514|0 |Normal |29 | |
|2296|fsnotifier64.exe | | |0 |Normal |3 | |
|2380|TXPlatform.exe |腾讯QQ多客户端管理服务 |7.9.14308.0 |0 |Normal |5 |C:\Program Files (x86)\Tencent\QQLite\Bin |
|2744|QQ.exe |腾讯QQ |7.9.14308.0 |0 |Normal |50 |C:\Program Files (x86)\Tencent\QQLite\Bin |
|2876|chrome.exe | | |0 |Normal |14 | |
|2988|et.exe |WPS Spreadsheets |11.1.0.4994 |0 |Normal |10 |D:\Program Files\WPS\Bin\9.1.0.4994\office6 |
|3020|conhost.exe | | |0 |Normal |1 | |
|3280|java.exe | | |0 |Normal |28 | |
|3296|explorer.exe |Windows 资源管理器 |6.1.7601.17514|0 |Normal |21 | |
|3440|BTSync.exe |BitTorrent Sync |2.3.7.451 |0 |Normal |29 |C:\Users\AsionTang\AppData\Roaming\BitTorrent Sync |
|3452|adb.exe | | |0 |Normal |4 |C:\Users\AsionTang\AppData\Local\Android\Sdk\platform-tools|
|3484|chrome.exe | | |0 |Normal |13 | |
|3848|plugin_host.exe | | |0 |Normal |9 |D:\0-YeTools\YeTools\SublimeText\bin |
|3928|QQProtect.exe | | |0 |Normal |28 | |
|3984|chrome.exe | | |0 |Normal |6 | |
|4136|studio64.exe | | |0 |Normal |67 | |
|4148|vmware-tray.exe |VMware Tray Process |12.1.1.6932 |0 |Normal |3 |C:\Program Files (x86)\VMware\VMware Workstation |
|4380|svchost.exe |Windows 服务主进程 |6.1.7600.16385|0 |Normal |6 | |
|4436|chrome.exe | | |0 |Low |13 | |
|4468|vmware-usbarbitrator64.exe| | |0 |Normal |5 | |
|4688|vmnetdhcp.exe |VMware VMnet DHCP service |12.1.1.6932 |0 |Normal |3 | |
|4780|vmnat.exe |VMware NAT Service |12.1.1.6932 |0 |Normal |6 | |
|5272|chrome.exe | | |0 |Normal |1 | |
|5376|chrome.exe | | |0 |Normal |18 | |
|5640|Everything.exe | | |0 |Normal |15 | |
|5656|ALTRun.exe |Run shortcut with limited keystroke|1.0.0.0 |0 |Normal |6 |D:\0-YeTools |
|5664|chrome.exe | | |0 |Normal |32 | |
|5828|chrome.exe | | |0 |Low |14 | |
Assembler Information:
00401DF8 xor eax, eax
00401DFA cmp [ebx+$10], edx
00401DFD jnz +$03
00401DFF mov [ebx+$0C], eax
00401E02 mov [ebx], al
00401E04 mov eax, edx
00401E06 mov edx, [edx-$04]
00401E09 mov bl, byte ptr [$58A04D]
00401E0F jmp +$00000085
00401E14 mov eax, $00000100 ; ''...
00401E19 lock ; <-- EXCEPTION
00401E1A cmpxchg [ebx], ah
00401E1D jz -$6C
00401E1F rep
00401E20 nop
00401E21 cmp byte ptr [$58A5B9], $00
00401E28 jnz -$16
00401E2A push ecx
00401E2B push edx
00401E2C push $00
00401E2E call -$00000A3B
Registers:
EAX: 00000000 EDI: 00000000
EBX: 00000000 ESI: 00000000
ECX: 00000000 ESP: 00000000
EDX: 00000000 EIP: 00000000
Stack: Memory Dump:
0018F850: 0018F8F0 00401E19: F0 0F B0 23 74 94 F3 90 80 3D B9 A5 58 00 00 75 ...#t....=..X..u
0018F854: 0047CC59 00401E29: EA 51 52 6A 00 E8 C5 F5 FF FF 5A 59 B8 00 01 00 .QRj......ZY....
0018F858: 0018F878 00401E39: 00 F0 0F B0 23 0F 84 6F FF FF FF 51 52 6A 0A E8 ....#..o...QRj..
0018F85C: 7687030C 00401E49: AB F5 FF FF 5A 59 EB C3 90 90 90 B8 00 01 00 00 ....ZY..........
0018F860: 0018F910 00401E59: F0 0F B0 25 1C A7 58 00 74 42 F3 90 80 3D B9 A5 ...%..X.tB...=..
0018F864: 02096310 00401E69: 58 00 00 75 E6 6A 00 E8 83 F5 FF FF B8 00 01 00 X..u.j..........
0018F868: 020F9198 00401E79: 00 F0 0F B0 25 1C A7 58 00 74 21 6A 0A E8 6D F5 ....%..X.t!j..m.
0018F86C: 00000000 00401E89: FF FF EB C7 90 90 90 F6 C2 05 0F 85 E7 00 00 00 ................
0018F870: 00000000 00401E99: 83 E2 F0 84 DB 89 D3 56 89 C6 75 AF F7 44 33 FC .......V..u..D3.
0018F874: 00000000 00401EA9: 01 00 00 00 8B 4C 33 FC 75 35 83 C9 08 89 4C 33 .....L3.u5....L3
0018F878: 0018F900 00401EB9: FC F6 46 FC 08 75 40 81 FB E0 FF 13 00 74 50 8D ..F..u@......tP.
0018F87C: 767E003F 00401EC9: 43 03 89 46 FC 89 5C 33 F8 89 F0 89 DA E8 59 F7 C..F..\3......Y.
0018F880: 0018F910 00401ED9: FF FF C6 05 1C A7 58 00 00 31 C0 5E 5B C3 90 8D ......X..1.^[...
0018F884: 9C5EFAF9 00401EE9: 04 33 83 E1 F0 01 CB 81 F9 30 0B 00 00 72 C2 E8 .3.......0...r..
0018F888: 00000000 00401EF9: F7 F6 FF FF EB BB 90 8B 4E F8 29 CE 01 CB 81 F9 ........N.).....
0018F88C: 00000000 00401F09: 30 0B 00 00 72 B1 89 F0 E8 DE F6 FF FF EB A8 81 0...r...........