Microsoft (R) Windows Debugger Version 6.3.9600.16384 X86
Copyright (c) Microsoft Corporation. All rights reserved.
*** wait with pending attach
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*\\J3\Symbols
Deferred cache*\\server\Symbols
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Deferred srv*http://symbols.mozilla.org/firefox
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*\\J3\Symbols;cache*\\server\Symbols;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com;srv*http://symbols.mozilla.org/firefox
Executable search path is:
ModLoad: 01090000 010a4000 C:\Windows\System32\RuntimeBroker.exe
ModLoad: 775d0000 7774b000 C:\WINDOWS\SYSTEM32\ntdll.dll
ModLoad: 6cc80000 6cce1000 C:\WINDOWS\system32\verifier.dll
ModLoad: 75160000 751f6000 C:\WINDOWS\system32\KERNEL32.DLL
ModLoad: 74460000 745df000 C:\WINDOWS\system32\KERNELBASE.dll
ModLoad: 75a40000 75afe000 C:\WINDOWS\system32\msvcrt.dll
ModLoad: 770e0000 771a2000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 772b0000 7746d000 C:\WINDOWS\system32\combase.dll
ModLoad: 747d0000 74828000 C:\WINDOWS\system32\bcryptPrimitives.dll
ModLoad: 74350000 74394000 C:\WINDOWS\system32\powrprof.dll
ModLoad: 74340000 7434c000 C:\WINDOWS\system32\kernel.appcore.dll
ModLoad: 76f10000 76ffb000 C:\WINDOWS\system32\ole32.dll
ModLoad: 75210000 75254000 C:\WINDOWS\system32\sechost.dll
ModLoad: 77470000 775c5000 C:\WINDOWS\system32\GDI32.dll
ModLoad: 75720000 75858000 C:\WINDOWS\system32\USER32.dll
ModLoad: 74e60000 74e8f000 C:\WINDOWS\system32\IMM32.DLL
ModLoad: 74dd0000 74e54000 C:\WINDOWS\system32\clbcatq.dll
ModLoad: 6eb60000 6ece7000 C:\Windows\System32\Windows.UI.Immersive.dll
ModLoad: 759b0000 75a3d000 C:\WINDOWS\system32\shcore.dll
ModLoad: 72100000 7231c000 C:\Windows\System32\ActXPrxy.dll
ModLoad: 6efc0000 6f088000 C:\Windows\System32\WinTypes.dll
ModLoad: 73280000 7334d000 C:\Windows\System32\twinapi.appcore.dll
ModLoad: 742a0000 742bd000 C:\Windows\System32\bcrypt.dll
ModLoad: 62c50000 62c71000 C:\Windows\System32\Windows.ApplicationModel.Core.dll
ModLoad: 743b0000 743bf000 C:\WINDOWS\system32\profapi.dll
ModLoad: 73a00000 73a28000 C:\WINDOWS\SYSTEM32\ntmarta.dll
ModLoad: 73c10000 73c29000 C:\Windows\System32\USERENV.dll
ModLoad: 69b00000 69b12000 C:\WINDOWS\SYSTEM32\profext.dll
ModLoad: 74050000 74074000 C:\WINDOWS\system32\SspiCli.dll
ModLoad: 678a0000 678b5000 C:\WINDOWS\SYSTEM32\capauthz.dll
ModLoad: 72fc0000 73052000 C:\WINDOWS\system32\apphelp.dll
(b08.15e4): Break instruction exception - code 80000003 (first chance)
eax=003b0000 ebx=00000000 ecx=77691d90 edx=40040110 esi=77691d90 edi=77691d90
eip=77661250 esp=068efb54 ebp=068efb80 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!DbgBreakPoint:
77661250 cc int 3
Create process 2824 breakpoint.
0:007> g
*** wait with pending attach
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*\\J3\Symbols
Deferred cache*\\server\Symbols
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Deferred srv*http://symbols.mozilla.org/firefox
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*\\J3\Symbols;cache*\\server\Symbols;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com;srv*http://symbols.mozilla.org/firefox
Executable search path is:
ModLoad: 00d30000 00d38000 C:\WINDOWS\system32\browser_broker.exe
ModLoad: 775d0000 7774b000 C:\WINDOWS\SYSTEM32\ntdll.dll
ModLoad: 6cc80000 6cce1000 C:\WINDOWS\system32\verifier.dll
ModLoad: 75160000 751f6000 C:\WINDOWS\system32\KERNEL32.DLL
ModLoad: 74460000 745df000 C:\WINDOWS\system32\KERNELBASE.dll
ModLoad: 75a40000 75afe000 C:\WINDOWS\system32\msvcrt.dll
ModLoad: 772b0000 7746d000 C:\WINDOWS\system32\combase.dll
ModLoad: 770e0000 771a2000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 747d0000 74828000 C:\WINDOWS\system32\bcryptPrimitives.dll
ModLoad: 75210000 75254000 C:\WINDOWS\system32\sechost.dll
ModLoad: 75720000 75858000 C:\WINDOWS\system32\user32.dll
ModLoad: 77470000 775c5000 C:\WINDOWS\system32\GDI32.dll
ModLoad: 74e60000 74e8f000 C:\WINDOWS\system32\IMM32.DLL
ModLoad: 74340000 7434c000 C:\WINDOWS\system32\kernel.appcore.dll
ModLoad: 73070000 730e9000 C:\WINDOWS\system32\uxtheme.dll
ModLoad: 6b370000 6b387000 C:\WINDOWS\SYSTEM32\browserbroker.dll
ModLoad: 759b0000 75a3d000 C:\WINDOWS\system32\shcore.dll
ModLoad: 750c0000 75152000 C:\WINDOWS\system32\OLEAUT32.dll
ModLoad: 74650000 747c9000 C:\WINDOWS\system32\CRYPT32.dll
ModLoad: 743a0000 743ae000 C:\WINDOWS\system32\MSASN1.dll
ModLoad: 6ecf0000 6efbb000 C:\WINDOWS\SYSTEM32\iertutil.dll
ModLoad: 748d0000 74dca000 C:\WINDOWS\system32\windows.storage.dll
ModLoad: 74420000 74457000 C:\WINDOWS\system32\cfgmgr32.dll
ModLoad: 77060000 770db000 C:\WINDOWS\system32\advapi32.dll
ModLoad: 75670000 756b5000 C:\WINDOWS\system32\shlwapi.dll
ModLoad: 74350000 74394000 C:\WINDOWS\system32\powrprof.dll
ModLoad: 743b0000 743bf000 C:\WINDOWS\system32\profapi.dll
ModLoad: 6bf70000 6c0ec000 C:\WINDOWS\SYSTEM32\urlmon.dll
ModLoad: 715f0000 71606000 C:\WINDOWS\SYSTEM32\MPR.dll
ModLoad: 6a650000 6a878000 C:\WINDOWS\SYSTEM32\WININET.dll
ModLoad: 716f0000 7171d000 C:\WINDOWS\SYSTEM32\XmlLite.dll
ModLoad: 73ac0000 73ac8000 C:\WINDOWS\SYSTEM32\DPAPI.DLL
ModLoad: 74dd0000 74e54000 C:\WINDOWS\system32\clbcatq.dll
ModLoad: 61d00000 61d4f000 C:\Windows\System32\ieproxy.dll
ModLoad: 76f10000 76ffb000 C:\WINDOWS\system32\ole32.dll
ModLoad: 73280000 7334d000 C:\Windows\System32\twinapi.appcore.dll
ModLoad: 742a0000 742bd000 C:\Windows\System32\bcrypt.dll
ModLoad: 74050000 74074000 C:\WINDOWS\SYSTEM32\SspiCli.dll
ModLoad: 75b00000 76efe000 C:\WINDOWS\system32\SHELL32.dll
(4e0.12c4): Break instruction exception - code 80000003 (first chance)
Create process 1248 breakpoint.
1:007> g
*** wait with pending attach
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*\\J3\Symbols
Deferred cache*\\server\Symbols
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Deferred srv*http://symbols.mozilla.org/firefox
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*\\J3\Symbols;cache*\\server\Symbols;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com;srv*http://symbols.mozilla.org/firefox
Executable search path is:
ModLoad: 01040000 0151d000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
ModLoad: 775d0000 7774b000 C:\WINDOWS\SYSTEM32\ntdll.dll
ModLoad: 6cc80000 6cce1000 C:\WINDOWS\system32\verifier.dll
ModLoad: 75160000 751f6000 C:\WINDOWS\system32\KERNEL32.DLL
ModLoad: 74460000 745df000 C:\WINDOWS\system32\KERNELBASE.dll
ModLoad: 72fc0000 73052000 C:\WINDOWS\system32\apphelp.dll
ModLoad: 77060000 770db000 C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 75a40000 75afe000 C:\WINDOWS\system32\msvcrt.dll
ModLoad: 75210000 75254000 C:\WINDOWS\system32\sechost.dll
ModLoad: 770e0000 771a2000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 76f10000 76ffb000 C:\WINDOWS\system32\ole32.dll
ModLoad: 772b0000 7746d000 C:\WINDOWS\system32\combase.dll
ModLoad: 747d0000 74828000 C:\WINDOWS\system32\bcryptPrimitives.dll
ModLoad: 77470000 775c5000 C:\WINDOWS\system32\GDI32.dll
ModLoad: 75720000 75858000 C:\WINDOWS\system32\USER32.dll
ModLoad: 6fe50000 6fe99000 C:\WINDOWS\SYSTEM32\wincorlib.DLL
ModLoad: 750c0000 75152000 C:\WINDOWS\system32\OLEAUT32.dll
ModLoad: 74e60000 74e8f000 C:\WINDOWS\system32\IMM32.DLL
ModLoad: 74340000 7434c000 C:\WINDOWS\system32\kernel.appcore.dll
ModLoad: 6f090000 6fd00000 C:\Windows\System32\Windows.UI.Xaml.dll
ModLoad: 6efc0000 6f088000 C:\WINDOWS\SYSTEM32\wintypes.dll
ModLoad: 72bf0000 72c77000 C:\WINDOWS\SYSTEM32\CoreMessaging.dll
ModLoad: 72320000 72372000 C:\WINDOWS\SYSTEM32\Bcp47Langs.dll
ModLoad: 6ecf0000 6efbb000 C:\WINDOWS\SYSTEM32\iertutil.dll
ModLoad: 759b0000 75a3d000 C:\WINDOWS\system32\shcore.dll
ModLoad: 748d0000 74dca000 C:\WINDOWS\system32\windows.storage.dll
ModLoad: 74420000 74457000 C:\WINDOWS\system32\cfgmgr32.dll
ModLoad: 75670000 756b5000 C:\WINDOWS\system32\shlwapi.dll
ModLoad: 74350000 74394000 C:\WINDOWS\system32\powrprof.dll
ModLoad: 743b0000 743bf000 C:\WINDOWS\system32\profapi.dll
ModLoad: 73280000 7334d000 C:\Windows\System32\twinapi.appcore.dll
ModLoad: 742a0000 742bd000 C:\WINDOWS\SYSTEM32\bcrypt.dll
ModLoad: 6c410000 6c425000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\EShims.dll
ModLoad: 73c10000 73c29000 C:\WINDOWS\SYSTEM32\USERENV.dll
ModLoad: 715f0000 71606000 C:\WINDOWS\SYSTEM32\MPR.dll
ModLoad: 60100000 6053c000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\eModel.dll
ModLoad: 75b00000 76efe000 C:\WINDOWS\system32\SHELL32.dll
ModLoad: 743c0000 7441e000 C:\WINDOWS\system32\firewallapi.dll
ModLoad: 734a0000 734cd000 C:\WINDOWS\SYSTEM32\fwbase.dll
ModLoad: 72100000 7231c000 C:\Windows\System32\ActXPrxy.dll
ModLoad: 73070000 730e9000 C:\WINDOWS\system32\uxtheme.dll
ModLoad: 72b10000 72b2d000 C:\WINDOWS\SYSTEM32\dwmapi.dll
ModLoad: 72860000 728e2000 C:\WINDOWS\SYSTEM32\dxgi.dll
ModLoad: 728f0000 72b0a000 C:\WINDOWS\SYSTEM32\d3d11.dll
ModLoad: 71bb0000 71dc8000 C:\WINDOWS\SYSTEM32\d3d10warp.dll
ModLoad: 71720000 71bae000 C:\WINDOWS\SYSTEM32\d2d1.dll
ModLoad: 72c80000 72d34000 C:\Windows\System32\dcomp.dll
ModLoad: 6b5a0000 6b5c9000 C:\Windows\System32\Windows.ApplicationModel.dll
ModLoad: 5fca0000 60023000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\eView.dll
ModLoad: 6bf70000 6c0ec000 C:\WINDOWS\SYSTEM32\urlmon.dll
ModLoad: 6fd80000 6fe50000 C:\Windows\System32\MrmCoreR.dll
ModLoad: 6fd00000 6fd7b000 C:\Windows\System32\Windows.UI.dll
ModLoad: 6a930000 6aaf6000 C:\WINDOWS\system32\CoreUIComponents.dll
ModLoad: 75890000 759af000 C:\WINDOWS\system32\MSCTF.dll
ModLoad: 69b00000 69b12000 C:\WINDOWS\SYSTEM32\profext.dll
ModLoad: 73a00000 73a28000 C:\WINDOWS\SYSTEM32\ntmarta.dll
ModLoad: 6a650000 6a878000 C:\WINDOWS\SYSTEM32\WININET.dll
ModLoad: 74050000 74074000 C:\WINDOWS\SYSTEM32\SspiCli.dll
ModLoad: 66850000 6685b000 C:\WINDOWS\SYSTEM32\tokenbinding.dll
ModLoad: 75000000 7505f000 C:\WINDOWS\system32\WS2_32.dll
ModLoad: 6bba0000 6bbb2000 C:\WINDOWS\SYSTEM32\ondemandconnroutehelper.dll
ModLoad: 71620000 7164f000 C:\WINDOWS\SYSTEM32\IPHLPAPI.DLL
ModLoad: 70e40000 70edb000 C:\WINDOWS\SYSTEM32\winhttp.dll
ModLoad: 73d50000 73da0000 C:\WINDOWS\system32\mswsock.dll
ModLoad: 70210000 70218000 C:\WINDOWS\SYSTEM32\WINNSI.DLL
ModLoad: 75200000 75207000 C:\WINDOWS\system32\NSI.dll
ModLoad: 6b100000 6b10f000 C:\Windows\System32\Windows.Shell.ServiceHostBuilder.dll
ModLoad: 69b60000 69b6c000 C:\WINDOWS\system32\execmodelproxy.dll
ModLoad: 64350000 644cb000 C:\WINDOWS\SYSTEM32\ieapfltr.dll
ModLoad: 73de0000 73df3000 C:\WINDOWS\SYSTEM32\CRYPTSP.dll
ModLoad: 6ddc0000 6de0a000 C:\WINDOWS\SYSTEM32\policymanager.dll
ModLoad: 6dd50000 6ddb5000 C:\WINDOWS\SYSTEM32\msvcp110_win.dll
ModLoad: 716f0000 7171d000 C:\WINDOWS\SYSTEM32\XmlLite.dll
ModLoad: 6e7c0000 6e8f2000 C:\Windows\System32\Windows.Globalization.dll
ModLoad: 6b7d0000 6b804000 C:\WINDOWS\System32\netprofm.dll
ModLoad: 6b6a0000 6b6a9000 C:\WINDOWS\System32\npmproxy.dll
ModLoad: 71610000 71620000 C:\WINDOWS\SYSTEM32\wkscli.dll
ModLoad: 70ba0000 70bc8000 C:\WINDOWS\SYSTEM32\netjoin.dll
ModLoad: 73f00000 73f1e000 C:\WINDOWS\SYSTEM32\JoinUtil.dll
ModLoad: 756c0000 7571a000 C:\WINDOWS\system32\coml2.dll
ModLoad: 73940000 7394a000 C:\WINDOWS\SYSTEM32\netutils.dll
ModLoad: 6b340000 6b369000 C:\WINDOWS\SYSTEM32\MDMRegistration.DLL
ModLoad: 74650000 747c9000 C:\WINDOWS\system32\CRYPT32.dll
ModLoad: 743a0000 743ae000 C:\WINDOWS\system32\MSASN1.dll
ModLoad: 6da50000 6da63000 C:\WINDOWS\SYSTEM32\DMCmnUtils.dll
ModLoad: 730f0000 73112000 C:\WINDOWS\SYSTEM32\DEVOBJ.dll
ModLoad: 73f70000 73f90000 C:\WINDOWS\SYSTEM32\ncrypt.dll
ModLoad: 73f40000 73f6c000 C:\WINDOWS\SYSTEM32\NTASN1.dll
ModLoad: 731f0000 73274000 C:\WINDOWS\SYSTEM32\DNSAPI.dll
ModLoad: 72770000 72790000 C:\WINDOWS\SYSTEM32\SLC.dll
ModLoad: 72750000 7276d000 C:\WINDOWS\SYSTEM32\sppc.dll
ModLoad: 696a0000 696e1000 C:\WINDOWS\system32\DataExchange.dll
ModLoad: 73ed0000 73eda000 C:\WINDOWS\SYSTEM32\CRYPTBASE.dll
ModLoad: 69fb0000 69fe4000 C:\Windows\System32\execmodelclient.dll
ModLoad: 733d0000 733ef000 C:\Windows\System32\rmclient.dll
ModLoad: 725a0000 726eb000 C:\WINDOWS\SYSTEM32\PROPSYS.dll
ModLoad: 6e900000 6eaf1000 C:\WINDOWS\SYSTEM32\dwrite.dll
ModLoad: 701c0000 701c8000 C:\Windows\System32\rasadhlp.dll
ModLoad: 70060000 700a7000 C:\WINDOWS\System32\fwpuclnt.dll
ModLoad: 666a0000 666ec000 C:\Windows\System32\Windows.Graphics.dll
ModLoad: 62c50000 62c71000 C:\Windows\System32\Windows.ApplicationModel.Core.dll
ModLoad: 660a0000 66333000 C:\WINDOWS\SYSTEM32\msftedit.dll
ModLoad: 72060000 72083000 C:\WINDOWS\SYSTEM32\globinputhost.dll
ModLoad: 67920000 6796d000 C:\WINDOWS\SYSTEM32\NInput.dll
ModLoad: 66350000 66362000 C:\Windows\System32\Windows.Globalization.Fontgroups.dll
ModLoad: 66340000 66349000 C:\WINDOWS\SYSTEM32\fontgroupsoverride.dll
ModLoad: 6b320000 6b340000 C:\Windows\System32\Windows.System.Profile.RetailInfo.dll
ModLoad: 69a50000 69ae3000 C:\WINDOWS\system32\twinapi.dll
ModLoad: 6e750000 6e7c0000 C:\WINDOWS\system32\directmanipulation.dll
ModLoad: 6de80000 6de91000 C:\Windows\System32\threadpoolwinrt.dll
(11bc.1618): Break instruction exception - code 80000003 (first chance)
Create process 4540 breakpoint.
2:052> g
*** wait with pending attach
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*\\J3\Symbols
Deferred cache*\\server\Symbols
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Deferred srv*http://symbols.mozilla.org/firefox
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*\\J3\Symbols;cache*\\server\Symbols;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com;srv*http://symbols.mozilla.org/firefox
Executable search path is:
ModLoad: 009c0000 00a0e000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
ModLoad: 775d0000 7774b000 C:\WINDOWS\SYSTEM32\ntdll.dll
ModLoad: 6cc80000 6cce1000 C:\WINDOWS\system32\verifier.dll
ModLoad: 75160000 751f6000 C:\WINDOWS\system32\KERNEL32.DLL
ModLoad: 74460000 745df000 C:\WINDOWS\system32\KERNELBASE.dll
ModLoad: 72fc0000 73052000 C:\WINDOWS\system32\apphelp.dll
ModLoad: 77060000 770db000 C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 75a40000 75afe000 C:\WINDOWS\system32\msvcrt.dll
ModLoad: 75210000 75254000 C:\WINDOWS\system32\sechost.dll
ModLoad: 770e0000 771a2000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 759b0000 75a3d000 C:\WINDOWS\system32\shcore.dll
ModLoad: 772b0000 7746d000 C:\WINDOWS\system32\combase.dll
ModLoad: 747d0000 74828000 C:\WINDOWS\system32\bcryptPrimitives.dll
ModLoad: 74600000 74642000 C:\WINDOWS\system32\WINTRUST.dll
ModLoad: 743a0000 743ae000 C:\WINDOWS\system32\MSASN1.dll
ModLoad: 74650000 747c9000 C:\WINDOWS\system32\CRYPT32.dll
ModLoad: 6ecf0000 6efbb000 C:\WINDOWS\SYSTEM32\iertutil.dll
ModLoad: 748d0000 74dca000 C:\WINDOWS\system32\windows.storage.dll
ModLoad: 74420000 74457000 C:\WINDOWS\system32\cfgmgr32.dll
ModLoad: 75670000 756b5000 C:\WINDOWS\system32\shlwapi.dll
ModLoad: 77470000 775c5000 C:\WINDOWS\system32\GDI32.dll
ModLoad: 75720000 75858000 C:\WINDOWS\system32\USER32.dll
ModLoad: 74340000 7434c000 C:\WINDOWS\system32\kernel.appcore.dll
ModLoad: 74350000 74394000 C:\WINDOWS\system32\powrprof.dll
ModLoad: 743b0000 743bf000 C:\WINDOWS\system32\profapi.dll
ModLoad: 74e60000 74e8f000 C:\WINDOWS\system32\IMM32.DLL
ModLoad: 60100000 6053c000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\EMODEL.dll
ModLoad: 75b00000 76efe000 C:\WINDOWS\system32\SHELL32.dll
ModLoad: 750c0000 75152000 C:\WINDOWS\system32\OLEAUT32.dll
ModLoad: 743c0000 7441e000 C:\WINDOWS\system32\firewallapi.dll
ModLoad: 73c10000 73c29000 C:\WINDOWS\SYSTEM32\USERENV.dll
ModLoad: 734a0000 734cd000 C:\WINDOWS\SYSTEM32\fwbase.dll
ModLoad: 6c410000 6c425000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\EShims.dll
ModLoad: 715f0000 71606000 C:\WINDOWS\SYSTEM32\MPR.dll
ModLoad: 76f10000 76ffb000 C:\WINDOWS\system32\ole32.dll
ModLoad: 73070000 730e9000 C:\WINDOWS\system32\uxtheme.dll
ModLoad: 69b00000 69b12000 C:\WINDOWS\SYSTEM32\profext.dll
ModLoad: 73a00000 73a28000 C:\WINDOWS\SYSTEM32\ntmarta.dll
ModLoad: 73280000 7334d000 C:\WINDOWS\SYSTEM32\twinapi.appcore.dll
ModLoad: 742a0000 742bd000 C:\WINDOWS\SYSTEM32\bcrypt.dll
ModLoad: 64bb0000 65d9b000 C:\WINDOWS\SYSTEM32\edgehtml.dll
ModLoad: 73de0000 73df3000 C:\WINDOWS\SYSTEM32\cryptsp.dll
ModLoad: 64540000 64bb0000 C:\WINDOWS\SYSTEM32\chakra.dll
ModLoad: 64500000 64533000 C:\WINDOWS\SYSTEM32\MLANG.dll
ModLoad: 73ed0000 73eda000 C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL
ModLoad: 6efc0000 6f088000 C:\Windows\System32\WinTypes.dll
ModLoad: 6a650000 6a878000 C:\WINDOWS\SYSTEM32\WININET.dll
ModLoad: 74050000 74074000 C:\WINDOWS\SYSTEM32\SspiCli.dll
ModLoad: 66850000 6685b000 C:\WINDOWS\SYSTEM32\tokenbinding.dll
ModLoad: 75000000 7505f000 C:\WINDOWS\system32\WS2_32.dll
ModLoad: 6bba0000 6bbb2000 C:\WINDOWS\SYSTEM32\ondemandconnroutehelper.dll
ModLoad: 71620000 7164f000 C:\WINDOWS\SYSTEM32\IPHLPAPI.DLL
ModLoad: 70e40000 70edb000 C:\WINDOWS\SYSTEM32\winhttp.dll
ModLoad: 73d50000 73da0000 C:\WINDOWS\system32\mswsock.dll
ModLoad: 70210000 70218000 C:\WINDOWS\SYSTEM32\WINNSI.DLL
ModLoad: 75200000 75207000 C:\WINDOWS\system32\NSI.dll
ModLoad: 6bf70000 6c0ec000 C:\WINDOWS\SYSTEM32\urlmon.dll
ModLoad: 72b10000 72b2d000 C:\WINDOWS\SYSTEM32\dwmapi.dll
ModLoad: 75890000 759af000 C:\WINDOWS\system32\MSCTF.dll
ModLoad: 64350000 644cb000 C:\WINDOWS\SYSTEM32\ieapfltr.dll
ModLoad: 6ddc0000 6de0a000 C:\WINDOWS\SYSTEM32\policymanager.dll
ModLoad: 6dd50000 6ddb5000 C:\WINDOWS\SYSTEM32\msvcp110_win.dll
(2c0.13a4): Break instruction exception - code 80000003 (first chance)
Create process 704 breakpoint.
3:061> g
*** wait with pending attach
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*\\J3\Symbols
Deferred cache*\\server\Symbols
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Deferred srv*http://symbols.mozilla.org/firefox
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*\\J3\Symbols;cache*\\server\Symbols;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com;srv*http://symbols.mozilla.org/firefox
Executable search path is:
ModLoad: 01390000 0139b000 C:\WINDOWS\system32\ApplicationFrameHost.exe
ModLoad: 775d0000 7774b000 C:\WINDOWS\SYSTEM32\ntdll.dll
ModLoad: 6cc80000 6cce1000 C:\WINDOWS\system32\verifier.dll
ModLoad: 75160000 751f6000 C:\WINDOWS\system32\KERNEL32.DLL
ModLoad: 74460000 745df000 C:\WINDOWS\system32\KERNELBASE.dll
ModLoad: 75a40000 75afe000 C:\WINDOWS\system32\msvcrt.dll
ModLoad: 772b0000 7746d000 C:\WINDOWS\system32\combase.dll
ModLoad: 770e0000 771a2000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 747d0000 74828000 C:\WINDOWS\system32\bcryptPrimitives.dll
ModLoad: 74340000 7434c000 C:\WINDOWS\system32\kernel.appcore.dll
ModLoad: 74dd0000 74e54000 C:\WINDOWS\system32\clbcatq.dll
ModLoad: 67c30000 67d31000 C:\WINDOWS\System32\ApplicationFrame.dll
ModLoad: 759b0000 75a3d000 C:\WINDOWS\system32\SHCORE.dll
ModLoad: 75670000 756b5000 C:\WINDOWS\system32\SHLWAPI.dll
ModLoad: 77470000 775c5000 C:\WINDOWS\system32\GDI32.dll
ModLoad: 75720000 75858000 C:\WINDOWS\system32\USER32.dll
ModLoad: 750c0000 75152000 C:\WINDOWS\system32\OLEAUT32.dll
ModLoad: 725a0000 726eb000 C:\WINDOWS\System32\PROPSYS.dll
ModLoad: 75210000 75254000 C:\WINDOWS\system32\sechost.dll
ModLoad: 73280000 7334d000 C:\WINDOWS\System32\twinapi.appcore.dll
ModLoad: 73070000 730e9000 C:\WINDOWS\System32\UxTheme.dll
ModLoad: 730f0000 73112000 C:\WINDOWS\System32\DEVOBJ.dll
ModLoad: 74420000 74457000 C:\WINDOWS\system32\cfgmgr32.dll
ModLoad: 69a50000 69ae3000 C:\WINDOWS\System32\TWINAPI.dll
ModLoad: 71720000 71bae000 C:\WINDOWS\System32\d2d1.dll
ModLoad: 728f0000 72b0a000 C:\WINDOWS\System32\d3d11.dll
ModLoad: 72c80000 72d34000 C:\WINDOWS\System32\dcomp.dll
ModLoad: 72b10000 72b2d000 C:\WINDOWS\System32\dwmapi.dll
ModLoad: 742a0000 742bd000 C:\WINDOWS\System32\bcrypt.dll
ModLoad: 72860000 728e2000 C:\WINDOWS\System32\dxgi.dll
ModLoad: 74e60000 74e8f000 C:\WINDOWS\system32\IMM32.DLL
ModLoad: 72100000 7231c000 C:\Windows\System32\ActXPrxy.dll
ModLoad: 75890000 759af000 C:\WINDOWS\system32\MSCTF.dll
ModLoad: 71bb0000 71dc8000 C:\WINDOWS\system32\D3D10Warp.dll
ModLoad: 625f0000 6270c000 C:\WINDOWS\system32\UIAutomationCore.DLL
ModLoad: 73c10000 73c29000 C:\WINDOWS\system32\USERENV.dll
ModLoad: 743b0000 743bf000 C:\WINDOWS\system32\profapi.dll
ModLoad: 75b00000 76efe000 C:\WINDOWS\system32\SHELL32.dll
ModLoad: 748d0000 74dca000 C:\WINDOWS\system32\windows.storage.dll
ModLoad: 77060000 770db000 C:\WINDOWS\system32\advapi32.dll
ModLoad: 74350000 74394000 C:\WINDOWS\system32\powrprof.dll
ModLoad: 72320000 72372000 C:\WINDOWS\system32\Bcp47Langs.dll
ModLoad: 72410000 72583000 C:\WINDOWS\system32\windowscodecs.dll
ModLoad: 6fd80000 6fe50000 C:\WINDOWS\SYSTEM32\mrmcorer.dll
ModLoad: 6ecf0000 6efbb000 C:\WINDOWS\SYSTEM32\iertutil.dll
ModLoad: 6fd00000 6fd7b000 C:\Windows\System32\Windows.UI.dll
(abc.628): Break instruction exception - code 80000003 (first chance)
Create process 2748 breakpoint.
4:074> g
(11bc.b78): Windows Runtime Originate Error - code 40080201 (first chance)
(11bc.b78): Windows Runtime Originate Error - code 40080201 (first chance)
(11bc.b78): Windows Runtime Originate Error - code 40080201 (first chance)
(2c0.1454): Unknown exception - code 00000005 (first chance)
inetcore\apfilter\src\util\unmanaged\core\src\useraccountstore.cpp(48)\ieapfltr.dll!64399176: (caller: 64398D8F) Exception(1) tid(1454) 80040154 Class not registered
(2c0.ddc): Break instruction exception - code 80000003 (first chance)
3:060> .lastevent
Last event: 2c0.ddc: Break instruction exception - code 80000003 (first chance)
debugger time: Mon May 16 16:15:14.354 2016 (UTC + 2:00)
3:060> |.
. 3 id: 2c0 attach name: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
3:060> .exr -1
ExceptionAddress: 74532db2 (KERNELBASE!RaiseException+0x00000062)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000001
NumberParameters: 0
3:060> lm on
start end module name
009c0000 00a0e000 microsoftedgecp microsoftedgecp.exe
60100000 6053c000 EMODEL EMODEL.dll
61d00000 61d4f000 ieproxy ieproxy.dll
64350000 644cb000 ieapfltr ieapfltr.dll
644d0000 644de000 msimtf msimtf.dll
644e0000 644fc000 srpapi srpapi.dll
64500000 64533000 MLANG MLANG.dll
64540000 64bb0000 chakra chakra.dll
64bb0000 65d9b000 edgehtml edgehtml.dll
66850000 6685b000 tokenbinding tokenbinding.dll
67920000 6796d000 ninput ninput.dll
696a0000 696e1000 dataexchange dataexchange.dll
69a50000 69ae3000 twinapi twinapi.dll
69b00000 69b12000 profext profext.dll
6a650000 6a878000 WININET WININET.dll
6bba0000 6bbb2000 ondemandconnroutehelper ondemandconnroutehelper.dll
6bf70000 6c0ec000 urlmon urlmon.dll
6c410000 6c425000 EShims EShims.dll
6cc80000 6cce1000 verifier verifier.dll
6dd50000 6ddb5000 msvcp110_win msvcp110_win.dll
6ddc0000 6de0a000 policymanager policymanager.dll
6e1c0000 6e1e0000 IDStore IDStore.dll
6e750000 6e7c0000 directmanipulation directmanipulation.dll
6e7c0000 6e8f2000 windows_globalization windows.globalization.dll
6e900000 6eaf1000 DWrite DWrite.dll
6ecf0000 6efbb000 iertutil iertutil.dll
6efc0000 6f088000 WinTypes WinTypes.dll
6fd00000 6fd7b000 Windows_UI Windows.UI.dll
6fd80000 6fe50000 MrmCoreR MrmCoreR.dll
70060000 700a7000 fwpuclnt fwpuclnt.dll
701c0000 701c8000 rasadhlp rasadhlp.dll
70210000 70218000 WINNSI WINNSI.DLL
70e40000 70edb000 winhttp winhttp.dll
715f0000 71606000 MPR MPR.dll
71620000 7164f000 IPHLPAPI IPHLPAPI.DLL
71720000 71bae000 d2d1 d2d1.dll
71bb0000 71dc8000 d3d10warp d3d10warp.dll
72100000 7231c000 ActXPrxy ActXPrxy.dll
72320000 72372000 Bcp47Langs Bcp47Langs.dll
725a0000 726eb000 PROPSYS PROPSYS.dll
726f0000 72703000 SAMLIB SAMLIB.dll
72860000 728e2000 dxgi dxgi.dll
728f0000 72b0a000 d3d11 d3d11.dll
72b10000 72b2d000 dwmapi dwmapi.dll
72c80000 72d34000 dcomp dcomp.dll
72fc0000 73052000 apphelp apphelp.dll
73070000 730e9000 uxtheme uxtheme.dll
731f0000 73274000 DNSAPI DNSAPI.dll
73280000 7334d000 twinapi_appcore twinapi.appcore.dll
733d0000 733ef000 rmclient rmclient.dll
734a0000 734cd000 fwbase fwbase.dll
73970000 7397a000 tbs tbs.dll
73a00000 73a28000 ntmarta ntmarta.dll
73a90000 73abf000 rsaenh rsaenh.dll
73c10000 73c29000 USERENV USERENV.dll
73d50000 73da0000 mswsock mswsock.dll
73de0000 73df3000 cryptsp cryptsp.dll
73ed0000 73eda000 CRYPTBASE CRYPTBASE.DLL
74050000 74074000 SspiCli SspiCli.dll
74210000 74291000 sxs sxs.dll
742a0000 742bd000 bcrypt bcrypt.dll
74340000 7434c000 kernel_appcore kernel.appcore.dll
74350000 74394000 powrprof powrprof.dll
743a0000 743ae000 MSASN1 MSASN1.dll
743b0000 743bf000 profapi profapi.dll
743c0000 7441e000 firewallapi firewallapi.dll
74420000 74457000 cfgmgr32 cfgmgr32.dll
74460000 745df000 KERNELBASE KERNELBASE.dll
74600000 74642000 WINTRUST WINTRUST.dll
74650000 747c9000 CRYPT32 CRYPT32.dll
747d0000 74828000 bcryptPrimitives bcryptPrimitives.dll
748d0000 74dca000 windows_storage windows.storage.dll
74e60000 74e8f000 IMM32 IMM32.DLL
75000000 7505f000 WS2_32 WS2_32.dll
750c0000 75152000 OLEAUT32 OLEAUT32.dll
75160000 751f6000 KERNEL32 KERNEL32.DLL
75200000 75207000 NSI NSI.dll
75210000 75254000 sechost sechost.dll
75670000 756b5000 shlwapi shlwapi.dll
75720000 75858000 USER32 USER32.dll
75890000 759af000 MSCTF MSCTF.dll
759b0000 75a3d000 shcore shcore.dll
75a40000 75afe000 msvcrt msvcrt.dll
75b00000 76efe000 SHELL32 SHELL32.dll
76f10000 76ffb000 ole32 ole32.dll
77060000 770db000 ADVAPI32 ADVAPI32.dll
770e0000 771a2000 RPCRT4 RPCRT4.dll
772b0000 7746d000 combase combase.dll
77470000 775c5000 GDI32 GDI32.dll
775d0000 7774b000 ntdll ntdll.dll
3:060> kn 0x64
# ChildEBP RetAddr
00 0843c288 656c741d KERNELBASE!RaiseException+0x61
01 0843c320 656c7388 edgehtml!Abandonment::InduceAbandonment+0x40
02 0843c328 6531de43 edgehtml!Abandonment::DeprecatedAPI+0xd
03 0843c39c 653e9ae9 edgehtml!CBase::ContextInvokeEx+0x23bdc6
04 0843c40c 64fef17a edgehtml!COmWindowProxy::InvokeEx+0x3fac79
05 0843c440 64fef0eb edgehtml!CBase::VersionedInvokeEx+0x5a
06 0843c480 6503cc2f edgehtml!CBase::PrivateInvokeEx+0x7b
07 0843c4b8 647ee6e4 edgehtml!CBase::varInvokeEx+0x6f
08 0843c53c 647323b9 chakra!HostDispatch::CallInvokeEx+0x14f
09 0843c5b0 64732307 chakra!HostDispatch::GetValueByDispId+0x91
0a 0843c5c8 647322bc chakra!HostDispatch::GetValue+0x28
0b 0843c5ec 646afdce chakra!HostDispatch::GetProperty+0x6c
0c 0843c63c 6471d0a9 chakra!Js::JavascriptOperators::GetProperty_Internal<0>+0x11e
0d 0843c680 647203d3 chakra!Js::JavascriptOperators::PatchGetValueWithThisPtrNoFastPath+0x79
0e 0843c6ec 647b80f1 chakra!Js::ProfilingHelpers::ProfiledLdFld<0,0,0>+0x4f3
0f 0843c740 647239ed chakra!Js::ProfilingHelpers::ProfiledLdFldForTypeOf<0,0,0>+0x4f
10 0843c768 64728322 chakra!Js::InterpreterStackFrame::OP_ProfiledGetPropertyForTypeOf<Js::OpLayoutT_ElementCP<Js::LayoutSizePolicy<0> > const >+0x3b
11 0843c79c 6472549e chakra!Js::InterpreterStackFrame::ProcessProfiled+0x1172
12 0843c7d8 6472903d chakra!Js::InterpreterStackFrame::Process+0xae
13 0843c970 64729cd8 chakra!Js::InterpreterStackFrame::InterpreterHelper+0x2dd
14 0843c9a8 647ed8d1 chakra!Js::InterpreterStackFrame::InterpreterThunk+0x38
15 0843c9f0 646a7335 chakra!Js::JavascriptFunction::CallFunction<1>+0x91
16 0843ca6c 646a6967 chakra!Js::JavascriptFunction::CallRootFunctionInternal+0xe5
17 0843ca80 647bebf2 chakra!Js::JavascriptFunction::CallRootFunction+0x14
18 0843cb00 646ac135 chakra!ScriptSite::CallRootFunction+0x74
19 0843cb44 646a8803 chakra!ScriptSite::Execute+0x105
1a 0843cb98 6524b989 chakra!ScriptEngineBase::Execute+0xa3
1b 0843cc54 6524bba7 edgehtml!CListenerDispatch::InvokeVar+0x179
1c 0843cc80 6524ff54 edgehtml!CListenerDispatch::Invoke+0x6d
1d 0843cd28 652bfef4 edgehtml!CEventMgr::_InvokeListeners+0x274
1e 0843cd40 65250164 edgehtml!CEventMgr::_InvokeListenersOnWindow+0x40
1f 0843cdd8 65251ba0 edgehtml!CEventMgr::_InvokeListeners+0x484
20 0843cf3c 6524f74b edgehtml!CEventMgr::Dispatch+0x460
21 0843cf60 651e987b edgehtml!CEventMgr::DispatchEvent+0x4b
22 0843d028 650fb5f3 edgehtml!COmWindowProxy::Fire_onload+0x15d
23 0843d080 650fb0cd edgehtml!CMarkup::OnLoadStatusDone+0x34a
24 0843d09c 650f976b edgehtml!CMarkup::OnLoadStatus+0xbb
25 0843d4e4 650f923f edgehtml!CProgSink::DoUpdate+0x521
26 0843d4f4 651b4814 edgehtml!CProgSink::OnMethodCall+0xf
27 0843d56c 651b3033 edgehtml!GlobalWndOnMethodCall+0x234
28 0843d5c0 75755d93 edgehtml!GlobalWndProc+0x133
29 0843d5ec 75739f3a USER32!_InternalCallWinProc+0x2b
2a 0843d684 75739a80 USER32!UserCallWinProcCheckWow+0x1aa
2b 0843d6e4 757398d0 USER32!DispatchMessageWorker+0x1a0
2c 0843d6f0 6019a62d USER32!DispatchMessageW+0x10
2d 0843f894 60199e13 EMODEL!CTabWindow::_TabWindowThreadProc+0x54d
2e 0843f964 6eef1e7c EMODEL!LCIETab_ThreadProc+0x2f3
2f 0843f97c 751795f4 iertutil!_IsoThreadProc_WrapperToReleaseScope+0x1c
30 0843f990 775f241a KERNEL32!BaseThreadInitThunk+0x24
31 0843f9d8 775f23e9 ntdll!__RtlUserThreadStart+0x2b
32 0843f9e8 00000000 ntdll!_RtlUserThreadStart+0x1b
3:060> .exr -1
ExceptionAddress: 74532db2 (KERNELBASE!RaiseException+0x00000062)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000001
NumberParameters: 0
3:060> .if ($vvalid(@$scopeip - 138, 138)) { u @$scopeip - 138 @$scopeip - 1; };
KERNELBASE!OutputDebugStringA+0x1c9:
74532c79 85c3 test ebx,eax
74532c7b fe ???
74532c7c ff ???
74532c7d ff ???
74532c7e e852010000 call KERNELBASE!CreateDBWinMutex (74532dd5)
74532c83 8bd0 mov edx,eax
74532c85 85d2 test edx,edx
74532c87 0f8457aa0300 je KERNELBASE!CredPackAuthenticationBufferW+0x12034 (7456d6e4)
74532c8d 8bca mov ecx,edx
74532c8f bef0975b74 mov esi,offset KERNELBASE!BasepPriorityStateLock+0x4 (745b97f0)
74532c94 33c0 xor eax,eax
74532c96 f00fb10e lock cmpxchg dword ptr [esi],ecx
74532c9a 85c0 test eax,eax
74532c9c 0f849ffeffff je KERNELBASE!OutputDebugStringA+0x91 (74532b41)
74532ca2 e949aa0300 jmp KERNELBASE!CredPackAuthenticationBufferW+0x12040 (7456d6f0)
74532ca7 b8ff010000 mov eax,1FFh
74532cac 8985d8fdffff mov dword ptr [ebp-228h],eax
74532cb2 e95cffffff jmp KERNELBASE!OutputDebugStringA+0x163 (74532c13)
74532cb7 8b45ec mov eax,dword ptr [ebp-14h]
74532cba 8b00 mov eax,dword ptr [eax]
74532cbc 33c9 xor ecx,ecx
74532cbe 813806000140 cmp dword ptr [eax],40010006h
74532cc4 0f94c1 sete cl
74532cc7 8bc1 mov eax,ecx
74532cc9 c3 ret
74532cca 85ff test edi,edi
74532ccc 7527 jne KERNELBASE!OutputDebugStringA+0x245 (74532cf5)
74532cce 83bddcfdffff00 cmp dword ptr [ebp-224h],0
74532cd5 0f8541ab0300 jne KERNELBASE!CredPackAuthenticationBufferW+0x1216c (7456d81c)
74532cdb 8b85d0fdffff mov eax,dword ptr [ebp-230h]
74532ce1 85c0 test eax,eax
74532ce3 7519 jne KERNELBASE!OutputDebugStringA+0x24e (74532cfe)
74532ce5 8b85c8fdffff mov eax,dword ptr [ebp-238h]
74532ceb 85c0 test eax,eax
74532ced 7517 jne KERNELBASE!OutputDebugStringA+0x256 (74532d06)
74532cef c3 ret
74532cf0 e8e92f0200 call KERNELBASE!__report_rangecheckfailure (74555cde)
74532cf5 53 push ebx
74532cf6 57 push edi
74532cf7 e8b47efcff call KERNELBASE!UnmapViewOfFileEx (744fabb0)
74532cfc ebd0 jmp KERNELBASE!OutputDebugStringA+0x21e (74532cce)
74532cfe 50 push eax
74532cff e84cd7feff call KERNELBASE!CloseHandle (74520450)
74532d04 ebdf jmp KERNELBASE!OutputDebugStringA+0x235 (74532ce5)
74532d06 50 push eax
74532d07 e844d7feff call KERNELBASE!CloseHandle (74520450)
74532d0c c3 ret
74532d0d cc int 3
74532d0e cc int 3
74532d0f cc int 3
74532d10 cc int 3
74532d11 cc int 3
74532d12 cc int 3
74532d13 cc int 3
74532d14 cc int 3
74532d15 cc int 3
74532d16 cc int 3
74532d17 cc int 3
74532d18 cc int 3
74532d19 cc int 3
74532d1a cc int 3
74532d1b cc int 3
74532d1c cc int 3
74532d1d cc int 3
74532d1e cc int 3
74532d1f cc int 3
KERNELBASE!ReleaseMutex:
74532d20 8bff mov edi,edi
74532d22 55 push ebp
74532d23 8bec mov ebp,esp
74532d25 6a00 push 0
74532d27 ff7508 push dword ptr [ebp+8]
74532d2a ff1560b15b74 call dword ptr [KERNELBASE!_imp__NtReleaseMutant (745bb160)]
74532d30 85c0 test eax,eax
74532d32 7807 js KERNELBASE!ReleaseMutex+0x1b (74532d3b)
74532d34 33c0 xor eax,eax
74532d36 40 inc eax
74532d37 5d pop ebp
74532d38 c20400 ret 4
74532d3b 8bc8 mov ecx,eax
74532d3d e87edcfeff call KERNELBASE!BaseSetLastNTError (745209c0)
74532d42 33c0 xor eax,eax
74532d44 ebf1 jmp KERNELBASE!ReleaseMutex+0x17 (74532d37)
74532d46 cc int 3
74532d47 cc int 3
74532d48 cc int 3
74532d49 cc int 3
74532d4a cc int 3
74532d4b cc int 3
74532d4c cc int 3
74532d4d cc int 3
74532d4e cc int 3
74532d4f cc int 3
KERNELBASE!RaiseException:
74532d50 8bff mov edi,edi
74532d52 55 push ebp
74532d53 8bec mov ebp,esp
74532d55 83e4f8 and esp,0FFFFFFF8h
74532d58 83ec58 sub esp,58h
74532d5b a100705b74 mov eax,dword ptr [KERNELBASE!__security_cookie (745b7000)]
74532d60 33c4 xor eax,esp
74532d62 89442454 mov dword ptr [esp+54h],eax
74532d66 8b4508 mov eax,dword ptr [ebp+8]
74532d69 8b4d14 mov ecx,dword ptr [ebp+14h]
74532d6c 8364240800 and dword ptr [esp+8],0
74532d71 890424 mov dword ptr [esp],eax
74532d74 8b450c mov eax,dword ptr [ebp+0Ch]
74532d77 83e001 and eax,1
74532d7a c744240c502d5374 mov dword ptr [esp+0Ch],offset KERNELBASE!RaiseException (74532d50)
74532d82 89442404 mov dword ptr [esp+4],eax
74532d86 85c9 test ecx,ecx
74532d88 7439 je KERNELBASE!RaiseException+0x73 (74532dc3)
74532d8a 8b4510 mov eax,dword ptr [ebp+10h]
74532d8d 83f80f cmp eax,0Fh
74532d90 7738 ja KERNELBASE!RaiseException+0x7a (74532dca)
74532d92 89442410 mov dword ptr [esp+10h],eax
74532d96 c1e002 shl eax,2
74532d99 50 push eax
74532d9a 51 push ecx
74532d9b 8d44241c lea eax,[esp+1Ch]
74532d9f 50 push eax
74532da0 e82b660200 call KERNELBASE!memcpy (745593d0)
74532da5 83c40c add esp,0Ch
74532da8 8d0424 lea eax,[esp]
74532dab 50 push eax
74532dac ff1574b35b74 call dword ptr [KERNELBASE!_imp__RtlRaiseException (745bb374)]
3:060> .if ($vvalid(@$scopeip, 138)) { u @$scopeip @$scopeip + 137; };
KERNELBASE!RaiseException+0x61:
74532db1 748b je KERNELBASE!ReleaseMutex+0x1e (74532d3e)
74532db3 4c dec esp
74532db4 2454 and al,54h
74532db6 33cc xor ecx,esp
74532db8 e8f82d0200 call KERNELBASE!__security_check_cookie (74555bb5)
74532dbd 8be5 mov esp,ebp
74532dbf 5d pop ebp
74532dc0 c21000 ret 10h
74532dc3 8364241000 and dword ptr [esp+10h],0
74532dc8 ebde jmp KERNELBASE!RaiseException+0x58 (74532da8)
74532dca 6a0f push 0Fh
74532dcc 58 pop eax
74532dcd ebc3 jmp KERNELBASE!RaiseException+0x42 (74532d92)
74532dcf cc int 3
74532dd0 cc int 3
74532dd1 cc int 3
74532dd2 cc int 3
74532dd3 cc int 3
74532dd4 cc int 3
KERNELBASE!CreateDBWinMutex:
74532dd5 8bff mov edi,edi
74532dd7 55 push ebp
74532dd8 8bec mov ebp,esp
74532dda 83ec50 sub esp,50h
74532ddd a100705b74 mov eax,dword ptr [KERNELBASE!__security_cookie (745b7000)]
74532de2 33c5 xor eax,ebp
74532de4 8945fc mov dword ptr [ebp-4],eax
74532de7 53 push ebx
74532de8 56 push esi
74532de9 33db xor ebx,ebx
74532deb 66c745f80005 mov word ptr [ebp-8],500h
74532df1 57 push edi
74532df2 8d45d8 lea eax,[ebp-28h]
74532df5 895df4 mov dword ptr [ebp-0Ch],ebx
74532df8 50 push eax
74532df9 53 push ebx
74532dfa 53 push ebx
74532dfb 53 push ebx
74532dfc 53 push ebx
74532dfd 53 push ebx
74532dfe 53 push ebx
74532dff 53 push ebx
74532e00 6a12 push 12h
74532e02 6a01 push 1
74532e04 8d45f4 lea eax,[ebp-0Ch]
74532e07 895de4 mov dword ptr [ebp-1Ch],ebx
74532e0a 50 push eax
74532e0b 66c745e80001 mov word ptr [ebp-18h],100h
74532e11 8bf3 mov esi,ebx
74532e13 895dec mov dword ptr [ebp-14h],ebx
74532e16 8bfb mov edi,ebx
74532e18 66c745f00010 mov word ptr [ebp-10h],1000h
74532e1e 895dd8 mov dword ptr [ebp-28h],ebx
74532e21 895dd4 mov dword ptr [ebp-2Ch],ebx
74532e24 895ddc mov dword ptr [ebp-24h],ebx
74532e27 895de0 mov dword ptr [ebp-20h],ebx
74532e2a ff1588b45b74 call dword ptr [KERNELBASE!_imp__RtlAllocateAndInitializeSid (745bb488)]
74532e30 85c0 test eax,eax
74532e32 0f889f010000 js KERNELBASE!CreateDBWinMutex+0x202 (74532fd7)
74532e38 8d45d4 lea eax,[ebp-2Ch]
74532e3b 50 push eax
74532e3c 53 push ebx
74532e3d 53 push ebx
74532e3e 53 push ebx
74532e3f 53 push ebx
74532e40 53 push ebx
74532e41 53 push ebx
74532e42 6820020000 push 220h
74532e47 6a20 push 20h
74532e49 6a02 push 2
74532e4b 8d45f4 lea eax,[ebp-0Ch]
74532e4e 50 push eax
74532e4f ff1588b45b74 call dword ptr [KERNELBASE!_imp__RtlAllocateAndInitializeSid (745bb488)]
74532e55 85c0 test eax,eax
74532e57 0f887a010000 js KERNELBASE!CreateDBWinMutex+0x202 (74532fd7)
74532e5d 8d45dc lea eax,[ebp-24h]
74532e60 50 push eax
74532e61 53 push ebx
74532e62 53 push ebx
74532e63 53 push ebx
74532e64 53 push ebx
74532e65 53 push ebx
74532e66 53 push ebx
74532e67 53 push ebx
74532e68 53 push ebx
74532e69 6a01 push 1
74532e6b 8d45e4 lea eax,[ebp-1Ch]
74532e6e 50 push eax
74532e6f ff1588b45b74 call dword ptr [KERNELBASE!_imp__RtlAllocateAndInitializeSid (745bb488)]
74532e75 85c0 test eax,eax
74532e77 0f885a010000 js KERNELBASE!CreateDBWinMutex+0x202 (74532fd7)
74532e7d 8d45e0 lea eax,[ebp-20h]
74532e80 50 push eax
74532e81 53 push ebx
74532e82 53 push ebx
74532e83 53 push ebx
74532e84 53 push ebx
74532e85 53 push ebx
74532e86 53 push ebx
74532e87 53 push ebx
74532e88 6800100000 push 1000h
74532e8d 6a01 push 1
74532e8f 8d45ec lea eax,[ebp-14h]
74532e92 50 push eax
74532e93 ff1588b45b74 call dword ptr [KERNELBASE!_imp__RtlAllocateAndInitializeSid (745bb488)]
74532e99 85c0 test eax,eax
74532e9b 0f8836010000 js KERNELBASE!CreateDBWinMutex+0x202 (74532fd7)
74532ea1 6a01 push 1
74532ea3 8d45b0 lea eax,[ebp-50h]
74532ea6 50 push eax
74532ea7 ff1560b45b74 call dword ptr [KERNELBASE!_imp__RtlCreateSecurityDescriptor (745bb460)]
74532ead 85c0 test eax,eax
74532eaf 0f8822010000 js KERNELBASE!CreateDBWinMutex+0x202 (74532fd7)
74532eb5 ff75dc push dword ptr [ebp-24h]
74532eb8 ff1598b45b74 call dword ptr [KERNELBASE!_imp__RtlLengthSid (745bb498)]
74532ebe ff75d4 push dword ptr [ebp-2Ch]
74532ec1 8bf0 mov esi,eax
74532ec3 ff1598b45b74 call dword ptr [KERNELBASE!_imp__RtlLengthSid (745bb498)]
74532ec9 ff75d8 push dword ptr [ebp-28h]
74532ecc 03f0 add esi,eax
74532ece ff1598b45b74 call dword ptr [KERNELBASE!_imp__RtlLengthSid (745bb498)]
74532ed4 83c620 add esi,20h
74532ed7 03c6 add eax,esi
74532ed9 50 push eax
74532eda 53 push ebx
74532edb 8945d0 mov dword ptr [ebp-30h],eax
74532ede e84d020000 call KERNELBASE!GlobalAlloc (74533130)
74532ee3 8bf0 mov esi,eax
74532ee5 85f6 test esi,esi
74532ee7 0f84ea000000 je KERNELBASE!CreateDBWinMutex+0x202 (74532fd7)
3:060> rM 0x7D
eax=0843c230 ebx=0000000a ecx=00000000 edx=776613f0 esi=00000000 edi=00000000
eip=74532db1 esp=0843c230 ebp=0843c288 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
fpcw=027F: rn 53 puozdi fpsw=0000: top=0 cc=0000 -------- fptw=FFFF
fopcode=0000 fpip=0000:65239717 fpdp=0000:07598788
st0= 0.000000000000000000000e+0000 st1=-7.810000000000000000000e+0002
st2=-6.080000000000000000000e+0002 st3= 1.000000000000000000000e+0000
st4= 1.000000000000000000000e+0000 st5=-7.810000000000000000000e+0002
st6= 1.000000000000000000000e+0000 st7= 0.000000000000000000000e+0000
mm0=0000000000000000 mm1=c340000000000000
mm2=9800000000000000 mm3=8000000000000000
mm4=8000000000000000 mm5=c340000000000000
mm6=8000000000000000 mm7=0000000000000000
xmm0=0 0 0 0
xmm1=0 0 0 0
xmm2=0 0 0 0
xmm3=0 0 0 0
xmm4=0 0 0 0
xmm5=0 0 0 0
xmm6=0 0 0 0
xmm7=0 0 0 0
dr0=00000000 dr1=00000000 dr2=00000000
dr3=00000000 dr6=00000000 dr7=00000000
KERNELBASE!RaiseException+0x61:
74532db1 748b je KERNELBASE!ReleaseMutex+0x1e (74532d3e) [br=1]
3:060> dpp @$ea - 10*$ptrsize L10;
Bad register error at '@$ea - 10*$ptrsize '
3:060> lm M *microsoftedgecp.exe
start end module name
009c0000 00a0e000 microsoftedgecp (deferred)
3:060> lmv m *edgehtml
start end module name
64bb0000 65d9b000 edgehtml (pdb symbols) \\j3\symbols\edgehtml.pdb\EB51CD87F5FF4258B32C8451ECC8CB031\edgehtml.pdb
Loaded symbol image file: C:\WINDOWS\SYSTEM32\edgehtml.dll
Image path: C:\WINDOWS\SYSTEM32\edgehtml.dll
Image name: edgehtml.dll
Timestamp: Sat Apr 23 06:20:39 2016 (571AF817)
CheckSum: 011D509E
ImageSize: 011EB000
File version: 11.0.10586.306
Product version: 11.0.10586.306
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Internet Explorer
InternalName: EDGEHTML
OriginalFilename: EDGEHTML.DLL
ProductVersion: 11.00.10586.306
FileVersion: 11.00.10586.306 (th2_release_sec.160422-1850)
FileDescription: Microsoft (R) HTML Viewer
LegalCopyright: � Microsoft Corporation. All rights reserved.
3:060> lmv m *microsoftedgecp
start end module name
009c0000 00a0e000 microsoftedgecp (deferred)
Image path: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
Image name: microsoftedgecp.exe
Timestamp: Tue Nov 24 07:49:28 2015 (56540878)
CheckSum: 00053B24
ImageSize: 0004E000
File version: 11.0.10586.20
Product version: 11.0.10586.20
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft Edge
InternalName: MicrosoftEdgeCP
OriginalFilename: MicrosoftEdgeCP.exe
ProductVersion: 11.00.10586.20
FileVersion: 11.00.10586.20 (th2_release_sec.151123-1940)
FileDescription: Microsoft Edge Content Process
LegalCopyright: � Microsoft Corporation. All rights reserved.
3:060>