ModLoad: 00000000`73e00000 00000000`73e0d000 E:\Users\xxxxx\Desktop\spookshellext\Release\SpookShlExt.dll
ntdll!NtMapViewOfSection+0xa:
00000000`77b7153a c3 ret
0:000> .effmach x86
Effective machine: x86 compatible (x86)
0:000:x86> kvn 5000
# ChildEBP RetAddr Args to Child
00 002dbd10 77d3bf70 0000027c ffffffff 002dbe3c ntdll32!NtMapViewOfSection+0x12 (FPO: [10,0,0])
01 002dbd64 77d3c5fb 0000027c 00000000 00000000 ntdll32!LdrpMapViewOfSection+0xc7 (FPO: [Non-Fpo])
02 002dbe58 77d3c42c 002dbea4 012dc004 00000000 ntdll32!LdrpFindOrMapDll+0x333 (FPO: [Non-Fpo])
03 002dbfd8 77d3c558 002dc03c 002dc004 00000000 ntdll32!LdrpLoadDll+0x2b2 (FPO: [Non-Fpo])
04 002dc010 75962c95 002dc004 002dc054 002dc03c ntdll32!LdrLoadDll+0xaa (FPO: [Non-Fpo])
05 002dc04c 764a9d43 00000000 00000000 00556614 KERNELBASE!LoadLibraryExW+0x1f1 (FPO: [Non-Fpo])
06 002dc068 764a9cc7 00000000 002dc0e4 00000008 ole32!LoadLibraryWithLogging+0x16 (FPO: [Non-Fpo]) (CONV: stdcall)
[d:\w7rtm\com\ole32\common\loadfree.cxx @ 157]
07 002dc08c 764a9bb6 002dc0e4 002dc0b0 002dc0b4 ole32!CClassCache::CDllPathEntry::LoadDll+0xa9 (FPO: [Non-Fpo]) (CONV: stdcall)
[d:\w7rtm\com\ole32\com\objact\dllcache.cxx @ 1925]
08 002dc0bc 764a90be 002dc0e4 002dc3cc 002dc0dc ole32!CClassCache::CDllPathEntry::Create_rl+0x37 (FPO: [Non-Fpo]) (CONV: stdcall)
[d:\w7rtm\com\ole32\com\objact\dllcache.cxx @ 1783]
09 002dc308 764a8f93 00000001 002dc3cc 002dc338 ole32!CClassCache::CClassEntry::CreateDllClassEntry_rl+0xd4 (FPO: [Non-Fpo]) (CONV:
thiscall) [d:\w7rtm\com\ole32\com\objact\dllcache.cxx @ 886]
0a 002dc350 764a8e99 00000001 00525464 002dc37c ole32!CClassCache::GetClassObjectActivator+0x224 (FPO: [Non-Fpo]) (CONV: stdcall)
[d:\w7rtm\com\ole32\com\objact\dllcache.cxx @ 4795]
0b 002dc388 764a8c57 002dc3cc 00000000 002dc9d4 ole32!CClassCache::GetClassObject+0x30 (FPO: [Non-Fpo]) (CONV: stdcall)
[d:\w7rtm\com\ole32\com\objact\dllcache.cxx @ 4574]
0c 002dc404 764c3170 765c6444 00000000 002dc9d4 ole32!CServerContextActivator::CreateInstance+0x110 (FPO: [Non-Fpo]) (CONV: stdcall)
[d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 974]
0d 002dc444 764a8dca 002dc9d4 00000000 002dcf38 ole32!ActivationPropertiesIn::DelegateCreateInstance+0x108 (FPO: [Non-Fpo]) (CONV: stdcall)
[d:\w7rtm\com\ole32\actprops\actprops.cxx @ 1917]
0e 002dc498 764a8d3f 765c646c 00000000 002dc9d4 ole32!CApartmentActivator::CreateInstance+0x112 (FPO: [Non-Fpo]) (CONV: stdcall)
[d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 2268]
0f 002dc4b8 764a8ac2 765c6494 00000001 00000000 ole32!CProcessActivator::CCICallback+0x6d (FPO: [Non-Fpo]) (CONV: stdcall)
[d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 1737]
10 002dc4d8 764a8a73 765c6494 002dc830 00000000 ole32!CProcessActivator::AttemptActivation+0x2c (FPO: [Non-Fpo]) (CONV: stdcall)
[d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 1630]
11 002dc514 764a8e2d 765c6494 002dc830 00000000 ole32!CProcessActivator::ActivateByContext+0x4f (FPO: [Non-Fpo]) (CONV: stdcall)
[d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 1487]
12 002dc53c 764c3170 765c6494 00000000 002dc9d4 ole32!CProcessActivator::CreateInstance+0x49 (FPO: [Non-Fpo]) (CONV: stdcall)
[d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 1377]
13 002dc57c 764c2ef4 002dc9d4 00000000 002dcf38 ole32!ActivationPropertiesIn::DelegateCreateInstance+0x108 (FPO: [Non-Fpo]) (CONV: stdcall)
[d:\w7rtm\com\ole32\actprops\actprops.cxx @ 1917]
14 002dc7dc 764c3170 765c6448 00000000 002dc9d4 ole32!CClientContextActivator::CreateInstance+0xb0 (FPO: [Non-Fpo]) (CONV: stdcall)
评论0