date/time          : 2017-12-12, 14:14:37, 960ms
computer name      : HELLO_HEBIN-PC
user name          : Hello_HeBin <admin>
registered owner   : Hello_HeBin / Microsoft
operating system   : Windows 7 x64 Service Pack 1 build 7601
system language    : Chinese (Simplified)
system up time     : 5 hours 55 minutes
program up time    : 11 seconds
processors         : 8x Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
physical memory    : 7302/12157 MB (free/total)
free disk space    : (C:) 32.67 GB
display mode       : 1920x1080, 32 bit
process id         : $2540
allocated memory   : 61.49 MB
largest free block : 1.99 GB
executable         : Linkman.exe
exec. date/time    : 2017-11-19 17:48
version            : 8.9.9.11
compiled with      : Delphi 7
madExcept version  : 4.0.14
callstack crc      : $470dfd2a, $3bb1f1d2, $b87cbcf9
count              : 2
exception number   : 1
exception class    : ERegistryException
exception message  : Failed to set data for ''.

thread $261c:
004ad2a5 +0059 Linkman.exe  Registry               TRegistry.PutData
004ad0e9 +0021 Linkman.exe  Registry               TRegistry.WriteString
007d633e +00c6 Linkman.exe  RegistryUnit  788  +11 reg_IEIntegration
00859de6 +075a Linkman.exe  MainFormUnit 7911 +244 TLinkmanF.StartUpTimerTimer
004a4f67 +000f Linkman.exe  ExtCtrls               TTimer.Timer
004a4e4b +002b Linkman.exe  ExtCtrls               TTimer.WndProc
0048f410 +0014 Linkman.exe  Classes                StdWndProc
75927bc5 +000a user32.dll                          DispatchMessageA
004f643f +0083 Linkman.exe  Forms                  TApplication.ProcessMessage
004f6476 +000a Linkman.exe  Forms                  TApplication.HandleMessage
004f668e +0096 Linkman.exe  Forms                  TApplication.Run
008973ae +13a2 Linkman.exe  Linkman       655 +506 initialization
768d3368 +0010 kernel32.dll                        BaseThreadInitThunk

thread $21ac:
77000166 +0e ntdll.dll                NtWaitForMultipleObjects
75df1714 +fa KERNELBASE.dll           WaitForMultipleObjectsEx
768d19f7 +89 kernel32.dll             WaitForMultipleObjectsEx
7593087c +00 user32.dll               MsgWaitForMultipleObjectsEx
75930b7c +1a user32.dll               MsgWaitForMultipleObjects
00462929 +0d Linkman.exe    madExcept CallThreadProcSafe
00462993 +37 Linkman.exe    madExcept ThreadExceptFrame
768d3368 +10 kernel32.dll             BaseThreadInitThunk
>> created by thread $261c at:
720878ad +00 gdiplus.dll

thread $1100:
77001f4f +0b ntdll.dll     NtWaitForWorkViaWorkerFactory
768d3368 +10 kernel32.dll  BaseThreadInitThunk

thread $1ea4:
77001f4f +0b ntdll.dll     NtWaitForWorkViaWorkerFactory
768d3368 +10 kernel32.dll  BaseThreadInitThunk

thread $1948 (TSplash): <suspended> <priority:1>
0081a43a +1e Linkman.exe SplashFormUnit 100 +1 TSplash.Create

modules:
00400000 Linkman.exe         8.9.9.11           C:\Users\Hello_HeBin\Desktop\linkman\Linkman
06e30000 LinkmanBrowsers.dll 8.8.6.0            C:\Users\Hello_HeBin\Desktop\linkman\Linkman
53190000 FaultRep.dll        6.1.7601.17514     C:\Windows\system32
59ac0000 icm32.dll           6.1.7601.23677     C:\Windows\system32
5c0d0000 IdnDL.dll           6.1.7600.16385     C:\Windows\system32
5c0e0000 olepro32.dll        6.1.7601.23452     C:\Windows\system32
61e00000 sqlite3.dll         3.15.2.0           C:\Users\Hello_HeBin\Desktop\linkman\Linkman
67660000 DUI70.dll           6.1.7600.16385     C:\Windows\system32
67720000 DUser.dll           6.1.7600.16385     C:\Windows\system32
67750000 explorerframe.dll   6.1.7601.23893     C:\Windows\system32
67de0000 mscms.dll           6.1.7601.23677     C:\Windows\system32
70780000 security.dll        6.1.7600.16385     C:\Windows\system32
71340000 ntmarta.dll         6.1.7600.16385     C:\Windows\system32
715d0000 Fwpuclnt.dll        6.1.7601.18283     C:\Windows\system32
71a30000 PROPSYS.dll         7.0.7601.17514     C:\Windows\system32
71cf0000 apphelp.dll         6.1.7601.19050     C:\Windows\system32
71de0000 uxtheme.dll         6.1.7600.16385     C:\Windows\system32
72040000 gdiplus.dll         6.1.7601.23894     C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e
722d0000 comctl32.dll        6.10.7601.18837    C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d
72470000 wsock32.dll         6.1.7600.16385     C:\Windows\system32
72820000 SECUR32.DLL         6.1.7601.23915     C:\Windows\system32
72ad0000 winspool.drv        6.1.7601.17514     C:\Windows\system32
72c70000 WINNSI.DLL          6.1.7601.23889     C:\Windows\system32
72c80000 iphlpapi.dll        6.1.7601.17514     C:\Windows\system32
72fb0000 version.dll         6.1.7600.16385     C:\Windows\system32
73460000 OLEACC.DLL          7.0.0.0            C:\Windows\system32
74000000 msimg32.dll         6.1.7600.16385     C:\Windows\system32
74180000 WindowsCodecs.dll   6.2.9200.21830     C:\Windows\system32
743e0000 CRYPTBASE.dll       6.1.7601.23915     C:\Windows\syswow64
743f0000 SspiCli.dll         6.1.7601.23915     C:\Windows\syswow64
74450000 DEVOBJ.dll          6.1.7601.17621     C:\Windows\syswow64
74490000 msvcrt.dll          7.0.7601.17744     C:\Windows\syswow64
74540000 shell32.dll         6.1.7601.23893     C:\Windows\syswow64
75190000 CLBCatQ.DLL         2001.12.8530.16385 C:\Windows\syswow64
75220000 Normaliz.dll        6.1.7600.16385     C:\Windows\syswow64
75260000 dwmapi.dll          6.1.7601.18917     C:\Windows\syswow64
75280000 oleaut32.dll        6.1.7601.23775     C:\Windows\syswow64
75320000 ole32.dll           6.1.7601.23889     C:\Windows\syswow64
75480000 comdlg32.dll        6.1.7601.17514     C:\Windows\syswow64
75500000 WS2_32.dll          6.1.7601.23451     C:\Windows\syswow64
755a0000 IMM32.DLL           6.1.7601.17514     C:\Windows\system32
75600000 RPCRT4.dll          6.1.7601.23915     C:\Windows\syswow64
75820000 GDI32.dll           6.1.7601.23914     C:\Windows\syswow64
758c0000 LPK.dll             6.1.7601.23930     C:\Windows\syswow64
75910000 user32.dll          6.1.7601.23594     C:\Windows\syswow64
75a10000 SETUPAPI.dll        6.1.7601.17514     C:\Windows\syswow64
75bc0000 winmm.dll           6.1.7601.17514     C:\Windows\syswow64
75c00000 ADVAPI32.dll        6.1.7601.23915     C:\Windows\syswow64
75cb0000 USERENV.dll         6.1.7601.17514     C:\Windows\syswow64
75cd0000 SHLWAPI.dll         6.1.7601.17514     C:\Windows\syswow64
75d30000 NSI.dll             6.1.7601.23889     C:\Windows\syswow64
75d40000 profapi.dll         6.1.7600.16385     C:\Windows\syswow64
75de0000 KERNELBASE.dll      6.1.7601.23915     C:\Windows\syswow64
760c0000 MSCTF.dll           6.1.7601.23915     C:\Windows\syswow64
76450000 sechost.dll         6.1.7601.18869     C:\Windows\SysWOW64
767a0000 WLDAP32.dll         6.1.7601.23889     C:\Windows\syswow64
76880000 CFGMGR32.dll        6.1.7601.17621     C:\Windows\syswow64
768c0000 kernel32.dll        6.1.7601.23915     C:\Windows\syswow64
769d0000 USP10.dll           1.626.7601.23894   C:\Windows\syswow64
76fe0000 ntdll.dll           6.1.7601.23915     C:\Windows\SysWOW64

processes:
0000 Idle                       0 0   0
0004 System                     0 0   0
0190 smss.exe                   0 0   0
0240 csrss.exe                  0 0   0
02a0 csrss.exe                  1 0   0
02a8 wininit.exe                0 0   0
02f0 services.exe               0 0   0
02f8 winlogon.exe               1 0   0
0314 lsass.exe                  0 0   0
031c lsm.exe                    0 0   0
0374 svchost.exe                0 0   0
03c4 svchost.exe                0 0   0
0158 svchost.exe                0 0   0
01cc svchost.exe                0 0   0
0268 svchost.exe                0 0   0
027c svchost.exe                0 0   0
0474 igfxCUIService.exe         0 0   0
0494 svchost.exe                0 0   0
0520 dwm.exe                    1 20  3    high
0548 explorer.exe               1 552 397  normal
0598 ZhuDongFangYu.exe          0 0   0
05cc svchost.exe                0 0   0
0698 EPEnvUpdate.exe            1 34  32   normal C:\Servyou\EnvUpdate
06a8 PTXBootSvc.exe             1 29  16   normal C:\Servyou\PTXSvcBoot
06e4 spoolsv.exe                0 0   0
072c taskhost.exe               1 79  40   normal
0738 svchost.exe                0 0   0
07c0 EPService.exe              0 0   0
061c sqlservr.exe               0 0   0
04c4 vmnetdhcp.exe              0 0   0
0528 vmnat.exe                  0 0   0
052c svchost.exe                0 0   0
0858 vmware-authd.exe           0 0   0
08b8 vmware-usbarbitrator64.exe 0 0   0
0910 EPEnvPluginLoader.exe      1 34  20   normal C:\Servyou\EPEnvUpdate
0954 XBoxStat.exe               1 21  15   normal
0a78 360sd.exe                  1 494 242  normal
0ac4 360Game.exe                1 17  59   normal C:\Users\Hello_HeBin\AppData\Roaming\360Game\bin
0b1c PresentationFontCache.exe  0 0   0
0b48 sqlmangr.exe               1 145 91   normal C:\Program Files (x86)\Microsoft SQL Server\80\Tools\Binn
0b94 360tray.exe                1 298 64   normal C:\Program Files (x86)\360\360safe\safemon
0c34 iusb3mon.exe               1 18  7    normal C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application
0c54 FtLnSOP.exe                1 16  18   normal C:\Windows\twain_32\fjscan32\SOP
0c64 UCClient.exe               1 510 115  normal D:\Program Files\GZB\bin
0880 svchost.exe                0 0   0
0b7c svchost.exe                0 0   0
0db4 SearchIndexer.exe          0 0   0
0e74 igfxEM.exe                 1 14  13   normal
0ecc cefBrower.exe              1 81  27   normal D:\Program Files\GZB\bin
10ec 360rp.exe                  1 10  2    normal
11c0 igfxHK.exe                 1 13  13   normal
11c8 igfxTray.exe               1 12  4    normal
11e4 CefSubProcess.exe          1 4   1    normal D:\Program Files\GZB\bin
14c4 wmpnetwk.exe               0 0   0
1640 SoftMgrLite.exe            1 260 139  normal C:\Program Files (x86)\360\360safe\SoftMgr\SML
157c svchost.exe                0 0   0
1364 SogouExplorer.exe          1 353 208  normal C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
159c SogouExplorer.exe          1 359 185  normal C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
1388 SogouExplorer.exe          1 38  10   normal C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
07e4 SogouExplorer.exe          1 345 5    idle   C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
1788 SogouExplorer.exe          1 576 5    idle   C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
13f8 SogouExplorer.exe          1 748 5    idle   C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
0ae4 SogouExplorer.exe          1 778 5    normal C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
140c SogouExplorer.exe          1 115 24   normal C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
0638 SogouExplorer.exe          1 458 5    normal C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
0908 SogouExplorer.exe          1 350 5    idle   C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
0448 SogouExplorer.exe          1 352 5    idle   C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
0380 SogouExplorer.exe          1 766 5    idle   C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
0d3c SogouExplorer.exe          1 194 5    idle   C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
1b50 notepad.exe                1 23  20   normal
1b74 Photoshop.exe              1 586 2573 normal D:\photoshopcc_44249\Adobe Photoshop CC 32位\Adobe Photoshop CC
1e50 wuauclt.exe                1 13  9    normal
1434 wdswfsafe.exe              1 9   3    normal C:\Program Files (x86)\360\360safe\safemon
1958 SogouExplorer.exe          1 56  1    normal C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
0f84 360se.exe                  1 339 102  normal C:\Users\Hello_HeBin\AppData\Roaming\360se6\Application
0ae8 360se.exe                  1 7   6    normal C:\Users\Hello_HeBin\AppData\Roaming\360se6\Application
1dc8 360se.exe                  1 475 6    normal C:\Users\Hello_HeBin\AppData\Roaming\360se6\Application
1f80 360se.exe                  1 4   1    normal C:\Users\Hello_HeBin\AppData\Roaming\360se6\Application
1d2c 360se.exe                  1 5   1    normal C:\Users\Hello_HeBin\AppData\Roaming\360se6\Application
19e8 360se.exe                  1 456 6    normal C:\Users\Hello_HeBin\AppData\Roaming\360se6\Application
238c SogouCloud.exe             1 24  5    normal C:\Program Files (x86)\SogouInput\8.8.0.1814
1a40 nethelper360.exe           1 36  29   normal C:\Users\Hello_HeBin\AppData\Roaming\360Safe\NetHelper
1fc8 360se.exe                  1 428 6    normal C:\Users\Hello_HeBin\AppData\Roaming\360se6\Application
2268 audiodg.exe                0 0   0
2508 YunDetectService.exe       1 9   7    normal C:\Users\Hello_HeBin\AppData\Roaming\baidu\BaiduNetdisk
24a4 WmiPrvSE.exe               0 0   0
1aec WmiPrvSE.exe               0 0   0
2424 SogouExplorer.exe          1 820 5    idle   C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
2540 Linkman.exe                1 549 296  normal C:\Users\Hello_HeBin\Desktop\linkman\Linkman
1acc SearchProtocolHost.exe     0 0   0
07fc SearchFilterHost.exe       0 0   0    idle

hardware:
+ Computer
  - ACPI x64-based PC
+ Disk drives
  - WDC WD10EZEX-00BN5A0 ATA Device
+ Display adapters
  - Intel(R) HD Graphics 4600 (driver 10.18.10.4491)
+ Human Interface Devices
  - USB 输入设备
+ IDE ATA/ATAPI controllers
  - ATA Channel 0
  - 标准 AHCI 1.0 串行 ATA 控制器
+ Keyboards
  - PS/2 标准键盘
+ Mice and other pointing devices
  - HID-compliant mouse
+ Monitors
  - 通用即插即用监视器
+ Network adapters
  - Microsoft ISATAP Adapter #3
  - Realtek PCIe GBE Family Controller (driver 7.112.811.2017)
  - VMware Virtual Ethernet Adapter for VMnet1 (driver 4.2.8.0)
  - VMware Virtual Ethernet Adapter for VMnet8 (driver 4.2.8.0)
  - WAN Miniport (IKEv2)
  - WAN 微型端口(IP)
  - WAN 微型端口(IPv6)
  - WAN 微型端口(L2TP)
  - WAN 微型端口(PPPOE)
  - WAN 微型端口(PPTP)
  - WAN 微型端口(SSTP)
  - WAN 微型端口(网络监视器)
+ Ports (COM & LPT)
  - 打印机端口 (LPT1)
  - 通信端口 (COM1)
+ Processors
  - Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
  - Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
  - Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
  - Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
  - Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
  - Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
  - Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
  - Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
+ Sound, video and game controllers
  - Realtek High Definition Audio (driver 6.0.1.8245)
+ Storage volume shadow copies
  - 通用卷影复制
+ System devices
  - ACPI Fan
  - ACPI Fan
  - ACPI Fan
  - ACPI Fan
  - ACPI Fan
  - ACPI Fixed Feature Button
  - ACPI Power Button
  - ACPI Thermal Zone
  - ACPI Thermal Zone
  - Direct memory access controller
  - High Definition Audio 控制器
  - High precision event timer
  - Intel(R) 8 Series/C220 Series PCI Express Root Port #1 - 8C10 (driver 10.1.1.38)
  - Intel(R) 8 Series/C220 Series PCI Express Root Port #3 - 8C14 (driver 10.1.1.38)
  - Intel(R) 8 Series/C220 Series SMBus Controller - 8C22 (driver 10.1.1.38)
  - Intel(R) 82802 Firmware Hub Device
  - Intel(R) B85 LPC Controller - 8C50 (driver 10.1.1.38)
  - Intel(R) Management Engine Interface  (driver 9.0.0.1287)
  - Microsoft ACPI-Compliant System
  - Microsoft System Management BIOS Driver
  - Microsoft Windows Management Interface for ACPI
  - Microsoft 虚拟驱动器枚举器驱动程序
  - Motherboard resources
  - Motherboard resources
  - Motherboard resources
  - Motherboard resources
  - Motherboard resources
  - Numeric data processor
  - PCI standard host CPU bridge
  - PCI standard PCI-to-PCI bridge
  - PCI 总线 (driver 2.5.3.34)
  - Plug and Play Software Device Enumerator
  - Printer Port Logical Interface
  - Programmable interrupt controller
  - Remote Desktop Device Redirector Bus
  - Scp Virtual Bus Driver (driver 1.0.0.103)
  - System board
  - System CMOS/real time clock
  - System timer
  - Terminal Server Keyboard Driver
  - Terminal Server Mouse Driver
  - UMBus Enumerator
  - UMBus Root Bus Enumerator
  - VMware VMCI Host Device (driver 9.8.6.0)
  - Volume Manager
  - 复合总线枚举器
  - 文件作为卷驱动程序
+ Universal Serial Bus controllers
  - Generic USB Hub
  - Generic USB Hub
  - Standard Enhanced PCI to USB Host Controller
  - Standard Enhanced PCI to USB Host Controller
  - USB Root Hub
  - USB Root Hub
  - 英特尔(R) USB 3.0 可扩展主机控制器 (driver 2.5.3.34)
  - 英特尔(R) USB 3.0 根集线器 (driver 2.5.3.34)

cpu registers:
eax = 04c813c0
ebx = 025203c0
ecx = 00000000
edx = 004ad2aa
esi = 00000001
edi = 00000000
eip = 004ad2aa
esp = 0018fa58
ebp = 0018faa0

stack dump:
0018fa58  aa d2 4a 00 de fa ed 0e - 01 00 00 00 07 00 00 00  ..J.............
0018fa68  6c fa 18 00 aa d2 4a 00 - c0 13 c8 04 c0 03 52 02  l.....J.......R.
0018fa78  01 00 00 00 00 00 00 00 - a0 fa 18 00 88 fa 18 00  ................
0018fa88  00 00 00 00 a8 32 44 02 - c0 03 52 02 00 00 00 00  .....2D...R.....
0018fa98  0b 32 44 02 a8 32 44 02 - 0c fb 18 00 ee d0 4a 00  .2D..2D.......J.
0018faa8  01 00 00 00 48 00 00 00 - 00 00 00 00 a4 ec 4d 00  ....H.........M.
0018fab8  28 5f 8b 00 43 63 7d 00 - 14 fb 18 00 98 51 40 00  (_..Cc}......Q@.
0018fac8  0c fb 18 00 4c a9 8a 00 - 00 00 00 00 00 00 00 00  ....L...........
0018fad8  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0018fae8  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0018faf8  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0018fb08  00 00 00 00 80 fc 18 00 - eb 9d 85 00 20 fb 18 00  ............ ...
0018fb18  98 51 40 00 80 fc 18 00 - 90 fc 18 00 98 51 40 00  .Q@..........Q@.
0018fb28  80 fc 18 00 00 00 00 00 - 58 4f 4a 00 28 6a 4f 02  ........XOJ.(jO.
0018fb38  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0018fb48  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0018fb58  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0018fb68  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0018fb78  35 43 3a 5c 55 73 65 72 - 73 5c 48 65 6c 6c 6f 5f  5C:\Users\Hello_
0018fb88  48 65 42 69 6e 5c 44 65 - 73 6b 74 6f 70 5c 6c 69  HeBin\Desktop\li

disassembling:
[...]
007d632d       mov     edx, 3
007d6332       call    -$3d067b ($405cbc)     ; System.@LStrCatN
007d6337       mov     ecx, [ebp-$c]
007d633a       xor     edx, edx
007d633c       mov     eax, [ebx]
007d633e     > call    -$32927b ($4ad0c8)     ; Registry.TRegistry.WriteString
007d6343 791   mov     cl, 1
007d6345       mov     edx, $7d65fc           ; '\Software\Microsoft\Internet Explorer\MenuExt\Add to Linkman'
007d634a       mov     eax, [ebx]
007d634c       call    -$32996d ($4ac9e4)     ; Registry.TRegistry.OpenKey
007d6351       test    al, al
[...]

date/time          : 2017-12-12, 14:15:24, 295ms
computer name      : HELLO_HEBIN-PC
user name          : Hello_HeBin <admin>
registered owner   : Hello_HeBin / Microsoft
operating system   : Windows 7 x64 Service Pack 1 build 7601
system language    : Chinese (Simplified)
system up time     : 5 hours 55 minutes
program up time    : 40 seconds
processors         : 8x Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
physical memory    : 7281/12157 MB (free/total)
free disk space    : (C:) 32.67 GB
display mode       : 1920x1080, 32 bit
process id         : $1c60
allocated memory   : 72.78 MB
largest free block : 1.99 GB
executable         : Linkman.exe
exec. date/time    : 2017-11-19 17:48
version            : 8.9.9.11
compiled with      : Delphi 7
madExcept version  : 4.0.14
callstack crc      : $0df37fce, $1a4d2839, $73b8200c
exception number   : 1
exception class    : EExternalException
exception message  : External exception 80000003.

thread $1af8:
008341d1 +036d Linkman.exe  AboutFormUnit  178  +77 Showform
00405192 +002a Linkman.exe  System                  @HandleFinally
7704383d +00f4 ntdll.dll                            RtlUnwind
76ff013e +000a ntdll.dll                            KiUserExceptionDispatcher
00834358 +0000 Linkman.exe  AboutFormUnit  196   +0 TAboutForm.FormShow
004ef5f9 +0015 Linkman.exe  Forms                   TCustomForm.DoShow
004f25cd +00a9 Linkman.exe  Forms                   TCustomForm.CMShowingChanged
004d97b4 +0188 Linkman.exe  Controls                TControl.WndProc
004dc813 +0157 Linkman.exe  Controls                TWinControl.WndProc
004efd85 +0421 Linkman.exe  Forms                   TCustomForm.WndProc
004d9584 +0024 Linkman.exe  Controls                TControl.Perform
004dc367 +00c7 Linkman.exe  Controls                TWinControl.UpdateShowing
004dc3d2 +0036 Linkman.exe  Controls                TWinControl.UpdateControlState
004de1e6 +0026 Linkman.exe  Controls                TWinControl.CMVisibleChanged
004d97b4 +0188 Linkman.exe  Controls                TControl.WndProc
004dc813 +0157 Linkman.exe  Controls                TWinControl.WndProc
004efd85 +0421 Linkman.exe  Forms                   TCustomForm.WndProc
004d9584 +0024 Linkman.exe  Controls                TControl.Perform
004d825f +0027 Linkman.exe  Controls                TControl.SetVisible
004ef87a +003a Linkman.exe  Forms                   TCustomForm.SetVisible
004f2d63 +0007 Linkman.exe  Forms                   TCustomForm.Show
004f2f2f +0123 Linkman.exe  Forms                   TCustomForm.ShowModal
0085c6eb +0043 Linkman.exe  MainFormUnit  9875   +6 TLinkmanF.help_aboutClick
004e7c36 +00a6 Linkman.exe  Menus                   TMenuItem.Click
004e8f27 +0013 Linkman.exe  Menus                   TMenu.DispatchCommand
004f1d27 +001f Linkman.exe  Forms                   TCustomForm.WMCommand
004d97b4 +0188 Linkman.exe  Controls                TControl.WndProc
004dc813 +0157 Linkman.exe  Controls                TWinControl.WndProc
004efd85 +0421 Linkman.exe  Forms                   TCustomForm.WndProc
0085001e +00ba Linkman.exe  MainFormUnit  3378  +36 TLinkmanF.WndProc
005bb2e9 +0905 Linkman.exe  sSkinProvider 3393 +162 TsSkinProvider.NewWndProc
005f8b9a +002e Linkman.exe  acSBUtils     7477   +6 TacMainWnd.CallPrevWndProc
005ee98b +0ad3 Linkman.exe  acSBUtils     3846 +283 TacScrollWnd.acWndProc
004dc490 +002c Linkman.exe  Controls                TWinControl.MainWndProc
0048f410 +0014 Linkman.exe  Classes                 StdWndProc
75938535 +0016 user32.dll                           CallWindowProcA
00756d71 +00dd Linkman.exe  CoolTrayIcon  1040  +69 TCoolTrayIcon.HookFormProc
0048f410 +0014 Linkman.exe  Classes                 StdWndProc
75927bc5 +000a user32.dll                           DispatchMessageA
004f643f +0083 Linkman.exe  Forms                   TApplication.ProcessMessage
004f6476 +000a Linkman.exe  Forms                   TApplication.HandleMessage
004f668e +0096 Linkman.exe  Forms                   TApplication.Run
008973ae +13a2 Linkman.exe  Linkman        655 +506 initialization
768d3368 +0010 kernel32.dll                         BaseThreadInitThunk

thread $1af8, inner exception level 1:
>> EAccessViolation, Access violation at address 00B53C87 in module 'Linkman.exe'. Read of address 00000003
00b53c87 +0000 Linkman.exe
004ef5f9 +0015 Linkman.exe  Forms                   TCustomForm.DoShow
004f25cd +00a9 Linkman.exe  Forms                   TCustomForm.CMShowingChanged
004d97b4 +0188 Linkman.exe  Controls                TControl.WndProc
004dc813 +0157 Linkman.exe  Controls                TWinControl.WndProc
004efd85 +0421 Linkman.exe  Forms                   TCustomForm.WndProc
004d9584 +0024 Linkman.exe  Controls                TControl.Perform
004dc367 +00c7 Linkman.exe  Controls                TWinControl.UpdateShowing
004dc3d2 +0036 Linkman.exe  Controls                TWinControl.UpdateControlState
004de1e6 +0026 Linkman.exe  Controls                TWinControl.CMVisibleChanged
004d97b4 +0188 Linkman.exe  Controls                TControl.WndProc
004dc813 +0157 Linkman.exe  Controls                TWinControl.WndProc
004efd85 +0421 Linkman.exe  Forms                   TCustomForm.WndProc
004d9584 +0024 Linkman.exe  Controls                TControl.Perform
004d825f +0027 Linkman.exe  Controls                TControl.SetVisible
004ef87a +003a Linkman.exe  Forms                   TCustomForm.SetVisible
004f2d63 +0007 Linkman.exe  Forms                   TCustomForm.Show
004f2f2f +0123 Linkman.exe  Forms                   TCustomForm.ShowModal
0085c6eb +0043 Linkman.exe  MainFormUnit  9875   +6 TLinkmanF.help_aboutClick
004e7c36 +00a6 Linkman.exe  Menus                   TMenuItem.Click
004e8f27 +0013 Linkman.exe  Menus                   TMenu.DispatchCommand
004f1d27 +001f Linkman.exe  Forms                   TCustomForm.WMCommand
004d97b4 +0188 Linkman.exe  Controls                TControl.WndProc
004dc813 +0157 Linkman.exe  Controls                TWinControl.WndProc
004efd85 +0421 Linkman.exe  Forms                   TCustomForm.WndProc
0085001e +00ba Linkman.exe  MainFormUnit  3378  +36 TLinkmanF.WndProc
005bb2e9 +0905 Linkman.exe  sSkinProvider 3393 +162 TsSkinProvider.NewWndProc
005f8b9a +002e Linkman.exe  acSBUtils     7477   +6 TacMainWnd.CallPrevWndProc
005ee98b +0ad3 Linkman.exe  acSBUtils     3846 +283 TacScrollWnd.acWndProc
004dc490 +002c Linkman.exe  Controls                TWinControl.MainWndProc
0048f410 +0014 Linkman.exe  Classes                 StdWndProc
75938535 +0016 user32.dll                           CallWindowProcA
00756d71 +00dd Linkman.exe  CoolTrayIcon  1040  +69 TCoolTrayIcon.HookFormProc
0048f410 +0014 Linkman.exe  Classes                 StdWndProc
75927bc5 +000a user32.dll                           DispatchMessageA
004f643f +0083 Linkman.exe  Forms                   TApplication.ProcessMessage
004f6476 +000a Linkman.exe  Forms                   TApplication.HandleMessage
004f668e +0096 Linkman.exe  Forms                   TApplication.Run
008973ae +13a2 Linkman.exe  Linkman        655 +506 initialization
768d3368 +0010 kernel32.dll                         BaseThreadInitThunk

thread $252c:
77000166 +0e ntdll.dll                NtWaitForMultipleObjects
75df1714 +fa KERNELBASE.dll           WaitForMultipleObjectsEx
768d19f7 +89 kernel32.dll             WaitForMultipleObjectsEx
7593087c +00 user32.dll               MsgWaitForMultipleObjectsEx
75930b7c +1a user32.dll               MsgWaitForMultipleObjects
00462929 +0d Linkman.exe    madExcept CallThreadProcSafe
00462993 +37 Linkman.exe    madExcept ThreadExceptFrame
768d3368 +10 kernel32.dll             BaseThreadInitThunk
>> created by thread $1af8 at:
720878ad +00 gdiplus.dll

thread $18dc:
77001f4f +0b ntdll.dll     NtWaitForWorkViaWorkerFactory
768d3368 +10 kernel32.dll  BaseThreadInitThunk

thread $2740:
77001f4f +0b ntdll.dll     NtWaitForWorkViaWorkerFactory
768d3368 +10 kernel32.dll  BaseThreadInitThunk

thread $1eec (TSplash): <suspended> <priority:1>
0081a43a +1e Linkman.exe SplashFormUnit 100 +1 TSplash.Create

thread $2524:
77000166 +0e ntdll.dll     NtWaitForMultipleObjects
768d3368 +10 kernel32.dll  BaseThreadInitThunk

HttpServer Listener #1 ($2680): <priority:2>
76fff8da +0e ntdll.dll                            NtWaitForSingleObject
75502f7b +5b WS2_32.dll                           WahReferenceContextByHandle
7550673b +9c WS2_32.dll                           select
0066fde6 +4a Linkman.exe  IdStackWindows          TIdSocketListWindows.FDSelect
0066fd8c +20 Linkman.exe  IdStackWindows          TIdSocketListWindows.SelectRead
0068cfce +06 Linkman.exe  IdSocketHandle          TIdSocketHandle.Select
006a0094 +78 Linkman.exe  IdServerIOHandlerSocket TIdServerIOHandlerSocket.Accept
006a1cec +98 Linkman.exe  IdCustomTCPServer       TIdListenerThread.Run
00669013 +f3 Linkman.exe  IdThread                TIdThread.Execute
00462a47 +2b Linkman.exe  madExcept               HookedTThreadExecute
0048d800 +34 Linkman.exe  Classes                 ThreadProc
004058b4 +28 Linkman.exe  System                  ThreadWrapper
00462929 +0d Linkman.exe  madExcept               CallThreadProcSafe
00462993 +37 Linkman.exe  madExcept               ThreadExceptFrame
768d3368 +10 kernel32.dll                         BaseThreadInitThunk
>> created by thread $1af8 at:
006691fb +4f Linkman.exe  IdThread                TIdThread.Create

thread $1d34 (TIdThreadWithTask): <suspended>
006691fb +4f Linkman.exe IdThread TIdThread.Create

thread $27d4 (TpmFormatThread):
76fff8da +0e ntdll.dll                        NtWaitForSingleObject
75df15c8 +92 KERNELBASE.dll                   WaitForSingleObjectEx
768d118f +3e kernel32.dll                     WaitForSingleObjectEx
768d1143 +0d kernel32.dll                     WaitForSingleObject
0049db05 +09 Linkman.exe    SyncObjs          TEvent.WaitFor
006cbf4e +0a Linkman.exe    PMSupport 7273 +2 TpmFormatThread.Execute
00462a47 +2b Linkman.exe    madExcept         HookedTThreadExecute
0048d800 +34 Linkman.exe    Classes           ThreadProc
004058b4 +28 Linkman.exe    System            ThreadWrapper
00462929 +0d Linkman.exe    madExcept         CallThreadProcSafe
00462993 +37 Linkman.exe    madExcept         ThreadExceptFrame
768d3368 +10 kernel32.dll                     BaseThreadInitThunk
>> created by thread $1af8 at:
006cbef1 +35 Linkman.exe    PMSupport 7259 +3 TpmFormatThread.Create

thread $250c (TpmFormatThread):
76fff8da +0e ntdll.dll                        NtWaitForSingleObject
75df15c8 +92 KERNELBASE.dll                   WaitForSingleObjectEx
768d118f +3e kernel32.dll                     WaitForSingleObjectEx
768d1143 +0d kernel32.dll                     WaitForSingleObject
0049db05 +09 Linkman.exe    SyncObjs          TEvent.WaitFor
006cbf4e +0a Linkman.exe    PMSupport 7273 +2 TpmFormatThread.Execute
00462a47 +2b Linkman.exe    madExcept         HookedTThreadExecute
0048d800 +34 Linkman.exe    Classes           ThreadProc
004058b4 +28 Linkman.exe    System            ThreadWrapper
00462929 +0d Linkman.exe    madExcept         CallThreadProcSafe
00462993 +37 Linkman.exe    madExcept         ThreadExceptFrame
768d3368 +10 kernel32.dll                     BaseThreadInitThunk
>> created by thread $1af8 at:
006cbef1 +35 Linkman.exe    PMSupport 7259 +3 TpmFormatThread.Create

thread $1c14 (TpmFormatThread):
76fff8da +0e ntdll.dll                        NtWaitForSingleObject
75df15c8 +92 KERNELBASE.dll                   WaitForSingleObjectEx
768d118f +3e kernel32.dll                     WaitForSingleObjectEx
768d1143 +0d kernel32.dll                     WaitForSingleObject
0049db05 +09 Linkman.exe    SyncObjs          TEvent.WaitFor
006cbf4e +0a Linkman.exe    PMSupport 7273 +2 TpmFormatThread.Execute
00462a47 +2b Linkman.exe    madExcept         HookedTThreadExecute
0048d800 +34 Linkman.exe    Classes           ThreadProc
004058b4 +28 Linkman.exe    System            ThreadWrapper
00462929 +0d Linkman.exe    madExcept         CallThreadProcSafe
00462993 +37 Linkman.exe    madExcept         ThreadExceptFrame
768d3368 +10 kernel32.dll                     BaseThreadInitThunk
>> created by thread $1af8 at:
006cbef1 +35 Linkman.exe    PMSupport 7259 +3 TpmFormatThread.Create

thread $1b10 (TpmFormatThread):
76fff8da +0e ntdll.dll                        NtWaitForSingleObject
75df15c8 +92 KERNELBASE.dll                   WaitForSingleObjectEx
768d118f +3e kernel32.dll                     WaitForSingleObjectEx
768d1143 +0d kernel32.dll                     WaitForSingleObject
0049db05 +09 Linkman.exe    SyncObjs          TEvent.WaitFor
006cbf4e +0a Linkman.exe    PMSupport 7273 +2 TpmFormatThread.Execute
00462a47 +2b Linkman.exe    madExcept         HookedTThreadExecute
0048d800 +34 Linkman.exe    Classes           ThreadProc
004058b4 +28 Linkman.exe    System            ThreadWrapper
00462929 +0d Linkman.exe    madExcept         CallThreadProcSafe
00462993 +37 Linkman.exe    madExcept         ThreadExceptFrame
768d3368 +10 kernel32.dll                     BaseThreadInitThunk
>> created by thread $1af8 at:
006cbef1 +35 Linkman.exe    PMSupport 7259 +3 TpmFormatThread.Create

modules:
00400000 Linkman.exe         8.9.9.11           C:\Users\Hello_HeBin\Desktop\linkman\Linkman
06e30000 LinkmanBrowsers.dll 8.8.6.0            C:\Users\Hello_HeBin\Desktop\linkman\Linkman
53190000 FaultRep.dll        6.1.7601.17514     C:\Windows\system32
59ac0000 icm32.dll           6.1.7601.23677     C:\Windows\system32
5c0c0000 IdnDL.dll           6.1.7600.16385     C:\Windows\system32
5c0e0000 olepro32.dll        6.1.7601.23452     C:\Windows\system32
61e00000 sqlite3.dll         3.15.2.0           C:\Users\Hello_HeBin\Desktop\linkman\Linkman
67660000 DUI70.dll           6.1.7600.16385     C:\Windows\system32
67720000 DUser.dll           6.1.7600.16385     C:\Windows\system32
67750000 explorerframe.dll   6.1.7601.23893     C:\Windows\system32
67de0000 mscms.dll           6.1.7601.23677     C:\Windows\system32
70780000 security.dll        6.1.7600.16385     C:\Windows\system32
71340000 ntmarta.dll         6.1.7600.16385     C:\Windows\system32
715c0000 rasadhlp.dll        6.1.7600.16385     C:\Windows\system32
715d0000 Fwpuclnt.dll        6.1.7601.18283     C:\Windows\system32
71610000 winrnr.dll          6.1.7600.16385     C:\Windows\System32
71620000 pnrpnsp.dll         6.1.7600.16385     C:\Windows\system32
71640000 napinsp.dll         6.1.7600.16385     C:\Windows\system32
71650000 NLAapi.dll          6.1.7601.18685     C:\Windows\system32
71660000 wshtcpip.dll        6.1.7600.16385     C:\Windows\System32
71670000 mswsock.dll         6.1.7601.23451     C:\Windows\System32
71a30000 PROPSYS.dll         7.0.7601.17514     C:\Windows\system32
71b30000 DNSAPI.dll          6.1.7601.17570     C:\Windows\system32
71cf0000 apphelp.dll         6.1.7601.19050     C:\Windows\system32
71de0000 uxtheme.dll         6.1.7600.16385     C:\Windows\system32
72040000 gdiplus.dll         6.1.7601.23894     C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e
722d0000 comctl32.dll        6.10.7601.18837    C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d
72470000 wsock32.dll         6.1.7600.16385     C:\Windows\system32
72820000 SECUR32.DLL         6.1.7601.23915     C:\Windows\system32
72ad0000 winspool.drv        6.1.7601.17514     C:\Windows\system32
72c70000 WINNSI.DLL          6.1.7601.23889     C:\Windows\system32
72c80000 iphlpapi.dll        6.1.7601.17514     C:\Windows\system32
72fb0000 version.dll         6.1.7600.16385     C:\Windows\system32
73460000 OLEACC.DLL          7.0.0.0            C:\Windows\system32
74000000 msimg32.dll         6.1.7600.16385     C:\Windows\system32
74180000 WindowsCodecs.dll   6.2.9200.21830     C:\Windows\system32
743e0000 CRYPTBASE.dll       6.1.7601.23915     C:\Windows\syswow64
743f0000 SspiCli.dll         6.1.7601.23915     C:\Windows\syswow64
74450000 DEVOBJ.dll          6.1.7601.17621     C:\Windows\syswow64
74490000 msvcrt.dll          7.0.7601.17744     C:\Windows\syswow64
74540000 shell32.dll         6.1.7601.23893     C:\Windows\syswow64
75190000 CLBCatQ.DLL         2001.12.8530.16385 C:\Windows\syswow64
75220000 Normaliz.dll        6.1.7600.16385     C:\Windows\syswow64
75260000 dwmapi.dll          6.1.7601.18917     C:\Windows\syswow64
75280000 oleaut32.dll        6.1.7601.23775     C:\Windows\syswow64
75320000 ole32.dll           6.1.7601.23889     C:\Windows\syswow64
75480000 comdlg32.dll        6.1.7601.17514     C:\Windows\syswow64
75500000 WS2_32.dll          6.1.7601.23451     C:\Windows\syswow64
755a0000 IMM32.DLL           6.1.7601.17514     C:\Windows\system32
75600000 RPCRT4.dll          6.1.7601.23915     C:\Windows\syswow64
75820000 GDI32.dll           6.1.7601.23914     C:\Windows\syswow64
758c0000 LPK.dll             6.1.7601.23930     C:\Windows\syswow64
75910000 user32.dll          6.1.7601.23594     C:\Windows\syswow64
75a10000 SETUPAPI.dll        6.1.7601.17514     C:\Windows\syswow64
75bc0000 winmm.dll           6.1.7601.17514     C:\Windows\syswow64
75c00000 ADVAPI32.dll        6.1.7601.23915     C:\Windows\syswow64
75cb0000 USERENV.dll         6.1.7601.17514     C:\Windows\syswow64
75cd0000 SHLWAPI.dll         6.1.7601.17514     C:\Windows\syswow64
75d30000 NSI.dll             6.1.7601.23889     C:\Windows\syswow64
75d40000 profapi.dll         6.1.7600.16385     C:\Windows\syswow64
75de0000 KERNELBASE.dll      6.1.7601.23915     C:\Windows\syswow64
760c0000 MSCTF.dll           6.1.7601.23915     C:\Windows\syswow64
76450000 sechost.dll         6.1.7601.18869     C:\Windows\SysWOW64
767a0000 WLDAP32.dll         6.1.7601.23889     C:\Windows\syswow64
76880000 CFGMGR32.dll        6.1.7601.17621     C:\Windows\syswow64
768c0000 kernel32.dll        6.1.7601.23915     C:\Windows\syswow64
769d0000 USP10.dll           1.626.7601.23894   C:\Windows\syswow64
76fe0000 ntdll.dll           6.1.7601.23915     C:\Windows\SysWOW64

processes:
0000 Idle                       0 0   0
0004 System                     0 0   0
0190 smss.exe                   0 0   0
0240 csrss.exe                  0 0   0
02a0 csrss.exe                  1 0   0
02a8 wininit.exe                0 0   0
02f0 services.exe               0 0   0
02f8 winlogon.exe               1 0   0
0314 lsass.exe                  0 0   0
031c lsm.exe                    0 0   0
0374 svchost.exe                0 0   0
03c4 svchost.exe                0 0   0
0158 svchost.exe                0 0   0
01cc svchost.exe                0 0   0
0268 svchost.exe                0 0   0
027c svchost.exe                0 0   0
0474 igfxCUIService.exe         0 0   0
0494 svchost.exe                0 0   0
0520 dwm.exe                    1 20  3    high
0548 explorer.exe               1 552 395  normal
0598 ZhuDongFangYu.exe          0 0   0
05cc svchost.exe                0 0   0
0698 EPEnvUpdate.exe            1 34  32   normal C:\Servyou\EnvUpdate
06a8 PTXBootSvc.exe             1 29  16   normal C:\Servyou\PTXSvcBoot
06e4 spoolsv.exe                0 0   0
072c taskhost.exe               1 88  43   normal
0738 svchost.exe                0 0   0
07c0 EPService.exe              0 0   0
061c sqlservr.exe               0 0   0
04c4 vmnetdhcp.exe              0 0   0
0528 vmnat.exe                  0 0   0
052c svchost.exe                0 0   0
0858 vmware-authd.exe           0 0   0
08b8 vmware-usbarbitrator64.exe 0 0   0
0910 EPEnvPluginLoader.exe      1 34  20   normal C:\Servyou\EPEnvUpdate
0954 XBoxStat.exe               1 21  15   normal
0a78 360sd.exe                  1 494 242  normal
0ac4 360Game.exe                1 17  59   normal C:\Users\Hello_HeBin\AppData\Roaming\360Game\bin
0b1c PresentationFontCache.exe  0 0   0
0b48 sqlmangr.exe               1 145 91   normal C:\Program Files (x86)\Microsoft SQL Server\80\Tools\Binn
0b94 360tray.exe                1 298 64   normal C:\Program Files (x86)\360\360safe\safemon
0c34 iusb3mon.exe               1 18  7    normal C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application
0c54 FtLnSOP.exe                1 16  18   normal C:\Windows\twain_32\fjscan32\SOP
0c64 UCClient.exe               1 510 115  normal D:\Program Files\GZB\bin
0880 svchost.exe                0 0   0
0b7c svchost.exe                0 0   0
0db4 SearchIndexer.exe          0 0   0
0e74 igfxEM.exe                 1 14  13   normal
0ecc cefBrower.exe              1 81  27   normal D:\Program Files\GZB\bin
10ec 360rp.exe                  1 10  2    normal
11c0 igfxHK.exe                 1 13  13   normal
11c8 igfxTray.exe               1 12  4    normal
11e4 CefSubProcess.exe          1 4   1    normal D:\Program Files\GZB\bin
14c4 wmpnetwk.exe               0 0   0
1640 SoftMgrLite.exe            1 260 139  normal C:\Program Files (x86)\360\360safe\SoftMgr\SML
157c svchost.exe                0 0   0
1364 SogouExplorer.exe          1 353 206  normal C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
159c SogouExplorer.exe          1 359 183  normal C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
1388 SogouExplorer.exe          1 38  10   normal C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
07e4 SogouExplorer.exe          1 345 5    idle   C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
1788 SogouExplorer.exe          1 576 5    idle   C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
13f8 SogouExplorer.exe          1 748 5    idle   C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
0ae4 SogouExplorer.exe          1 778 5    normal C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
140c SogouExplorer.exe          1 115 24   normal C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
0638 SogouExplorer.exe          1 458 5    normal C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
0908 SogouExplorer.exe          1 350 5    idle   C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
0448 SogouExplorer.exe          1 352 5    idle   C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
0380 SogouExplorer.exe          1 766 5    idle   C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
0d3c SogouExplorer.exe          1 194 5    idle   C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
1b50 notepad.exe                1 23  20   normal
1b74 Photoshop.exe              1 586 2573 normal D:\photoshopcc_44249\Adobe Photoshop CC 32位\Adobe Photoshop CC
1e50 wuauclt.exe                1 13  9    normal
1434 wdswfsafe.exe              1 9   3    normal C:\Program Files (x86)\360\360safe\safemon
1958 SogouExplorer.exe          1 56  1    normal C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
0f84 360se.exe                  1 339 102  normal C:\Users\Hello_HeBin\AppData\Roaming\360se6\Application
0ae8 360se.exe                  1 7   6    normal C:\Users\Hello_HeBin\AppData\Roaming\360se6\Application
1dc8 360se.exe                  1 475 6    normal C:\Users\Hello_HeBin\AppData\Roaming\360se6\Application
1f80 360se.exe                  1 4   1    normal C:\Users\Hello_HeBin\AppData\Roaming\360se6\Application
1d2c 360se.exe                  1 5   1    normal C:\Users\Hello_HeBin\AppData\Roaming\360se6\Application
19e8 360se.exe                  1 456 6    normal C:\Users\Hello_HeBin\AppData\Roaming\360se6\Application
238c SogouCloud.exe             1 24  5    normal C:\Program Files (x86)\SogouInput\8.8.0.1814
1a40 nethelper360.exe           1 36  29   normal C:\Users\Hello_HeBin\AppData\Roaming\360Safe\NetHelper
1fc8 360se.exe                  1 428 6    normal C:\Users\Hello_HeBin\AppData\Roaming\360se6\Application
2268 audiodg.exe                0 0   0
2508 YunDetectService.exe       1 9   7    normal C:\Users\Hello_HeBin\AppData\Roaming\baidu\BaiduNetdisk
24a4 WmiPrvSE.exe               0 0   0
1aec WmiPrvSE.exe               0 0   0
2424 SogouExplorer.exe          1 820 5    idle   C:\Users\Hello_HeBin\AppData\Local\SogouExplorer
1acc SearchProtocolHost.exe     0 0   0
07fc SearchFilterHost.exe       0 0   0    idle
1c60 Linkman.exe                1 712 362  normal C:\Users\Hello_HeBin\Desktop\linkman\Linkman
2498 dllhost.exe                1 9   5    normal

hardware:
+ Computer
  - ACPI x64-based PC
+ Disk drives
  - WDC WD10EZEX-00BN5A0 ATA Device
+ Display adapters
  - Intel(R) HD Graphics 4600 (driver 10.18.10.4491)
+ Human Interface Devices
  - USB 输入设备
+ IDE ATA/ATAPI controllers
  - ATA Channel 0
  - 标准 AHCI 1.0 串行 ATA 控制器
+ Keyboards
  - PS/2 标准键盘
+ Mice and other pointing devices
  - HID-compliant mouse
+ Monitors
  - 通用即插即用监视器
+ Network adapters
  - Microsoft ISATAP Adapter #3
  - Realtek PCIe GBE Family Controller (driver 7.112.811.2017)
  - VMware Virtual Ethernet Adapter for VMnet1 (driver 4.2.8.0)
  - VMware Virtual Ethernet Adapter for VMnet8 (driver 4.2.8.0)
  - WAN Miniport (IKEv2)
  - WAN 微型端口(IP)
  - WAN 微型端口(IPv6)
  - WAN 微型端口(L2TP)
  - WAN 微型端口(PPPOE)
  - WAN 微型端口(PPTP)
  - WAN 微型端口(SSTP)
  - WAN 微型端口(网络监视器)
+ Ports (COM & LPT)
  - 打印机端口 (LPT1)
  - 通信端口 (COM1)
+ Processors
  - Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
  - Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
  - Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
  - Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
  - Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
  - Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
  - Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
  - Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
+ Sound, video and game controllers
  - Realtek High Definition Audio (driver 6.0.1.8245)
+ Storage volume shadow copies
  - 通用卷影复制
+ System devices
  - ACPI Fan
  - ACPI Fan
  - ACPI Fan
  - ACPI Fan
  - ACPI Fan
  - ACPI Fixed Feature Button
  - ACPI Power Button
  - ACPI Thermal Zone
  - ACPI Thermal Zone
  - Direct memory access controller
  - High Definition Audio 控制器
  - High precision event timer
  - Intel(R) 8 Series/C220 Series PCI Express Root Port #1 - 8C10 (driver 10.1.1.38)
  - Intel(R) 8 Series/C220 Series PCI Express Root Port #3 - 8C14 (driver 10.1.1.38)
  - Intel(R) 8 Series/C220 Series SMBus Controller - 8C22 (driver 10.1.1.38)
  - Intel(R) 82802 Firmware Hub Device
  - Intel(R) B85 LPC Controller - 8C50 (driver 10.1.1.38)
  - Intel(R) Management Engine Interface  (driver 9.0.0.1287)
  - Microsoft ACPI-Compliant System
  - Microsoft System Management BIOS Driver
  - Microsoft Windows Management Interface for ACPI
  - Microsoft 虚拟驱动器枚举器驱动程序
  - Motherboard resources
  - Motherboard resources
  - Motherboard resources
  - Motherboard resources
  - Motherboard resources
  - Numeric data processor
  - PCI standard host CPU bridge
  - PCI standard PCI-to-PCI bridge
  - PCI 总线 (driver 2.5.3.34)
  - Plug and Play Software Device Enumerator
  - Printer Port Logical Interface
  - Programmable interrupt controller
  - Remote Desktop Device Redirector Bus
  - Scp Virtual Bus Driver (driver 1.0.0.103)
  - System board
  - System CMOS/real time clock
  - System timer
  - Terminal Server Keyboard Driver
  - Terminal Server Mouse Driver
  - UMBus Enumerator
  - UMBus Root Bus Enumerator
  - VMware VMCI Host Device (driver 9.8.6.0)
  - Volume Manager
  - 复合总线枚举器
  - 文件作为卷驱动程序
+ Universal Serial Bus controllers
  - Generic USB Hub
  - Generic USB Hub
  - Standard Enhanced PCI to USB Host Controller
  - Standard Enhanced PCI to USB Host Controller
  - USB Root Hub
  - USB Root Hub
  - 英特尔(R) USB 3.0 可扩展主机控制器 (driver 2.5.3.34)
  - 英特尔(R) USB 3.0 根集线器 (driver 2.5.3.34)

cpu registers:
eax = 00000003
ebx = 008b6000
ecx = 00000000
edx = 04c48d50
esi = 0260b3d8
edi = 04ce3580
eip = 00b53c87
esp = 0017f094
ebp = 0018f4e4

stack dump:
0017f094  00 00 00 00 00 00 00 00 - 80 35 ce 04 00 00 00 00  .........5......
0017f0a4  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0017f0b4  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0017f0c4  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0017f0d4  94 f4 18 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0017f0e4  80 64 8b 00 00 00 00 00 - 00 00 00 00 00 00 00 00  .d..............
0017f0f4  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0017f104  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0017f114  00 00 00 00 00 00 00 00 - c0 f4 18 00 00 00 00 00  ................
0017f124  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0017f134  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0017f144  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0017f154  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0017f164  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0017f174  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0017f184  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0017f194  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0017f1a4  00 00 00 00 00 00 00 00 - 01 00 00 00 00 00 00 00  ................
0017f1b4  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0017f1c4  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

disassembling:
[...]
0085c6da        mov     edx, [$8ac860]
0085c6e0        mov     [edx], eax
0085c6e2 9875   mov     eax, [$8ac860]
0085c6e7        mov     eax, [eax]
0085c6e9        mov     edx, [eax]
0085c6eb      > call    dword ptr [edx+$ec]
0085c6f1        xor     eax, eax
0085c6f3        pop     edx
0085c6f4        pop     ecx
0085c6f5        pop     ecx
0085c6f6        mov     fs:[eax], edx
[...]

