date/time         : 2009-02-14, 06:05:40, 593ms
computer name     : DATASERVER
user name         : <admin>
operating system  : Windows 2003 Service Pack 2 build 3790
system language   : English
system up time    : 2 days 18 hours
program up time   : 1 day 16 hours
processors        : 4x Intel(R) Xeon(R) CPU E5310 @ 1.60GHz
physical memory   : 1398/2043 MB (free/total)
free disk space   : (C:) 141.45 GB
display mode      : 1024x768, 16 bit
process id        : $bb0
allocated memory  : 6.73 MB
executable        : FlexMedSvc.exe
exec. date/time   : 2008-11-03 05:49
version           : 5.5.1.234
madExcept version : 3.0b beta 1
callstack crc     : $00000000, $00000000, $00000000
exception number  : 1
exception class   : ECSIdSocketError
exception message : Socket Error # 10054 Connection reset by peer.

thread $bd8:
>> stack not accessible, exception location:
004c8210 +70 FlexMedSvc.exe CSIdStackBSDBase +0 TCSIdStackBSDBase.RaiseSocketError

modules:
00400000 FlexMedSvc.exe 5.5.1.234     C:\Program Files\OCERIS\FlexMedical Client
4dc30000 msctfime.ime   5.2.3790.3959 C:\WINDOWS\system32
57b80000 Wship6.dll     5.2.3790.3959 C:\WINDOWS\system32
5aa20000 umdmxfrm.dll   5.2.3790.0    C:\WINDOWS\system32
5c830000 serwvdrv.dll   5.2.3790.3959 C:\WINDOWS\system32
5f270000 hnetcfg.dll    5.2.3790.3959 C:\WINDOWS\system32
71ae0000 wshtcpip.dll   5.2.3790.3959 C:\WINDOWS\System32
71b20000 mswsock.dll    5.2.3790.4318 C:\WINDOWS\System32
71b70000 UxTheme.dll    6.0.3790.3959 C:\WINDOWS\system32
71bb0000 wsock32.dll    5.2.3790.0    C:\WINDOWS\system32
71bf0000 WS2HELP.dll    5.2.3790.3959 C:\WINDOWS\system32
71c00000 WS2_32.dll     5.2.3790.3959 C:\WINDOWS\system32
75e60000 apphelp.dll    5.2.3790.3959 C:\WINDOWS\system32
76290000 IMM32.DLL      5.2.3790.3959 C:\WINDOWS\system32
762b0000 comdlg32.dll   6.0.3790.3959 C:\WINDOWS\system32
76aa0000 winmm.dll      5.2.3790.3959 C:\WINDOWS\system32
76ed0000 DNSAPI.dll     5.2.3790.4318 C:\WINDOWS\system32
76f10000 WLDAP32.dll    5.2.3790.3959 C:\WINDOWS\system32
76f50000 Secur32.dll    5.2.3790.3959 C:\WINDOWS\system32
76f70000 winrnr.dll     5.2.3790.3959 C:\WINDOWS\System32
77380000 USER32.dll     5.2.3790.4033 C:\WINDOWS\system32
77420000 comctl32.dll   6.0.3790.3959 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.3790.3959_x-ww_D8713E55
77670000 ole32.dll      5.2.3790.3959 C:\WINDOWS\system32
77b90000 version.dll    5.2.3790.3959 C:\WINDOWS\system32
77ba0000 msvcrt.dll     7.0.3790.3959 C:\WINDOWS\system32
77c00000 GDI32.dll      5.2.3790.4396 C:\WINDOWS\system32
77c50000 RPCRT4.dll     5.2.3790.4115 C:\WINDOWS\system32
77d00000 oleaut32.dll   5.2.3790.4202 C:\WINDOWS\system32
77da0000 SHLWAPI.dll    6.0.3790.3959 C:\WINDOWS\system32
77e40000 kernel32.dll   5.2.3790.4062 C:\WINDOWS\system32
77f50000 ADVAPI32.dll   5.2.3790.3959 C:\WINDOWS\system32
7c800000 ntdll.dll      5.2.3790.3959 C:\WINDOWS\system32
7c8d0000 shell32.dll    6.0.3790.4184 C:\WINDOWS\system32

processes:
000 Idle             0
004 System           0 normal
12c smss.exe         0 normal C:\WINDOWS\system32
160 csrss.exe        0 normal C:\WINDOWS\system32
17c winlogon.exe     0 high   C:\WINDOWS\system32
1ac services.exe     0 normal C:\WINDOWS\system32
1b8 lsass.exe        0 normal C:\WINDOWS\system32
25c svchost.exe      0 normal C:\WINDOWS\system32
2b4 svchost.exe      0 normal C:\WINDOWS\system32
2f4 svchost.exe      0 normal C:\WINDOWS\system32
318 svchost.exe      0 normal C:\WINDOWS\system32
328 svchost.exe      0 normal C:\WINDOWS\System32
3c4 msdtc.exe        0 normal C:\WINDOWS\system32
48c svchost.exe      0 normal C:\WINDOWS\system32
574 alg.exe          0 normal C:\WINDOWS\System32
5a0 svchost.exe      0 normal C:\WINDOWS\System32
1d8 svchost.exe      0 normal C:\WINDOWS\System32
95c fbguard.exe      0 normal C:\Program Files\Firebird\Firebird_1_5\bin
100 fbserver.exe     0 normal C:\Program Files\Firebird\Firebird_1_5\bin
a58 WinVNC.exe       0 normal C:\Program Files\UltraVNC
bb0 FlexMedSvc.exe   0 normal C:\Program Files\OCERIS\FlexMedical Client
9fc CSDispatcher.exe 0 normal C:\Program Files\Raize\CS4\Bin
8f4 zebedee.exe      0 normal C:\Program Files\Zebedee
544 csrss.exe        1 normal C:\WINDOWS\system32
9f0 winlogon.exe     1 high   C:\WINDOWS\system32
0b8 rdpclip.exe      1 normal C:\WINDOWS\system32
9d4 Explorer.EXE     1 normal C:\WINDOWS
604 BacsTray.exe     1 normal C:\Program Files\Broadcom\BACS
f34 ctfmon.exe       1 normal C:\WINDOWS\system32
b60 Uptime.exe       1 normal C:\Documents and Settings\All Users\Start Menu\Programs\Startup
7e4 avgtray.exe      1 normal C:\Program Files\AVG\AVG8
e54 avgwdsvc.exe     0 normal C:\PROGRA~1\AVG\AVG8
9a4 avgam.exe        0 normal C:\PROGRA~1\AVG\AVG8
de8 avgnsx.exe       0 normal C:\PROGRA~1\AVG\AVG8
fe0 IEXPLORE.EXE     1 normal C:\Program Files\Internet Explorer
c58 svchost.exe      0 normal C:\WINDOWS\system32
ba4 mmc.exe          1 normal C:\WINDOWS\system32
2d0 csrss.exe        3 normal C:\WINDOWS\system32
f9c avgrsx.exe       3 normal C:\Program Files\AVG\AVG8
e6c FMSERVER.EXE     0 normal C:\Program Files\OCERIS\FlexMedical Server
0c0 csrss.exe        2 normal C:\WINDOWS\system32
684 avgrsx.exe       2 normal C:\Program Files\AVG\AVG8
f18 csrss.exe        4 normal C:\WINDOWS\system32
a8c winlogon.exe     4 high   C:\WINDOWS\system32
7d8 avgrsx.exe       4 normal C:\Program Files\AVG\AVG8
a04 rdpclip.exe      4 normal C:\WINDOWS\system32
c14 Explorer.EXE     4 normal C:\WINDOWS
c0c BacsTray.exe     4 normal C:\Program Files\Broadcom\BACS
808 avgtray.exe      4 normal C:\PROGRA~1\AVG\AVG8
fd4 ctfmon.exe       4 normal C:\WINDOWS\system32
e50 Uptime.exe       4 normal C:\Documents and Settings\All Users\Start Menu\Programs\Startup
c44 mmc.exe          4 normal C:\WINDOWS\system32
68c wmiprvse.exe     0 normal C:\WINDOWS\system32\wbem
830 wuauclt.exe      1 normal C:\WINDOWS\system32
a64 wuauclt.exe      4 normal C:\WINDOWS\system32

cpu registers:
eax = 00f024f0
ebx = 00002746
ecx = 00f024f0
edx = 004c8210
esi = 004c8ae4
edi = 00000140
eip = 004c8210
esp = 0012fe60
ebp = 0012feb0

stack dump:
0012fe60  3d 6f de 00 08 27 eb 00 - 47 00 00 00 72 57 40 00  ?...4...G0@.t...
0012fe70  34 19 61 02 34 ff 12 00 - 73 00 00 00 00 00 13 00  .Z@...a.......D.
0012fe80  10 fe 12 00 03 00 00 00 - 00 91 44 00 c0 fe 12 00  4....V@.........
0012fe90  c4 fe 12 00 68 9b e0 00 - a4 fe 12 00 f9 91 44 00  ......D.......D.
0012fea0  f4 fe 12 00 04 ff 12 00 - 46 92 44 00 f4 fe 12 00  ........F.D.....
0012feb0  00 00 00 00 03 00 00 00 - 00 00 00 00 18 86 ec 00  ................
0012fec0  e8 85 ec 00 08 86 ec 00 - 48 b6 f0 00 18 b6 f0 00  ........H.......
0012fed0  00 f0 12 00 00 00 03 00 - 04 00 00 00 00 10 00 00  ................
0012fee0  00 10 00 00 04 00 00 00 - 00 00 02 00 0c 00 00 00  ................
0012fef0  34 ff 12 00 70 ff 12 00 - 58 96 44 00 70 ff 12 00  4...p...X.D.p...
0012ff00  70 ff 12 00 10 ff 12 00 - 62 98 44 00 70 ff 12 00  p.......b.D.p...
0012ff10  90 ff 12 00 d8 98 44 00 - 70 ff 12 00 00 00 00 00  ......D.p.......
0012ff20  80 99 e0 00 7c ff 12 00 - 00 00 00 00 00 00 00 00  ....|...........
0012ff30  00 00 00 00 88 1a 60 02 - 38 00 dd 00 00 00 00 00  ......`.8.......
0012ff40  00 00 00 00 30 e5 a5 80 - b0 2d 6e 88 00 00 00 00  ....0....-n.....
0012ff50  7c 7a 72 f7 00 00 00 00 - 04 00 00 00 00 00 00 00  |zr.............
0012ff60  70 b5 f0 00 00 e2 dd 00 - 00 00 00 00 05 00 00 00  p...............
0012ff70  80 ff 12 00 4b d1 44 00 - 80 99 e0 00 a8 93 44 00  ....K.D.......D.
0012ff80  b8 ff 12 00 90 d1 44 00 - a8 93 44 00 80 99 e0 00  ......D...D.....
0012ff90  9c ff 12 00 9d d1 44 00 - b8 ff 12 00 dc ff 12 00  ......D.........

date/time         : 2014-09-30, 21:17:06, 972ms
computer name     : DATASERVER
user name         : SYSTEM <admin>
registered owner  : Rainbow Family Med
operating system  : Windows 2003 R2 Service Pack 2 build 3790
system language   : English
system up time    : 18 days 14 hours
program up time   : 11 seconds
processors        : 4x Intel(R) Xeon(R) CPU E5310 @ 1.60GHz
physical memory   : 1046/2043 MB (free/total)
free disk space   : (C:) 1.35 GB
display mode      : 1024x768, 16 bit
process id        : $ddc
allocated memory  : 11.23 MB
executable        : FlexMedUpd.exe
exec. date/time   : 2014-09-30 18:23
version           : 7.0.1.8
compiled with     : Delphi XE
madExcept version : 3.0m beta 1
callstack crc     : $1aec43ca, $67ac73b0, $427a9f28
exception number  : 1
exception class   : EFCreateError
exception message : Cannot create file "C:\Program Files\OCERIS\FlexMedical Client\american.adm". The process cannot access the file because it is being used by another process.

main thread ($1218):
004a84b0 +0bc FlexMedUpd.exe Classes                       TFileStream.Create
004a83d0 +020 FlexMedUpd.exe Classes                       TFileStream.Create
0065150f +05f FlexMedUpd.exe uOSASLib              517  +7 OSASLib.CopyFile
0065dbda +196 FlexMedUpd.exe uOSASAppUpdateService 350 +27 TOSASAppUpdateService.InternalUpdateFiles
0065d5f6 +082 FlexMedUpd.exe uOSASAppUpdateService 253 +13 TOSASAppUpdateService.BeginUpdate
00697846 +07a FlexMedUpd.exe uServiceDataModule     85  +7 TServiceDataModule.TimerTimer
0051bd03 +00f FlexMedUpd.exe ExtCtrls                      TTimer.Timer
0051bbe7 +02b FlexMedUpd.exe ExtCtrls                      TTimer.WndProc
004b4d30 +014 FlexMedUpd.exe Classes                       StdWndProc
7739bacb +00a USER32.dll                                   DispatchMessageW
00535a77 +0f3 FlexMedUpd.exe Forms                         TApplication.ProcessMessage
00535aba +00a FlexMedUpd.exe Forms                         TApplication.HandleMessage
0053af06 +182 FlexMedUpd.exe SvcMgr                        TServiceApplication.Run
0053b321 +009 FlexMedUpd.exe uROComboService       112  +0 TROService.Run
0075de3a +0ee FlexMedUpd.exe FlexMedUpd            101 +17 initialization

thread $1300:
7c827b67 +a ntdll.dll  NtWaitForMultipleObjects

thread $17d0:
7c8276a7 +0a ntdll.dll                NtReplyWaitReceivePortEx
00463211 +0d FlexMedUpd.exe madExcept CallThreadProcSafe
0046327b +37 FlexMedUpd.exe madExcept ThreadExceptFrame
>> created by main thread ($1218) at:
77c740e2 +00 RPCRT4.dll

thread $e0c:
7c826db7 +0a ntdll.dll                NtDelayExecution
77e41ed3 +47 kernel32.dll             SleepEx
77e424f8 +0a kernel32.dll             Sleep
00463211 +0d FlexMedUpd.exe madExcept CallThreadProcSafe
0046327b +37 FlexMedUpd.exe madExcept ThreadExceptFrame
>> created by main thread ($1218) at:
776b1853 +00 ole32.dll

thread $400:
7739c83f +26 USER32.dll               GetMessageW
00463211 +0d FlexMedUpd.exe madExcept CallThreadProcSafe
0046327b +37 FlexMedUpd.exe madExcept ThreadExceptFrame
>> created by main thread ($1218) at:
776b1853 +00 ole32.dll

thread $1428:
7c827b77 +0a ntdll.dll                NtWaitForSingleObject
77e61d30 +82 kernel32.dll             WaitForSingleObjectEx
00463211 +0d FlexMedUpd.exe madExcept CallThreadProcSafe
0046327b +37 FlexMedUpd.exe madExcept ThreadExceptFrame
>> created by thread $400 at:
776b1853 +00 ole32.dll

thread $e44 (TROThreadTimer):
7c827b67 +0a ntdll.dll                         NtWaitForMultipleObjects
77e6203e +cc kernel32.dll                      WaitForMultipleObjectsEx
004b6602 +56 FlexMedUpd.exe SyncObjs           THandleObject.WaitFor
005aed31 +0d FlexMedUpd.exe uROClasses 1866 +5 TROThreadTimer.Execute
0046332f +2b FlexMedUpd.exe madExcept          HookedTThreadExecute
004b206a +42 FlexMedUpd.exe Classes            ThreadProc
004076a0 +28 FlexMedUpd.exe System      150 +0 ThreadWrapper
00463211 +0d FlexMedUpd.exe madExcept          CallThreadProcSafe
0046327b +37 FlexMedUpd.exe madExcept          ThreadExceptFrame
>> created by main thread ($1218) at:
005af0d0 +34 FlexMedUpd.exe uROClasses 2595 +5 TROInitializedThread.Create

thread $1088 (TROPipeListenerThread):
7c826f67 +00a ntdll.dll                                  NtFsControlFile
77e5c9f9 +045 kernel32.dll                               ConnectNamedPipe
005e3d8b +10f FlexMedUpd.exe uRONamedPipeServer  172 +47 TROPipeListenerThread.Execute
0046332f +02b FlexMedUpd.exe madExcept                   HookedTThreadExecute
004b206a +042 FlexMedUpd.exe Classes                     ThreadProc
004076a0 +028 FlexMedUpd.exe System              150  +0 ThreadWrapper
00463211 +00d FlexMedUpd.exe madExcept                   CallThreadProcSafe
0046327b +037 FlexMedUpd.exe madExcept                   ThreadExceptFrame
>> created by main thread ($1218) at:
005af0d0 +034 FlexMedUpd.exe uROClasses         2595  +5 TROInitializedThread.Create

thread $e7c (TServiceStartThread):
7c8275d7 +0a ntdll.dll                       NtReadFile
77e418b4 +61 kernel32.dll                    ReadFile
7d1e1ed4 +86 ADVAPI32.dll                    StartServiceCtrlDispatcherW
0053ad67 +07 FlexMedUpd.exe SvcMgr           TServiceStartThread.Execute
0046332f +2b FlexMedUpd.exe madExcept        HookedTThreadExecute
004b206a +42 FlexMedUpd.exe Classes          ThreadProc
004076a0 +28 FlexMedUpd.exe System    150 +0 ThreadWrapper
00463211 +0d FlexMedUpd.exe madExcept        CallThreadProcSafe
0046327b +37 FlexMedUpd.exe madExcept        ThreadExceptFrame
>> created by main thread ($1218) at:
0053acfb +4f FlexMedUpd.exe SvcMgr           TServiceStartThread.Create

thread $64c:
7c827b77 +0a ntdll.dll                NtWaitForSingleObject
77e61d30 +82 kernel32.dll             WaitForSingleObjectEx
77e61ca0 +0d kernel32.dll             WaitForSingleObject
004b2f44 +9c FlexMedUpd.exe Classes   TThread.WaitFor
0053a09d +75 FlexMedUpd.exe SvcMgr    TService.DoStart
00539fcb +93 FlexMedUpd.exe SvcMgr    TService.Main
0053a4cf +83 FlexMedUpd.exe SvcMgr    TServiceApplication.DispatchServiceMain
0053a2da +0e FlexMedUpd.exe SvcMgr    ServiceMain
00463211 +0d FlexMedUpd.exe madExcept CallThreadProcSafe
0046327b +37 FlexMedUpd.exe madExcept ThreadExceptFrame
>> created by thread $e7c (TServiceStartThread) at:
7d1f6085 +00 ADVAPI32.dll

thread $1588 (TServiceThread):
7739c83f +26 USER32.dll                      GetMessageW
00539804 +48 FlexMedUpd.exe SvcMgr           TServiceThread.ProcessRequests
00539681 +f1 FlexMedUpd.exe SvcMgr           TServiceThread.Execute
0046332f +2b FlexMedUpd.exe madExcept        HookedTThreadExecute
004b206a +42 FlexMedUpd.exe Classes          ThreadProc
004076a0 +28 FlexMedUpd.exe System    150 +0 ThreadWrapper
00463211 +0d FlexMedUpd.exe madExcept        CallThreadProcSafe
0046327b +37 FlexMedUpd.exe madExcept        ThreadExceptFrame
>> created by thread $64c at:
0053956f +1b FlexMedUpd.exe SvcMgr           TServiceThread.Create

modules:
00400000 FlexMedUpd.exe 7.0.1.8           C:\Program Files\OCERIS\FlexMedical Client
02510000 xpsp2res.dll   5.2.3790.3959     C:\WINDOWS\system32
10000000 STPLAYER.DLL                     C:\WINDOWS\SAFETP
40a90000 iertutil.dll   8.0.6001.23619    C:\WINDOWS\system32
40c80000 ieframe.dll    8.0.6001.23619    C:\WINDOWS\system32
4dc30000 msctfime.ime   5.2.3790.3959     C:\WINDOWS\system32
5aa20000 umdmxfrm.dll   5.2.3790.0        C:\WINDOWS\system32
5c830000 serwvdrv.dll   5.2.3790.3959     C:\WINDOWS\system32
5f270000 hnetcfg.dll    5.2.3790.3959     C:\WINDOWS\system32
6f350000 urlmon.dll     8.0.6001.23619    C:\WINDOWS\system32
71ae0000 wshtcpip.dll   5.2.3790.3959     C:\WINDOWS\System32
71b20000 mswsock.dll    5.2.3790.4318     C:\WINDOWS\system32
71b70000 UxTheme.dll    6.0.3790.3959     C:\WINDOWS\system32
71bb0000 wsock32.dll    5.2.3790.0        C:\WINDOWS\system32
71bd0000 mpr.dll        5.2.3790.3959     C:\WINDOWS\system32
71bf0000 WS2HELP.dll    5.2.3790.3959     C:\WINDOWS\system32
71c00000 WS2_32.dll     5.2.3790.3959     C:\WINDOWS\system32
71c40000 netapi32.dll   5.2.3790.5030     C:\WINDOWS\system32
71d00000 actxprxy.dll   6.0.3790.3959     C:\WINDOWS\system32
73070000 winspool.drv   5.2.3790.3959     C:\WINDOWS\system32
75360000 CRYPTUI.dll    5.131.3790.3959   C:\WINDOWS\system32
75e60000 apphelp.dll    5.2.3790.3959     C:\WINDOWS\system32
76190000 MSASN1.dll     5.2.3790.4584     C:\WINDOWS\system32
761b0000 CRYPT32.dll    5.131.3790.5362   C:\WINDOWS\system32
76280000 msimg32.dll    5.2.3790.0        C:\WINDOWS\system32
76290000 IMM32.DLL      5.2.3790.3959     C:\WINDOWS\system32
762b0000 comdlg32.dll   6.0.3790.3959     C:\WINDOWS\system32
766d0000 SHFolder.dll   6.0.3790.3959     C:\WINDOWS\system32
76aa0000 winmm.dll      5.2.3790.4916     C:\WINDOWS\system32
76b70000 PSAPI.dll      5.2.3790.3959     C:\WINDOWS\system32
76bb0000 WINTRUST.dll   5.131.3790.5060   C:\WINDOWS\system32
76c10000 imagehlp.dll   5.2.3790.5240     C:\WINDOWS\system32
76f10000 WLDAP32.dll    5.2.3790.3959     C:\WINDOWS\system32
76f50000 Secur32.dll    5.2.3790.4530     C:\WINDOWS\system32
77010000 COMRes.dll     2001.12.4720.3959 C:\WINDOWS\system32
77380000 USER32.dll     5.2.3790.4033     C:\WINDOWS\system32
77420000 comctl32.dll   6.0.3790.5190     C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.3790.5190_x-ww_319264BE
77670000 ole32.dll      5.2.3790.5209     C:\WINDOWS\system32
777b0000 CLBCatQ.DLL    2001.12.4720.3959 C:\WINDOWS\system32
77980000 shdocvw.dll    6.0.3790.4392     C:\WINDOWS\system32
77b90000 version.dll    5.2.3790.3959     C:\WINDOWS\system32
77ba0000 msvcrt.dll     7.0.3790.3959     C:\WINDOWS\system32
77c00000 GDI32.dll      5.2.3790.5418     C:\WINDOWS\system32
77c50000 RPCRT4.dll     5.2.3790.5254     C:\WINDOWS\system32
77e40000 kernel32.dll   5.2.3790.5295     C:\WINDOWS\system32
7c800000 ntdll.dll      5.2.3790.4937     C:\WINDOWS\system32
7c8d0000 shell32.dll    6.0.3790.5018     C:\WINDOWS\system32
7d0e0000 oleaut32.dll   5.2.3790.4807     C:\WINDOWS\system32
7d180000 SHLWAPI.dll    6.0.3790.5318     C:\WINDOWS\system32
7d1e0000 ADVAPI32.dll   5.2.3790.4555     C:\WINDOWS\system32

processes:
0000 Idle                  0 0   0
0004 System                0 0   0  normal
0134 smss.exe              0 0   0  normal C:\WINDOWS\system32
015c avgrsx.exe            0 0   0  normal C:\PROGRA~1\AVG\AVG2013
0280 csrss.exe             0 52  58 normal C:\WINDOWS\system32
029c winlogon.exe          0 41  15 high   C:\WINDOWS\system32
02cc services.exe          0 4   1  normal C:\WINDOWS\system32
02d8 lsass.exe             0 4   0  normal C:\WINDOWS\system32
0370 svchost.exe           0 4   0  normal C:\WINDOWS\system32
03cc svchost.exe           0 4   1  normal C:\WINDOWS\system32
0414 svchost.exe           0 5   1  normal C:\WINDOWS\system32
0424 svchost.exe           0 4   1  normal C:\WINDOWS\system32
0448 svchost.exe           0 5   22 normal C:\WINDOWS\System32
04d0 spoolsv.exe           0 13  9  normal C:\WINDOWS\system32
04f0 msdtc.exe             0 4   2  normal C:\WINDOWS\system32
0570 service.exe           0 4   1  normal C:\PROGRA~1\LabCorp
0580 mainserv.exe          0 8   4  normal C:\Program Files\APC\APC PowerChute Personal Edition
0588 LabCorp.exe           0 17  13 normal C:\PROGRA~1\LabCorp
05c8 avgwdsvc.exe          0 5   4  normal C:\Program Files\AVG\AVG2013
0608 dsm_sa_eventmgr32.exe 0 5   2  normal C:\Program Files\Dell\SysMgt\dataeng\bin
0610 inbox.exe             0 20  3  normal C:\Program Files\LabCorp
062c dsm_sa_datamgr32.exe  0 5   2  normal C:\Program Files\Dell\SysMgt\dataeng\bin
0674 svchost.exe           0 4   1  normal C:\WINDOWS\System32
0698 fbguard.exe           0 5   1  normal C:\Program Files\Firebird\Firebird_2_5\bin
0908 jqs.exe               0 5   2  idle   C:\Program Files\Java\jre6\bin
0944 mr2kserv.exe          0 4   3  normal C:\Program Files\Dell\SysMgt\sm
095c nassvc.exe            0 5   10 normal C:\Program Files\BUFFALO\NASNAVI
097c svchost.exe           0 4   2  normal C:\WINDOWS\System32
09e4 dsm_om_shrsvc32.exe   0 5   1  normal C:\Program Files\Dell\SysMgt\oma\bin
0a38 svchost.exe           0 4   2  normal C:\WINDOWS\System32
0a64 svchost.exe           0 4   0  normal C:\WINDOWS\system32
0a88 dsm_om_connsvc32.exe  0 5   2  normal C:\Program Files\Dell\SysMgt\iws\bin\win32
0a9c svchost.exe           0 4   3  normal C:\WINDOWS\system32
0ae0 svchost.exe           0 7   5  normal C:\WINDOWS\System32
0af0 WinVNC.exe            0 5   1  normal C:\Program Files\UltraVNC
0b70 zebedee.exe           0 4   3  normal C:\Program Files\Zebedee
0b90 fxssvc.exe            0 6   2  normal C:\WINDOWS\system32
0db4 LKBridgePRO.EXE       0 7   3  normal C:\LKBridge
0e58 svchost.exe           0 5   1  normal C:\WINDOWS\System32
0e88 fbserver.exe          0 5   1  normal C:\Program Files\Firebird\Firebird_2_5\bin
0f54 alg.exe               0 4   2  normal C:\WINDOWS\System32
0f60 WinVNC.exe            0 22  20 normal C:\Program Files\UltraVNC
0f90 wmiprvse.exe          0 6   6  normal C:\WINDOWS\system32\wbem
0680 BrYNSvc.exe           0 5   5  normal C:\Program Files\Browny02
0d04 avgidsagent.exe       0 5   1  normal C:\Program Files\AVG\AVG2013
0268 avgcsrvx.exe          0 0   0  normal C:\Program Files\AVG\AVG2013
0708 csrss.exe             4 0   0  normal C:\WINDOWS\system32
17a4 winlogon.exe          4 0   0  high   C:\WINDOWS\system32
11c0 rdpclip.exe           4 0   0  normal C:\WINDOWS\system32
07bc Explorer.EXE          4 0   0  normal C:\WINDOWS
0848 BacsTray.exe          4 0   0  normal C:\Program Files\Broadcom\BACS
1148 OrderReminder.exe     4 0   0  normal C:\Program Files\Hewlett-Packard\OrderReminder
13e4 avgui.exe             4 0   0  normal C:\Program Files\AVG\AVG2013
0510 BrStMonW.exe          4 0   0  normal C:\Program Files\Browny02\Brother
1468 BrstsWnd.exe          4 0   0  normal C:\Program Files\Brownie
1554 ctfmon.exe            4 0   0  normal C:\WINDOWS\system32
16d4 apcsystray.exe        4 0   0  normal C:\Program Files\APC\APC PowerChute Personal Edition
1604 calc.exe              4 0   0  normal C:\WINDOWS\system32
1060 scrnsave.scr          4 0   0  idle   C:\WINDOWS\system32
12d0 Explorer.EXE          0 172 96 normal C:\WINDOWS
13dc BacsTray.exe          0 14  14 normal C:\Program Files\Broadcom\BACS
15d8 OrderReminder.exe     0 11  3  normal C:\Program Files\Hewlett-Packard\OrderReminder
12a8 avgui.exe             0 100 62 normal C:\Program Files\AVG\AVG2013
1704 BrstsWnd.exe          0 94  72 normal C:\Program Files\Brownie
0aec ctfmon.exe            0 35  20 normal C:\WINDOWS\system32
00cc apcsystray.exe        0 11  8  normal C:\Program Files\APC\APC PowerChute Personal Edition
0670 FMSERVER.EXE          0 82  40 normal C:\Program Files\OCERIS\FlexMedical Server
08e4 FMFAXCLIENT.EXE       0 71  33 normal C:\Program Files\OCERIS\FlexMedical Fax
1328 FMEDICLIENT.EXE       0 70  54 normal C:\Program Files\OCERIS\FlexMedical EDI Client
17cc FlexMedUpdStatus.exe  0 41  32 normal C:\Program Files\OCERIS\FlexMedical Client
0ddc FlexMedUpd.exe        0 36  29 normal C:\Program Files\OCERIS\FlexMedical Client

hardware:
+ Batteries
  - APC Battery BackUP (driver 1.0.0.0)
+ Computer
  - ACPI Multiprocessor PC
+ Disk drives
  - DELL PERC 5/i SCSI Disk Device
+ Display adapters
  - ATI ES1000         (driver 8.24.3.0)
  - mv video hook driver2 (driver 1.1.0.0)
+ DVD/CD-ROM drives
  - PBDS CD-ROM DH-48N1P
+ Floppy disk controllers
  - Standard floppy disk controller
+ Human Interface Devices
  - American Power Conversion USB UPS
  - Logitech USB WheelMouse
  - USB Human Interface Device
  - USB Human Interface Device
  - USB Human Interface Device
+ IDE ATA/ATAPI controllers
  - Intel(R) 631xESB/6321ESB Ultra ATA Storage Controller - 269E (driver 7.3.0.1010)
  - Primary IDE Channel
+ Imaging devices
  - HP LJ M1522n Scan (driver 2.0.0.0)
+ Keyboards
  - HID Keyboard Device
  - HID Keyboard Device
+ Mice and other pointing devices
  - HID-compliant mouse
  - Logitech USB WheelMouse
+ Modems
  - PCI Soft Voice SoftRing Modem with SmartSP (driver 7.60.0.0)
+ Monitors
  - Plug and Play Monitor
+ Network adapters
  - Broadcom BCM5708C NetXtreme II GigE (NDIS VBD Client) (driver 4.4.15.0)
+ Ports (COM & LPT)
  - Communications Port (COM1)
  - Communications Port (COM2)
+ Processors
  - Intel(R) Xeon(R) CPU           E5310  @ 1.60GHz
  - Intel(R) Xeon(R) CPU           E5310  @ 1.60GHz
  - Intel(R) Xeon(R) CPU           E5310  @ 1.60GHz
  - Intel(R) Xeon(R) CPU           E5310  @ 1.60GHz
+ SCSI and RAID controllers
  - DELL PERC 5/i Integrated RAID Controller (driver 2.23.0.32)
+ Sound, video and game controllers
  - Audio Codecs
  - Legacy Audio Drivers
  - Legacy Video Capture Devices
  - Media Control Devices
  - Unimodem Half-Duplex Audio Device
  - Video Codecs
+ System devices
  - ACPI Fixed Feature Button
  - Broadcom BCM5708C NetXtreme II GigE (driver 4.4.23.0)
  - DELL PERC RAID Virtual Device (driver 2.23.0.32)
  - Direct memory access controller
  - High Precision Event Timer (driver 7.0.0.1011)
  - Intel(R) 5000 Series Chipset Error Reporting Registers - 25F0 (driver 7.3.0.1010)
  - Intel(R) 5000 Series Chipset Error Reporting Registers - 25F0 (driver 7.3.0.1010)
  - Intel(R) 5000 Series Chipset Error Reporting Registers - 25F0 (driver 7.3.0.1010)
  - Intel(R) 5000 Series Chipset FBD Registers - 25F5 (driver 7.3.0.1010)
  - Intel(R) 5000 Series Chipset FBD Registers - 25F6 (driver 7.3.0.1010)
  - Intel(R) 5000 Series Chipset PCI Express x4 Port 2 - 25E2 (driver 7.3.0.1010)
  - Intel(R) 5000 Series Chipset PCI Express x4 Port 3 - 25E3 (driver 7.3.0.1010)
  - Intel(R) 5000 Series Chipset PCI Express x4 Port 4 - 25E4 (driver 7.3.0.1010)
  - Intel(R) 5000 Series Chipset PCI Express x4 Port 5 - 25E5 (driver 7.3.0.1010)
  - Intel(R) 5000 Series Chipset PCI Express x4 Port 7 - 25E7 (driver 7.3.0.1010)
  - Intel(R) 5000 Series Chipset PCI Express x8 Port 6-7 - 25F9 (driver 7.3.0.1010)
  - Intel(R) 5000 Series Chipset Reserved Registers - 25F1 (driver 7.3.0.1010)
  - Intel(R) 5000 Series Chipset Reserved Registers - 25F3 (driver 7.3.0.1010)
  - Intel(R) 5000P Chipset Memory Controller Hub - 25D8 (driver 7.3.0.1010)
  - Intel(R) 6311ESB/6321ESB PCI Express Downstream Port E1 - 3510 (driver 7.3.0.1010)
  - Intel(R) 6311ESB/6321ESB PCI Express Downstream Port E2 - 3514 (driver 7.3.0.1010)
  - Intel(R) 6311ESB/6321ESB PCI Express to PCI-X Bridge - 350C (driver 7.3.0.1010)
  - Intel(R) 6311ESB/6321ESB PCI Express Upstream Port - 3500 (driver 7.3.0.1010)
  - Intel(R) 631xESB/6321ESB LPC Interface Controller - 2670 (driver 7.3.0.1010)
  - Intel(R) 631xESB/6321ESB PCI Express Root Port 1 - 2690 (driver 7.3.0.1010)
  - Intel(R) 82801 PCI Bridge - 244E (driver 7.0.0.1011)
  - ISAPNP Read Data Port
  - Logical Disk Manager
  - Microcode Update Device
  - Microsoft ACPI-Compliant System
  - Microsoft Composite Battery
  - Microsoft System Management BIOS Driver
  - Motherboard resources
  - Numeric data processor
  - PCI bus
  - PCI standard PCI-to-PCI bridge
  - PCI standard PCI-to-PCI bridge
  - PCI standard PCI-to-PCI bridge
  - Plug and Play Software Device Enumerator
  - Programmable interrupt controller
  - System board
  - System board
  - System board
  - System board
  - System CMOS/real time clock
  - System Management Device (driver 5.9.0.6019)
  - System timer
  - Terminal Server Device Redirector
  - Terminal Server Keyboard Driver
  - Terminal Server Mouse Driver
  - Volume Manager
+ Universal Serial Bus controllers
  - Generic USB Hub
  - Generic USB Hub
  - Intel(R) 631xESB/6321ESB USB Universal Host Controller - 2688 (driver 7.3.0.1010)
  - Intel(R) 631xESB/6321ESB USB Universal Host Controller - 2689 (driver 7.3.0.1010)
  - Intel(R) 631xESB/6321ESB USB Universal Host Controller - 268A (driver 7.3.0.1010)
  - Intel(R) 631xESB/6321ESB USB Universal Host Controller - 268B (driver 7.3.0.1010)
  - Intel(R) 631xESB/6321ESB USB2 Enhanced Host Controller - 268C (driver 7.3.0.1010)
  - USB Composite Device
  - USB Root Hub
  - USB Root Hub
  - USB Root Hub
  - USB Root Hub
  - USB Root Hub

disassembling:
[...]
006514fe       mov     fs:[edx], esp
00651501 517   push    $ff00
00651506       mov     ecx, esi
00651508       mov     dl, 1
0065150a       mov     eax, [$49a4c0]
0065150f     > call    -$1a9164 ($4a83b0)     ; Classes.TFileStream.Create
00651514       mov     [ebp-8], eax
00651517 518   xor     edx, edx
00651519       push    ebp
0065151a       push    $651572                ; System.@HandleFinally
0065151f       push    dword ptr fs:[edx]
[...]

